Feeds

Machine-readable blocklists of high-risk indicators. Rate limits may apply. See API docs for feed parameters and examples.

Dynamic feeds

Scored in real time. Capped at 10 000 entries. Supports ?min_score=, ?limit=, and ?type=ipv4|ipv6|domain.

/feeds/high-risk JSON — structured records for SIEMs and automation

/feeds/high-risk.csv CSV — spreadsheet-friendly columns

/feeds/high-risk.txt Plain text — one indicator per line, ideal for blocklists

Pre-generated every 15 minutes. No cap, no query parameters. Split by address family for direct firewall import.

/feeds/high-risk-full-ipv4.txt All high-risk IPv4 addresses, sorted numerically

/feeds/high-risk-full-ipv6.txt All high-risk IPv6 addresses, sorted numerically