Threat Intel List

Over 400 open-source threat intelligence feeds in one place!

Threat Intel List analyses and maintains a database containing threat intelligence from hundreds of security IP feeds, mainly related to online attacks, online service abuse, malware, botnets, command and control servers and other cybercrime activities.

The feeds are checked for updates every 30 minutes and any changes are immediately published. You can view the changes between updates (inc. added / removed intelligence) by clicking the last updated column for the selected feed. Note, whilst we check each feed every 30 minutes, updates to feeds can be published less frequently by maintainers. Check with each maintainer for update schedules.

You can download the raw data of each feed individually by selecting "Raw feed".

Alternatively, sign up for ThreatPipes to; automate the aggregation and de-duplication of all Threat Intel List feeds, enrich the downloaded indicators with additional meta-data (confidence, geo-lookups, etc.), and then sync the intelligence with your security tools. Sign up for a free trial of ThreatPipes here.

Question about Threat Intel List? Ask it on the community forum here.

Threat Exchange


The Threat Exchange is an online marketplace platform for buying, selling and sharing cyber threat intelligence feeds.

Browse the Exchanges

Name Category Number of Indicators Maintainer Last updated Raw feed ThreatPipes integration

Tweets by ThreatIntelList