Important
This repository is being retired. Over the next few months the public feeds here will be wound down and moved to a private feed for personal IOC subscribers only.
Move to ThreatCull. It is the self-hosted successor to this project: the same multi-source scoring and confidence tiers, run on your own hardware, with your own sources and allowlists. See Migrating to ThreatCull.
📢 Update: Blocklists are now served from Cloudflare R2 for faster global delivery and reduced latency. Use the download links below instead of raw GitHub URLs.
ThreatCull is a self-hosted threat-feed compiler built from the pipeline behind this repo. It downloads public blocklists, drops duplicates, private ranges and your own infrastructure, scores each indicator by how many independent sources list it, and serves the result to your firewalls, DNS servers and SIEM.
| This repo | ThreatCull |
|---|---|
| Fixed source list chosen for you | Source catalog with licence details, plus your own URLs or local files |
| CDN whitelist only | Built-in CDN allowlists, your own entries and allowlist URLs, alerts when a source lists your network |
| Plain text lists | Plain, hosts, AdGuard, RPZ, CSV or JSON, each at its own tokenised URL |
| Updates on this repo's schedule | Built-in scheduler, web UI, dashboard, lookup and run history |
Quick start (Docker Compose, amd64 and arm64):
curl -fsSLO https://raw.githubusercontent.com/spydisec/threatcull/main/docker-compose.yaml
# set THREATCULL_ADMIN_PASSWORD (12+ characters) in docker-compose.yaml
docker compose up -dOpen http://<server-ip>:6969, enable sources, rotate a Feed Token on Outputs, then point your firewall or DNS server at the feed URL instead of the spydisec.com lists below. Full docs: ThreatCull README.
Comprehensive threat intelligence blocklists aggregated from multiple OSINT sources, honeypot networks, and C2 trackers. Multi-source validation, confidence-based tiers, and CDN-aware whitelisting.
📑 Quick Links: ThreatCull • IP Blocklists • Domain Blocklists • Sources • Credits
⚠️ License Notice: Each OSINT feed is governed by its own terms. Users must review original source documentation for specific licensing details.
Confidence-based tiers with multi-source validation
| Tier | Blocklist | Download |
|---|---|---|
| 🎯 High | High Confidence (Limited ~5K) | 📥 Download |
| 🎯 High | High Confidence (Unlimited) | 📥 Download |
| ⚖️ Medium | Medium Confidence (Limited ~25K) | 📥 Download |
| ⚖️ Medium | Medium Confidence (Unlimited) | 📥 Download |
| 🔬 Low | Low Confidence (All Others) | 📥 Download |
| 📊 Research | Full Research Blocklist | 📥 Download |
| 🗄️ Archive | Permanent (Append-Only) | 📥 Download |
🔍 Confidence Scoring Details
Multi-Source Validation: IPs are scored by how many independent threat intelligence sources report them.
| Tier | Threshold | Description |
|---|---|---|
| 🎯 High Limited | 5+ sources | Strictest tier - confirmed malicious across 5+ feeds |
| 🎯 High Unlimited | 3+ sources | High confidence - validated by 3+ independent sources |
| ⚖️ Medium | 2+ sources | Medium confidence - corroborated by 2 sources |
| 🔬 Low | 1 source | Single-source reports - use with caution |
Example: An IP reported by ThreatFox, Feodo Tracker, IPsum, CINS Score, and Blocklist.de would have source_count=5 → appears in High Limited.
Whitelist Protection: CDN ranges (Cloudflare, Akamai, Fastly, Tailscale) are automatically excluded to prevent false positives.
Independent category processing - import any/all into Pi-hole/AdGuard
| Category | Blocklist | Download |
|---|---|---|
| 🛡️ Security | Malicious Domains | 📥 Download |
| 📧 Spam | Spam/Scam/Abuse Domains | 📥 Download |
| 📺 Privacy | Ads & Tracking Domains | 📥 Download |
| 🗄️ Archive | Permanent Domains (Append-Only) | 📥 Download |
Reduce false positives using these curated lists:
| Name | Purpose | Raw URL |
|---|---|---|
| Removed IPs | Legitimate IPs removed from blocklists | 📥 Raw |
| Whitelisted IPs | Critical infrastructure IPs (Cloudflare, Akamai, Fastly) | 📥 Raw |
| Community IPs | Community-submitted IP whitelist | 📥 Raw |
| Community Domains | Community-submitted domain whitelist | 📥 Raw |
💡 Found a false positive? Submit a Whitelist IP Request or Whitelist Domain Request — automated validation and processing via GitHub Actions.
