Open Threat Intel Feed

Deduplicated IOCs aggregated from 0 open-source feeds

JSONCSVTXT
Filters
TypeIndicator

Public IOC API

No auth required

Pull the full deduplicated indicator list programmatically. All filters below combine.

All IOCs as JSONGET /api/iocs
Plain-text blocklist (values only)GET /api/iocs?format=txt
CSV downloadGET /api/iocs?format=csv
Only malicious IPsGET /api/iocs?type=ip&format=txt
Phishing URLsGET /api/iocs?type=url&threat=phishing
Updated since a dateGET /api/iocs?since=2026-01-01
PaginationGET /api/iocs?limit=5000&offset=5000
Try it — sample JSON response

curl — pipe IPs into a firewall

curl -s /api/iocs?type=ip&format=txt

Query parameters

format · type · threat · feed · since · limit · offset