OpenCTI Integration Feeds Library

Damian Skeeles
Threatview.io - C2 Hunt Feed
June 26, 2025
Threat Intelligence
Detection & prevention sources
CobaltStrike
A list of CobaltStrike Infrastructure from https://threatview.io/Downloads/High-Confidence-CobaltStrike-C2 -Feeds.txt
PUBLISHED
Damian Skeeles
James Brine Threat Feed Endpoint
June 26, 2025
Detection & prevention sources
Threat Intelligence
A list of IPs observed attempting brute force attacks, from https://jamesbrine.com.au/csv
PUBLISHED
Damian Skeeles
Emerging Threats Blockrules Compromised IPs
June 26, 2025
Threat Intelligence
Detection & prevention sources
Proactive Security
This text feed and mapper ingests recently reported compromised IPs from https://rules.emergingthreats.net/blockrules/compromised-ips.txt
PUBLISHED
Damian Skeeles
Threatview.io - Bitcoin Address Intel
June 26, 2025
Threat Intelligence
cryptocurrency
A list of malicious Cryptocurrency Wallets from https://threatview.io/Downloads/MALICIOUS-BITCOIN_FEED.txt
PUBLISHED
Jean-Philippe Salles
Dan.me.uk (EXIT Nodes only)
June 26, 2025
Detection & prevention sources
Ingest IPs: The IP list provided by dan.me.uk contains addresses known to be used by TOR nodes. This list contains only IPs linked to EXIT nodes of the TOR infrastructure.
PUBLISHED
Nicolas Quintin
Dan.me.uk (All TOR nodes)
June 26, 2025
Detection & prevention sources
Ingest IPs: The IP list provided by dan.me.uk contains addresses known to be used by TOR nodes. These nodes are often hosted on cloud infrastructure or by hosting providers such as AWS, Azure, Hetzner, and others.
PUBLISHED
Nicolas Quintin
Spamhaus DROP list
June 25, 2025
Detection & prevention sources
Ingest IPs with SBL record ID in description: The Spamhaus DROP list (Don't Route Or Peer) is a list of IP address ranges controlled by threat actors and used exclusively for malicious activity, such as spam, malware distribution, and botnet operati
PUBLISHED
Jermain Njemanze
Blocklist.de
June 25, 2025
stream consumer sources
Threat Intelligence
This CSV feed and mapper ingests the latest IP addresses reported on www.blocklist.de
PUBLISHED