- Actively monitored infrastructure across 50+ threat actors:
🔍 Expand Threat Catalog
| C2s | Malware | Botnets |
|---|---|---|
| Cobalt Strike | AcidRain Stealer | 7777 |
| Metasploit Framework | Misha Stealer (AKA Grand Misha) | BlackNET |
| Covenant | Patriot Stealer | Doxerina |
| Mythic | RAXNET Bitcoin Stealer | Scarab |
| Brute Ratel C4 | Titan Stealer | 63256 |
| Posh | Collector Stealer | Kaiji |
| Sliver | Mystic Stealer | MooBot |
| Deimos | Gotham Stealer | Mozi |
| PANDA | Meduza Stealer | |
| NimPlant C2 | Quasar RAT | |
| Havoc C2 | ShadowPad | |
| Caldera | AsyncRAT | |
| Empire | DcRat | |
| Ares | BitRAT | |
| Hak5 Cloud C2 | DarkComet Trojan | |
| Pantegana | XtremeRAT Trojan | |
| Supershell | NanoCore RAT Trojan | |
| Poseidon C2 | Gh0st RAT Trojan | |
| Viper C2 | DarkTrack RAT Trojan | |
| Vshell | njRAT Trojan | |
| Villain | Remcos Pro RAT Trojan | |
| Nimplant C2 | Poison Ivy Trojan | |
| RedGuard C2 | Orcus RAT Trojan | |
| Oyster C2 | ZeroAccess Trojan | |
| byob C2 | HOOKBOT Trojan | |
| RisePro Stealer | ||
| NetBus Trojan | ||
| Bandit Stealer | ||
| Mint Stealer | ||
| Mekotio Trojan | ||
| Gozi Trojan | ||
| Atlandida Stealer | ||
| VenomRAT | ||
| Orcus RAT | ||
| BlackDolphin | ||
| Artemis RAT | ||
| Godzilla Loader | ||
| Jinx Loader | ||
| Netpune Loader | ||
| SpyAgent | ||
| SpiceRAT | ||
| Dust RAT | ||
| Pupy RAT | ||
| Atomic Stealer | ||
| Lumma Stealer | ||
| Serpent Stealer | ||
| Axile Stealer | ||
| Vector Stealer | ||
| Z3us Stealer | ||
| Rastro Stealer | ||
| Darkeye Stealer | ||
| AgniStealer | ||
| Epsilon Stealer | ||
| Bahamut Stealer | ||
| Unam Web Panel / SilentCryptoMiner | ||
| Vidar Stealer | ||
| Kraken RAT | ||
| Bumblebee Loader | ||
| Viper RAT | ||
| Spectre Stealer |
- Sources: Curated feeds including C2 servers, honeypot data, Mass-scanners, and OSINT feeds.
📚 View Full Source List
| Sources | Source URL |
|---|---|
| C2 IP Feed | C2_iplist.txt |
| Honeypot Master list | honeypot_iplist.txt |
| maltrail_scanners | maltrail_ips.txt |
| botvrij_eu | botvrij_eu |
| feodotracker | feodotracker |
| feodotracker_recommended | feodotracker_recommended |
| Blocklist_de_all | Blocklist_de_all |
| ThreatView_High_Confidence | ThreatView_High_Confidence |
| IPsumLevel_7 | IPsumLevel7 |
| CINS_Score | CINS_Score |
| DigitalSide | DigitalSide |
| duggytuxy | duggytuxy |
| etnetera.cz | etnetera.cz |
| emergingthreats-compromised | ET_Comp |
| greensnow.co | greensnow.co |
| Threatfox | Threatfox |
| More coming Soon! | Future Updates |
- Whitelist Coverage Matrix:
View Whitelist Sources 🛡️
| Provider | Type | Coverage | Source Link |
|---|---|---|---|
| Cloudflare | CDN IPv4/IPv6 | Global CDN | Cloudflare IPs |
| Akamai | CDN IPv4/IPv6 | Global CDN & Shield IPs | Akamai IPs |
| Fastly | CDN IPv4/IPv6 | Global CDN | Fastly IPs |
| Tailscale | DERP & Control Panel | Relay servers and control plane | Tailscale DERP |
| Uptime Robot | IPv4 | UptimeRobot Monitoring | UptimeRobot IPs |
Gratitude to our OSINT partners This project stands on the shoulders of these valuable resources:
- Abuse.ch - Feodo Tracker
- Botvrij.eu - Threat Intelligence
- Blocklist.de - Attack Data
- CINS Army - Threat Scoring
- DigitalSide - Italian CERT
- ...and 10+ other community maintainers
Special Thanks to MontySecurity for their C2 Tracker framework and elliotwutingfeng for Inversion DNSBL Blocklists.
Help us build the most reliable threat intelligence feed in the open-source community! 🚀
We welcome contributions from security researchers, network administrators, and cybersecurity enthusiasts to enhance this resource for:
- 🏠 Individuals: Strengthen personal network security with accurate blocklists
- 🏢 SMBs: Deploy cost-effective threat blocking without enterprise overhead
- 🏗️ Enterprises: Integrate scalable, production-ready threat intelligence
We're particularly interested in contributions that help us:
- 🔄 Deduplication: Eliminate redundant entries across multiple feeds
- 🎯 False Positive Reduction: Identify and remove legitimate IPs/domains incorrectly flagged
- ✅ Validation: Flag outdated indicators or confirm active threats
- 🏷️ Context Enhancement: Add threat actor attribution, geolocation tags, or threat categories
- ⚡ Automation: Suggest workflow improvements for data processing and curation
Get involved in multiple ways:
- 📝 Request Whitelisting - Submit a Whitelist IP or Whitelist Domain request to report false positives (automated validation & processing)
- 🐛 Report Issues - Flag duplicates, false positives, or outdated entries in GitHub Issues
- 💬 Share Feedback - Help improve enterprise/SMB integration patterns and use cases
- 📚 Documentation - Enhance guides for non-technical users and integration tutorials
- 🔧 Code Contributions - Improve processing scripts, add new data sources, or enhance automation
Every contribution helps make cybersecurity more accessible and effective for everyone! 🌐
📧 Email: spydisec@proton.me