spydisec/spydithreatintel
spydisec/spydithreatintel has 59 GitHub stars and 5 forks. Star changes are not measured yet. Last checked 2026-11-12 08:07 UTC. Last push 2026-11-12.
Spydi ThreatIntel Feed is built on open-source threat intelligence, community-maintained blocklists, and public security research.
实测星标增长
- 24小时
- 更新延迟
- 7天
- 更新延迟
- 15天
- 更新延迟
- 1个月
- 更新延迟
各周期内的星标净变化，周期相互重叠，并非每日新增。缺失的测量保持空白。星标代表关注度，不代表软件质量。
README.md
原文Spydi's ThreatIntel Feed 🛡️
[!IMPORTANT] This repository is being retired. Over the next few months the public feeds here will be wound down and moved to a private feed for personal IOC subscribers only.
Move to ThreatCull. It is the self-hosted successor to this project: the same multi-source scoring and confidence tiers, run on your own hardware, with your own sources and allowlists. See Migrating to ThreatCull.
📢 Update: Blocklists are now served from Cloudflare R2 for faster global delivery and reduced latency. Use the download links below instead of raw GitHub URLs.
🧭 Migrating to ThreatCull
ThreatCull is a self-hosted threat-feed compiler built from the pipeline behind this repo. It downloads public blocklists, drops duplicates, private ranges and your own infrastructure, scores each indicator by how many independent sources list it, and serves the result to your firewalls, DNS servers and SIEM.
| This repo | ThreatCull |
|---|---|
| Fixed source list chosen for you | Source catalog with licence details, plus your own URLs or local files |
| CDN whitelist only | Built-in CDN allowlists, your own entries and allowlist URLs, alerts when a source lists your network |
| Plain text lists | Plain, hosts, AdGuard, RPZ, CSV or JSON, each at its own tokenised URL |
| Updates on this repo's schedule | Built-in scheduler, web UI, dashboard, lookup and run history |
Quick start (Docker Compose, amd64 and arm64):
curl -fsSLO https://raw.githubusercontent.com/spydisec/threatcull/main/docker-compose.yaml
# set THREATCULL_ADMIN_PASSWORD (12+ characters) in docker-compose.yaml
docker compose up -d
Open http://<server-ip>:6969, enable sources, rotate a Feed Token on Outputs, then point your firewall or DNS server at the feed URL instead of the spydisec.com lists below. Full docs: ThreatCull README.
🚀 About
Comprehensive threat intelligence blocklists aggregated from multiple OSINT sources, honeypot networks, and C2 trackers. Multi-source validation, confidence-based tiers, and CDN-aware whitelisting.
📑 Quick Links: ThreatCull • IP Blocklists • Domain Blocklists • Sources • Credits
⚠️ License Notice: Each OSINT feed is governed by its own terms. Users must review original source documentation for specific licensing details.
🔥 IP Blocklists
Confidence-based tiers with multi-source validation
| Tier | Blocklist | Download |
|---|---|---|
| 🎯 High | High Confidence (Limited ~5K) | 📥 Download |
| 🎯 High | High Confidence (Unlimited) | 📥 Download |
| ⚖️ Medium | Medium Confidence (Limited ~25K) | 📥 Download |
| ⚖️ Medium | Medium Confidence (Unlimited) | 📥 Download |
| 🔬 Low | Low Confidence (All Others) | 📥 Download |
| 📊 Research | Full Research Blocklist | 📥 Download |
| 🗄️ Archive | Permanent (Append-Only) | 📥 Download |
🔍 Confidence Scoring Details
Multi-Source Validation: IPs are scored by how many independent threat intelligence sources report them.
| Tier | Threshold | Description |
|---|---|---|
| 🎯 High Limited | 5+ sources | Strictest tier - confirmed malicious across 5+ feeds |
| 🎯 High Unlimited | 3+ sources | High confidence - validated by 3+ independent sources |
| ⚖️ Medium | 2+ sources | Medium confidence - corroborated by 2 sources |
| 🔬 Low | 1 source | Single-source reports - use with caution |
Example: An IP reported by ThreatFox, Feodo Tracker, IPsum, CINS Score, and Blocklist.de would have source_count=5 → appears in High Limited.
