Real-Time Threat Intelligence Tools

Stay ahead of cyber threats with curated feeds, automated tools, and practical resources for defenders and analysts.

What Is Threat Intelligence

Evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject’s response to that menace or hazard.

Get a Free Security Scan Today!

of organizations say threat intelligence is critical to their security posture, helping them stay ahead of emerging threats and improve response times.

of reduction in time to detect and respond to threats was reported by organizations using threat intelligence platforms compared to those without.

of successful cyberattacks exploit known vulnerabilities that organizations failed to patch or detect—something threat intelligence helps deter.

Threat Intelligence Feed Directory

Welcome to BlackHawk Data’s curated collection of the most reliable open-source threat intelligence feeds. This page offers a handpicked library of real-time threat feeds, malware databases, network defense tools, and automation resources. Whether you’re building detection rules, enriching SIEM logs, or securing endpoints, these vetted tools help you stay informed and protected.

Our team continuously monitors and verifies every source to ensure you’re getting the most current and actionable threat data available.

General Threat Intelligence

These feeds provide broad-spectrum threat intelligence covering multiple threat types and vectors.

Network & Infrastructure Threats

Feeds focused on malicious network activity, compromised infrastructure, and attack patterns.

Malware Intelligence

Resources focused on malware detection, analysis, and prevention.

Vulnerabilities & Exploits

Resources for tracking vulnerabilities and active exploits in the wild.

Emerging Threats

Feeds focused on new and evolving threats.

Automated Threat Intelligence Tools

Platforms and tools for automating threat intelligence collection and processing.

General Threat Intelligence

These feeds provide broad-spectrum threat intelligence covering multiple threat types and vectors.

AlienVault OTX

A collaborative platform where security researchers and professionals share the latest threat data, including malware indicators, attack patterns, and vulnerability information.

Coverage: Global, multi-vector (IPs, domains, hashes, URLs)

Update Frequency: Real-time

Best For: Comprehensive threat monitoring, SOC teams

Access AlienVault OTX Feed

MISP Platform

The Malware Information Sharing Platform is a robust open-source tool for collecting, storing, and sharing cybersecurity indicators and threats.

Coverage: Structured threat data (STIX/TAXII compatible)

Update Frequency: Depends on instance

Best For: Threat intelligence sharing communities

Access MISP Platform Feed

OpenPhish

Provides real-time phishing URL feeds with both free and commercial offerings available.

Coverage: Active phishing URLs

Update Frequency: Real-time

Best For: Email security, web filtering

Access OpenPhish Feed

PhishTank

Community-driven phishing URL database that verifies suspected phishing URLs through crowdsourcing.

Coverage: Verified phishing sites

Update Frequency: Real-time

Best For: Comprehensive threat monitoring, SOC teams

Access PhishTank Feed

Network & Infrastructure Threats

Feeds focused on malicious network activity, compromised infrastructure, and attack patterns.

FireHOL IP Lists

Aggregates and categorizes IP addresses involved in malicious activities from various reputable sources, providing ready-to-use blocklists.

Coverage: IP addresses (IPv4/IPv6), networks

Update Frequency: Daily to real-time (depends on source)

Best For: Network security, firewall rules

Access FireHOL IP Lists Feed

Abuse.ch Feeds

A family of specialized threat feeds focusing on different aspects of cyber threats, from malware C2 servers to phishing infrastructure.

Key Feeds:

SSL Blacklist – Malicious SSL certificates
Feodo Tracker – Botnet C2 servers
ThreatFox – Malware IOCs
URLhaus – Malware distribution URLs

Update Frequency: Real-time to daily

Best For: Targeted threat protection

Access Abuse.ch Feed

Spamhaus DROP/EDROP Lists

Lists of malicious IP ranges (netblocks) involved in spam, malware distribution, and other malicious activities.

Coverage: IP ranges/netblocks

Update Frequency: Daily

Best For: Network-level blocking

Access Spamhaus Feed

Blocklist.de

Aggregates IPs involved in brute-force attacks, spam, and scanning from various sources.

Coverage: IP addresses

Update Frequency: Real-Time

Best For: Brute force attack prevention

Access Blocklist.de Feed

GreyNoise

Collects and analyzes data on Internet-wide scanning activity, distinguishing between benign scanners and malicious actors.

Coverage: Internet scanning activity

Update Frequency: Real-time

Best For:Noise reduction, threat context

Access GreyNoise Feed

Malware Intelligence

Resources focused on malware detection, analysis, and prevention.

