Open Threat Intel Feed

Deduplicated IOCs aggregated from 0 open-source feeds

Filters

Public IOC API

No auth required

Pull the full deduplicated indicator list programmatically. All filters below combine.

All IOCs as JSONGET /api/iocs

Plain-text blocklist (values only)GET /api/iocs?format=txt

CSV downloadGET /api/iocs?format=csv

STIX 2.1 bundleGET /api/iocs?format=stix

Only malicious IPsGET /api/iocs?type=ip&format=txt

Phishing URLsGET /api/iocs?type=url&threat=phishing

Updated since a dateGET /api/iocs?since=2026-01-01

PaginationGET /api/iocs?limit=5000&offset=5000

Public feed + YOUR personal feed (add your key)GET /api/iocs?key=vciso_yourkey

Community data API

No auth - free

Everything on the homepage as open JSON: ransomware victims, news/advisories/CVEs, and darkweb-marketplace metadata. Built for the community.

Ransomware victims (name, group, country, dates, source)GET /api/victims

Filter victimsGET /api/victims?country=AU&source=ransomware.live&days=30

Victim analytics (by group/country/sector/month)GET /api/victims/analytics

News, advisories, CVEs & darkweb (last 24h)GET /api/incidents?hours=24

Darkweb marketplaces (metadata only - no .onion)GET /api/darkweb/markets

curl - pipe IPs into a firewall

curl -s /api/iocs?type=ip&format=txt

Query parameters

format · type · threat · feed · since · limit · offset