Whitelist Protection: CDN ranges (Cloudflare, Akamai, Fastly, Tailscale) are automatically excluded to prevent false positives.
🌐 Domain Blocklists
Independent category processing - import any/all into Pi-hole/AdGuard
| Category | Blocklist | Download |
|---|---|---|
| 🛡️ Security | Malicious Domains | 📥 Download |
| 📧 Spam | Spam/Scam/Abuse Domains | 📥 Download |
| 📺 Privacy | Ads & Tracking Domains | 📥 Download |
| 🗄️ Archive | Permanent Domains (Append-Only) | 📥 Download |
📁 Whitelisting
Reduce false positives using these curated lists:
| Name | Purpose | Raw URL |
|---|---|---|
| Removed IPs | Legitimate IPs removed from blocklists | 📥 Raw |
| Whitelisted IPs | Critical infrastructure IPs (Cloudflare, Akamai, Fastly) | 📥 Raw |
| Community IPs | Community-submitted IP whitelist | 📥 Raw |
| Community Domains | Community-submitted domain whitelist | 📥 Raw |
💡 Found a false positive? Submit a Whitelist IP Request or Whitelist Domain Request — automated validation and processing via GitHub Actions.
🕵️ Tracked Threats & Source list
- Actively monitored infrastructure across 50+ threat actors:
🔍 Expand Threat Catalog
| C2s | Malware | Botnets |
|---|---|---|
| Cobalt Strike | AcidRain Stealer | 7777 |
| Metasploit Framework | Misha Stealer (AKA Grand Misha) | BlackNET |
| Covenant | Patriot Stealer | Doxerina |
| Mythic | RAXNET Bitcoin Stealer | Scarab |
| Brute Ratel C4 | Titan Stealer | 63256 |
| Posh | Collector Stealer | Kaiji |
| Sliver | Mystic Stealer | MooBot |
| Deimos | Gotham Stealer | Mozi |
| PANDA | Meduza Stealer | |
| NimPlant C2 | Quasar RAT | |
| Havoc C2 | ShadowPad | |
| Caldera | AsyncRAT | |
| Empire | DcRat | |
| Ares | BitRAT | |
| Hak5 Cloud C2 | DarkComet Trojan | |
| Pantegana | XtremeRAT Trojan | |
| Supershell | NanoCore RAT Trojan | |
| Poseidon C2 | Gh0st RAT Trojan | |
| Viper C2 | DarkTrack RAT Trojan | |
| Vshell | njRAT Trojan | |
| Villain | Remcos Pro RAT Trojan | |
| Nimplant C2 | Poison Ivy Trojan | |
| RedGuard C2 | Orcus RAT Trojan | |
| Oyster C2 | ZeroAccess Trojan | |
| byob C2 | HOOKBOT Trojan | |
| RisePro Stealer | ||
| NetBus Trojan | ||
| Bandit Stealer | ||
| Mint Stealer | ||
| Mekotio Trojan | ||
| Gozi Trojan | ||
| Atlandida Stealer | ||
| VenomRAT | ||
| Orcus RAT | ||
| BlackDolphin | ||
| Artemis RAT | ||
| Godzilla Loader | ||
| Jinx Loader | ||
| Netpune Loader | ||
| SpyAgent | ||
| SpiceRAT | ||
| Dust RAT | ||
| Pupy RAT | ||
| Atomic Stealer | ||
| Lumma Stealer | ||
| Serpent Stealer | ||
| Axile Stealer | ||
| Vector Stealer | ||
| Z3us Stealer | ||
| Rastro Stealer | ||
| Darkeye Stealer | ||
| AgniStealer | ||
| Epsilon Stealer | ||
| Bahamut Stealer | ||
| Unam Web Panel / SilentCryptoMiner | ||
| Vidar Stealer | ||
| Kraken RAT | ||
| Bumblebee Loader | ||
| Viper RAT | ||
| Spectre Stealer |
- Sources: Curated feeds including C2 servers, honeypot data, Mass-scanners, and OSINT feeds.
