Threat Feeds

Access real-time threat intelligence feeds from multiple sources. Integrate directly into your security stack via API or download for offline analysis.

2M+
Total Indicators
8
Active Feeds
Real-time
Updates
99.9%
Uptime SLA

Available Feeds

URLhaus

Malware URLs
Free

Malware distribution URLs collected and shared by abuse.ch

Update Frequency
Real-time
Indicators
100,000+
JSONCSVSTIX

BetterPhish

Phishing
Free

Aggregated phishing URLs from multiple sources with ML-enhanced detection

Update Frequency
Every 15 minutes
Indicators
50,000+
JSONCSV

Malware Bazaar

File Hashes
Free

Malware samples and file hashes from the security community

Update Frequency
Real-time
Indicators
1M+
JSONCSVSTIX

Feodo Tracker

Botnet C2
Free

Botnet C2 infrastructure tracking for banking trojans

Update Frequency
Every 5 minutes
Indicators
10,000+
JSONCSV

SSL Blocklist

SSL Certificates
Free

SSL certificates associated with malware and botnet activity

Update Frequency
Daily
Indicators
25,000+
JSONCSV

Threat Fox

Mixed IOCs
Free

IOCs shared by the infosec community (IPs, domains, URLs)

Update Frequency
Real-time
Indicators
500,000+
JSONCSVSTIX

DarkAPI Curated

Curated
Pro

Premium curated feed combining all sources with ML-enriched context

Update Frequency
Real-time
Indicators
2M+
JSONCSVSTIXMISP

Ransomware Tracker

Ransomware
Pro

Active ransomware infrastructure and payment addresses

Update Frequency
Every 30 minutes
Indicators
15,000+
JSONCSV

API Access

Access threat feeds programmatically using the DarkAPI REST API:

# Get URLhaus feed
curl -X GET "https://api.darkapi.io/v1/feeds/urlhaus" \
  -H "Authorization: Bearer YOUR_API_KEY"

# Get feed with filters
curl -X GET "https://api.darkapi.io/v1/feeds/urlhaus?limit=1000&since=24h" \
  -H "Authorization: Bearer YOUR_API_KEY"

# Get feed stats
curl -X GET "https://api.darkapi.io/v1/feeds/stats" \
  -H "Authorization: Bearer YOUR_API_KEY"
View full API documentation →

CLI Access

Download feeds directly from the command line:

# List available feeds
darkapi feed list

# Download URLhaus feed as JSON
darkapi feed download urlhaus --format json -o urlhaus.json

# Download with time filter
darkapi feed download urlhaus --since 24h --format csv

# Stream feed updates
darkapi feed stream urlhaus --format json
View CLI documentation →

Integrations

SIEM Integration

Native integrations with Splunk, Elastic, and QRadar for automated IOC ingestion.

MISP Compatible

Export feeds in MISP format for sharing with threat intelligence platforms.

STIX/TAXII

Standards-compliant STIX 2.1 bundles available via TAXII server.

Get Started with Threat Feeds

Create a free account to access threat feeds via API, CLI, or the web console. Upgrade to Pro for premium feeds and higher rate limits.

Create Free AccountView Pricing