Threat Feeds
Access real-time threat intelligence feeds from multiple sources. Integrate directly into your security stack via API or download for offline analysis.
Available Feeds
URLhaus
Malware URLsMalware distribution URLs collected and shared by abuse.ch
BetterPhish
PhishingAggregated phishing URLs from multiple sources with ML-enhanced detection
Malware Bazaar
File HashesMalware samples and file hashes from the security community
Feodo Tracker
Botnet C2Botnet C2 infrastructure tracking for banking trojans
SSL Blocklist
SSL CertificatesSSL certificates associated with malware and botnet activity
Threat Fox
Mixed IOCsIOCs shared by the infosec community (IPs, domains, URLs)
DarkAPI Curated
CuratedPremium curated feed combining all sources with ML-enriched context
Ransomware Tracker
RansomwareActive ransomware infrastructure and payment addresses
API Access
Access threat feeds programmatically using the DarkAPI REST API:
# Get URLhaus feed
curl -X GET "https://api.darkapi.io/v1/feeds/urlhaus" \
-H "Authorization: Bearer YOUR_API_KEY"
# Get feed with filters
curl -X GET "https://api.darkapi.io/v1/feeds/urlhaus?limit=1000&since=24h" \
-H "Authorization: Bearer YOUR_API_KEY"
# Get feed stats
curl -X GET "https://api.darkapi.io/v1/feeds/stats" \
-H "Authorization: Bearer YOUR_API_KEY"CLI Access
Download feeds directly from the command line:
# List available feeds
darkapi feed list
# Download URLhaus feed as JSON
darkapi feed download urlhaus --format json -o urlhaus.json
# Download with time filter
darkapi feed download urlhaus --since 24h --format csv
# Stream feed updates
darkapi feed stream urlhaus --format jsonIntegrations
SIEM Integration
Native integrations with Splunk, Elastic, and QRadar for automated IOC ingestion.
MISP Compatible
Export feeds in MISP format for sharing with threat intelligence platforms.
STIX/TAXII
Standards-compliant STIX 2.1 bundles available via TAXII server.
Get Started with Threat Feeds
Create a free account to access threat feeds via API, CLI, or the web console. Upgrade to Pro for premium feeds and higher rate limits.