Skip to main content
Data products

Threat Feeds Compare external indicators with your current sources

For SOC, MDR, MSSP and network teams using OpenCTI, MISP, a SIEM or a firewall. Evaluate what the feed adds to your existing intelligence and confirm its import behavior. STIX/TAXII access requires Pro or Enterprise.

Evaluate a feed in my tool

Pro: €99/month. Enterprise: quotation. TAXII polling does not consume the monthly lookup quota. The Free plan does not include feed access.

Read the integration documentation
GET/downloads/blocklist/blocklist-domains-all.txt
# IsMalicious.com Blocklist - Domains (All Levels)# Format: Plain# Generated: 2026-10-09T21:19:00.052170397+00:00# Total entries: 18302926# Update frequency: every 12 hours# Category: All# Threat level: All Levels# Website: https://ismalicious.com# © 2026 IsMalicious (compilation). Licensed to the downloading account under https://ismalicious.com/terms; redistribution of the compilation prohibited. Third-party entries remain under their providers' licences — see https://ismalicious.com/sources.6268aa.comamericanairlknes.com.rucasino-9av.buzzvirginiabeachantiquecom-any.com
18 302 926 entriesgenerated 2 hr. ago
Download the free sample (1 830 292 entries)10 % of the list · no account needed

Same family, other types

All lists and formats
By the numbers

Recent threat Feed Statistics

Inspect the returned data and collection metadata before integrating.

Current data sample

Counters unavailable. No estimated volumes are displayed.Counters unavailable. No estimated volumes are displayed.
By the numbersCounters unavailable. No estimated volumes are displayed.public sample
Evaluate a feed in my tool

No credit card required · Free: a 10% sample of each list · full lists on paid plans

Evaluate a feed over 14 days

Compare the feed with your existing sources in a test collection before changing production rules.

  1. 1.Define the task

    Choose an indicator type and target tool. Record your existing sources, comparison window and success criteria. Confirm evaluation access with our team.

  2. 2.Verify the import

    Follow TAXII documentation. Check authentication, collection selection and every page of the import. Record the object count accepted by your tool, not just the count returned by the API.

  3. 3.Verify the next synchronization

    Repeat the synchronization using added_after as documented. Record the checkpoint, duplicates and newly imported objects. A successful poll does not demonstrate fresh intelligence.

  4. 4.Review the evidence

    Compare matched indicators and investigate a sample of additional results. Record source dates, false positives and decisions changed. Additional objects alone do not prove better detection.

TAXII integration documentationData quality and limitations

TAXII 2.1

Transport

STIX 2.1

Object format

Pro / Enterprise

Access

added_after

Incremental filter

Capabilities

Key features.

Available signals and integration options.

Collection rebuilds

Shared STIX/TAXII collections are rebuilt nightly. Increasing the polling frequency does not make the corpus newer.

Multiple Formats

Choose the endpoint and output format your tool can ingest. Confirm the fields using an actual response.

Lookup streaming

The SSE endpoint streams a single indicator investigation. It is separate from TAXII collection polling.

Coverage to compare

Compare a representative indicator sample with the sources your team already uses. Coverage varies by source and indicator type.

STIX/TAXII Support

STIX 2.1 objects over TAXII 2.1 for authenticated Pro and Enterprise clients.

Custom Filters

Select indicator collections, use added_after and follow pagination. Check endpoint-specific filtering in the documentation.

Applications

Use cases.

Workflows to evaluate with your existing tools.

SIEM Enrichment

Feed data directly into your SIEM.

Firewall Rules

Validate indicator selection, capacity and false positives before applying blocking rules.

Threat Hunting

Search for IOCs in your environment.

Security Research

Analyze threat trends and patterns.

Support

Frequently asked questions.

How do collection rebuilds differ from polling?

The shared STIX/TAXII corpus is rebuilt nightly. Your client chooses when to poll it. A successful poll is not evidence that an indicator has just been observed; inspect the returned dates and compare them with your freshness requirements.

How can I consume the indicators?

Use STIX 2.1 over TAXII 2.1 with Pro or Enterprise access. Other endpoints support lookups or blocklist formats as documented. The SSE endpoint streams a lookup, not a continuous feed of collection changes.

Can I limit the import?

Choose the indicator collections, use the documented filters and follow pagination. Define your volume and retention constraints during the evaluation.

How should I evaluate history and freshness?

Inspect the date fields present in actual responses and agree on the period your evaluation needs. Collection availability does not establish a guaranteed historical retention period.

Cite this data

These figures may be quoted in research, articles and reports. Attribute them to isMalicious with a link to this page, so readers can check the numbers at the source and see how they move.

Attribution text: Source: isMalicious, isMalicious Threat Intelligence Feeds — https://ismalicious.com/data/feeds

Explore

Related tools.

Blocklists

Ready-to-use lists

STIX/TAXII

Standard formats

Streaming API

Progressive indicator investigation

Get Started

Ready to get started?

Tell us your current tool, the gap you want to investigate, a success criterion, expected volume and decision date. We will scope an evaluation against your existing sources.

Evaluate a feed in my toolRead the integration documentation

Pro: €99/month. Enterprise: quotation. TAXII polling does not consume the monthly lookup quota. The Free plan does not include feed access.