MalwareBazaar

A repository of malware samples with extensive metadata and analysis results, allowing security teams to research and identify new threats.

Data Types: Malware samples, hashes, signatures, behavior analysis

Update Frequency: Continuous as new samples are submitted

Best For: Malware researchers, threat analysts

Access MalwareBazaar Feed

URLhaus

Tracks malicious URLs used for malware distribution, providing timely information about active infection vectors.

Coverage: Malicious URLs, hosting infrastructure

Update Frequency: Real-time

Best For: Web filtering, email security

Access URLhaus Feed

SSL Blacklist

Provides a list of “bad” SSL certificates identified to be associated with malware or botnet activities.

Coverage: Malicious SSL Certificates

Update Frequency: Daily

Best For: SSL/TLS inspection

Access SSL Blacklist Feed

Malware Domain List

A searchable list of malicious domains that also performs reverse lookups and lists registrants, focused on phishing, trojans, and exploit kits.

Coverage: Malicious domains, registrants

Update Frequency: Daily

Best For: DNS filtering, domain monitoring

Access Malware Domain List Feed

ThreatFox

Platform for sharing indicators of compromise (IOCs) associated with malware with the infosec community, AV vendors and threat intelligence providers.

Coverage: Malware IOCs, campaigns

Update Frequency: Continuous

Best For: Malware analysis, threat hunting

Access ThreatFox Feed

Vulnerabilities & Exploits

Resources for tracking vulnerabilities and active exploits in the wild.

National Vulnerability Database

The U.S. government repository of standards-based vulnerability management data represented using the Security Content Automation Protocol (SCAP).

Coverage: All CVE-listed vulnerabilities

Update Frequency: As CVEs are published

Best For: Vulnerability management programs

Access National Vulnerability Database Feed

Exploit Database

Archive of public exploits and vulnerabilities maintained by Offensive Security as part of their Kali Linux distribution.

Coverage: Public exploits, proof-of-concepts

Update Frequency: Daily

Best For: Vulnerability research, penetration testing

Access Exploit Database Feed

Emerging Threats

Feeds focused on new and evolving threats.

Emerging Threats Rules

A collection of Snort and Suricata rules files that can be used for alerting or blocking emerging threats.

Coverage: Network signatures for threats

Update Frequency: Daily

Best For: IDS/IPS systems

Access Emerging Threat Rules Feed

CINS Score

A subset of the commercial CINS Score list, focused on poorly rated IPs that are not currently present on other threat lists.

Coverage: IP reputation scoring

Update Frequency: Daily

Best For: Threat prioritization

Access CINS Score Feed

Automated Threat Intelligence Tools

Platforms and tools for automating threat intelligence collection and processing.

IntelOwl

Automates threat intelligence collection from multiple sources including VirusTotal, AbuseIPDB, and others with a single API call.

Coverage: Multi-source intelligence aggregation

Update Frequency: On-demand

Best For: Automated analysis pipelines

Access IntelOwl Tool

Yeti

A platform for organizing observables, IOCs, and threat data into a unified knowledge base for threat intelligence.

Coverage: Threat data organization

Update Frequency: User-driven

Best For: Threat intelligence management

Access Yeti Tool

Practical Applications

How to leverage these threat feeds in your security operations

Network Protection

Integrate IP and domain feeds into firewalls, proxies, and network intrusion detection systems to automatically block known malicious traffic.

Email Security

Use phishing and malware URL feeds to enhance email security gateways and protect against malicious attachments and links.

Threat Hunting

Correlate internal logs with threat intelligence to identify compromised systems or ongoing attacks within your environment.

Automation

Feed threat data into SOAR platforms to automate incident response workflows for known threat indicators.

Additional Resources

Complementary resources for threat intelligence practitioners:

MITRE ATT&CK

Knowledge base of adversary tactics and techniques based on real-world observations, useful for threat modeling and detection engineering.

Access MITRE ATT&CK Resource

STIX/TAXII

Standards for structured threat information expression (STIX) and trusted automated exchange of indicator information (TAXII).

Learn More About STIX/TAXII

Threat Intelligence Training

Collection of training resources and courses for developing threat intelligence skills and knowledge.

Explore Threat Intelligence Training

Your Source For Actionable Threat Intelligence

Want help integrating threat intel into your stack? BlackHawk Data’s security experts help organizations automate detection, reduce noise, and improve response time. Contact us for a free consultation.