Threat Intelligence Feed

TTPS AND IOCS

Machine-readable indicators of compromise mapped to MITRE ATT&CK — aggregated from public sources, deduplicated, scored, filtered for false positives and expired automatically. Updated hourly.

cu-intel ~ $ connecting...
root@cu:~#

Feeds

Plain-text blocklists for firewalls and DNS filters; JSON and CSV for SIEMs and TIPs.
FeedFormatEntriesSizeURL
Loading...

Browse

Indicators seen in the last 48 hours. Values are defanged for display; copy gives you the real value.

Type

Family

Confidence

Loading...Pulling the latest indicators.

How it works

Scoring & expiry

  • Loading...

False-positive control

Every indicator is checked against curated MISP warning lists. Public DNS, CDNs, top-ranked domains and similar infrastructure are never published. Shared cloud ranges are published with a warning and kept off the blocklists unless confidence is 90+.

    Use it

    Point a URL alias / external list at a blocklist (pfBlockerNG, OPNsense, Pi-hole, EDLs), or pull JSON on a schedule:

    
            
    
        
    
    
    

    
    
        
    
            
    Sources
    
            Credit where it's due. These projects do the hard collection work.
        
    
        
    
            
    
                
    SourceLicenseUse hereLast update
    
                
            
    
        
    
    
    

    
    
        Provided as-is, without warranty, for defensive use. Indicators are aggregated from third-party sources and can be wrong or go stale;
        validate before blocking in production. Technique mappings come from MITRE ATT&CK® software profiles for each malware family.