threat-feeds

Extract and aggregate threat intelligence.

10-20x more blocks for your CrowdSec bouncers — 120k+ IPs from 32 free threat feeds

本项目致力于收集网上公开来源的威胁情报，主要关注信誉类威胁情报（如IP/域名等），以及事件类威胁情报。

Threat feeds designed to extract adversarial TTPs and IOCs, using: ✨AI✨

AI-Powered Security Feed in Real Time

Scripts for importing threat feeds and CTI articles, blogs, and reports into MISP.

Threat-feed IP block automation for Linux and macOS firewalls (iptables, nftables, pf) with cron-ready updates, dry-run previews, and package releases.

Automated IPv4 threat intelligence: combined blacklist from 100+ feeds with confidence scoring. Updated every 3h.

Automated threat intelligence collector built with Python and GitHub Actions — fetches recent IOCs from open sources, normalizes and enriches them (IP, URL, hash, CVE), and publishes ready-to-use feeds in CSV, JSON, and STIX formats.

Scrapes a list of Payload Domains, IOC's & C2 IPs from from various feeds for easy blacklisting.

🦅 Use fingerprinting to actively hunt for Command and Control servers on Shodan. Process threat feeds from Abuse.ch services to create a local database of C2 servers.

Easily manage blocking any external threat across all your FortiGate firewalls within a minute.

Automatically created C2 Feeds for Fortigate

Your daily summary of tracked changes for Webamon campaigns and emerging clusters seen across the web.

Automated phishing threat intelligence feed with URLs, IPs, domains, and IOC data.

Pi-hole inspired DNS blacklisting tool, integrates with FortiGate external connector threat feeds via the api

Deterministic, category-split threat-intelligence IP feeds (botnet C2, proxies, Tor, scanners, brute force) for OpenShield-XDP and any XDP/firewall consumer. Auto-rebuilt every 3 hours.

ThreatCull downloads public blocklists, drops duplicates, private ranges and your own infrastructure, scores each indicator by how many independent sources list it, and serves the result to your firewalls, DNS servers and SIEM.

Automated CVE ingestion, enrichment, and prioritization pipeline with real-time threat feeds | Built by Kirov Dynamics Team

Automated Human-in-the-Loop Threat Intelligence Pipeline leveraging LLMs for security data classification across 27 domains with built-in data poisoning mitigation.