📚 View Full Source List
| Sources | Source URL |
|---|---|
| C2 IP Feed | C2_iplist.txt |
| Honeypot Master list | honeypot_iplist.txt |
| maltrail_scanners | maltrail_ips.txt |
| botvrij_eu | botvrij_eu |
| feodotracker | feodotracker |
| feodotracker_recommended | feodotracker_recommended |
| Blocklist_de_all | Blocklist_de_all |
| ThreatView_High_Confidence | ThreatView_High_Confidence |
| IPsumLevel_7 | IPsumLevel7 |
| CINS_Score | CINS_Score |
| DigitalSide | DigitalSide |
| duggytuxy | duggytuxy |
| etnetera.cz | etnetera.cz |
| emergingthreats-compromised | ET_Comp |
| greensnow.co | greensnow.co |
| Threatfox | Threatfox |
| More coming Soon! | Future Updates |
- Whitelist Coverage Matrix:
View Whitelist Sources 🛡️
| Provider | Type | Coverage | Source Link |
|---|---|---|---|
| Cloudflare | CDN IPv4/IPv6 | Global CDN | Cloudflare IPs |
| Akamai | CDN IPv4/IPv6 | Global CDN & Shield IPs | Akamai IPs |
| Fastly | CDN IPv4/IPv6 | Global CDN | Fastly IPs |
| Tailscale | DERP & Control Panel | Relay servers and control plane | Tailscale DERP |
| Uptime Robot | IPv4 | UptimeRobot Monitoring | UptimeRobot IPs |
🙌 Acknowledgements
Gratitude to our OSINT partners This project stands on the shoulders of these valuable resources:
- Abuse.ch - Feodo Tracker
- Botvrij.eu - Threat Intelligence
- Blocklist.de - Attack Data
- CINS Army - Threat Scoring
- DigitalSide - Italian CERT
- ...and 10+ other community maintainers
Special Thanks to MontySecurity for their C2 Tracker framework and elliotwutingfeng for Inversion DNSBL Blocklists.
🤝 Community Contributions
Help us build the most reliable threat intelligence feed in the open-source community! 🚀
We welcome contributions from security researchers, network administrators, and cybersecurity enthusiasts to enhance this resource for:
- 🏠 Individuals: Strengthen personal network security with accurate blocklists
- 🏢 SMBs: Deploy cost-effective threat blocking without enterprise overhead
- 🏗️ Enterprises: Integrate scalable, production-ready threat intelligence
🎯 Key Focus Areas
We're particularly interested in contributions that help us:
- 🔄 Deduplication: Eliminate redundant entries across multiple feeds
- 🎯 False Positive Reduction: Identify and remove legitimate IPs/domains incorrectly flagged
- ✅ Validation: Flag outdated indicators or confirm active threats
- 🏷️ Context Enhancement: Add threat actor attribution, geolocation tags, or threat categories
- ⚡ Automation: Suggest workflow improvements for data processing and curation
💡 How to Contribute
Get involved in multiple ways:
- 📝 Request Whitelisting - Submit a Whitelist IP or Whitelist Domain request to report false positives (automated validation & processing)
- 🐛 Report Issues - Flag duplicates, false positives, or outdated entries in GitHub Issues
- 💬 Share Feedback - Help improve enterprise/SMB integration patterns and use cases
- 📚 Documentation - Enhance guides for non-technical users and integration tutorials
- 🔧 Code Contributions - Improve processing scripts, add new data sources, or enhance automation
Every contribution helps make cybersecurity more accessible and effective for everyone! 🌐
📡 Contact me
📧 Email: [email protected]
探索相关项目
trimstray/the-book-of-secret-knowledge
汇集各类启发灵感的清单、手册、速查表、博客、技巧、单行命令、CLI/Web 工具等内容。
257,974 星标Hack-with-Github/Awesome-Hacking
面向黑客、渗透测试人员与安全研究人员的各类 Awesome 清单合集。
125,360 星标swisskyrepo/PayloadsAllTheThings
一份用于 Web 应用安全以及渗透测试/CTF 的实用 payload 与绕过方法列表。
82,623 星标caddyserver/caddy
快速、可扩展的跨平台 HTTP/1-2-3 Web 服务器，支持自动 HTTPS
79,020 星标