A free threat feed from our honeypots.

Pull the lists

Plain text, one indicator per line, comment lines start with #. Safe to poll every five minutes.

• blackpot.io/threat-feed/ips.txt

  IPs we reported to AbuseIPDB, one per line
  Copy URL Download
• blackpot.io/threat-feed/hashes.txt

  Malware SHA-256, one per line
  Copy URL Download
• blackpot.io/threat-feed/urls.txt

  Malware download URLs (live, not defanged)
  Copy URL Download
• blackpot.io/threat-feed/feed.json

  Everything, with first/last-seen dates
  Copy URL Download
• blackpot.io/threat-feed/stix.json

  STIX 2.1 bundle for OpenCTI, Sentinel and other TIPs
  Copy URL Download
• blackpot.io/threat-feed/misp/manifest.json

  MISP feed: add https://blackpot.io/threat-feed/misp, format "MISP Feed"
  Copy URL Download
• blackpot.io/taxii2/

  TAXII 2.1: API root https://blackpot.io/taxii2/api/, collection 0f5d8b3a-6c2e-4b1f-9a7d-3e8c1b2a4f60
  Copy URL Download

# IPv4 entries; IPv6 needs a second set with "family inet6"
ipset -exist create blackpot hash:ip
curl -s https://blackpot.io/threat-feed/ips.txt | grep -Ev '^#|:' | \
  xargs -r -I{} ipset -exist add blackpot {}
iptables -I INPUT -m set --match-set blackpot src -j DROP