Sources & Feeds

IoCs are aggregated from 8 threat intelligence sources, collected every 30 minutes. Each source provides feeds broken down by type (IPs, Domains, URLs, Hashes) and risk level (High, Medium, Low).

1. ThreatFox (abuse.ch · Risk 4–7)

Community-reported IoCs with confidence scoring. Produces IPs, Domains, URLs, and Hashes.

Base: /feeds/blocklist/source · Legacy: /feeds/blocklist/source/threatfox.txt (all types)

2. URLhaus (abuse.ch · Risk 4–6)

Active malware distribution URLs.

3. Feodo Tracker (abuse.ch · Risk 8)

Confirmed botnet C2 infrastructure (Dridex, Emotet, TrickBot, QBot).

4. MalwareBazaar (abuse.ch · Risk 6)

Recent malware sample hashes (SHA256).

5. IPsum (stamparm · Risk 6–7)

IPs appearing on 3+ blacklists (aggregated from ~100 lists).

6. Blocklist.de (Risk 5)

IPs attacking SSH, FTP, mail, and web services.

7. Spamhaus DROP (Risk 9)

Hijacked netblocks — highest confidence, widely trusted. Note: Spamhaus provides CIDR netblocks, not individual IPs.

8. OpenPhish (Risk 5)

Automated phishing URL detection.

9. bitwire-it/ipblocklist (Risk 6–8)

Community-aggregated IP blocklist from 30+ public threat intel sources, updated every 2 hours. Split into two streams: inbound (reputation-based, 3.4M IPs — scanners, brute-force, spam) and outbound (C2/botnet destinations, 190k IPs — higher value). Licensed CC BY-NC-SA 4.0 via github.com/bitwire-it/ipblocklist. We import up to 5,000 IPs per stream per day for display.

Combined Feeds

All sources merged into one feed per indicator type, with optional risk-level filtering.

By Risk Level

Feeds filtered by computed risk score, available for all indicator types. Use high-risk for strict blocking, medium for monitoring, and low for research.

Risk Scoring

Each IoC is assigned a risk score (1–9) based on the source reliability and indicator confidence:

Iceland Network Flagging

IoCs are automatically checked against Icelandic IP ranges from RIX.is (~300 IPv4 CIDR blocks, 64 AS numbers). This provides situational awareness for Icelandic organizations.

• IP matching — Individual IPs from any source are checked against all Icelandic CIDR blocks
• CIDR overlap — Spamhaus DROP/EDROP netblocks are checked for overlap with Icelandic ranges
• Iceland threats feed — /feeds/blocklist/iceland-threats.txt returns all flagged IoCs
• API endpoint — /api/threat-intel/iceland returns flagged IoCs with full context

How the Feeds Are Generated

1. Collection — Every 30 minutes, a scheduled job fetches IoCs from all 8 sources in parallel. Most sources require no API key.
2. Risk scoring — Each IoC receives a risk score (1–9) based on source reliability and indicator confidence. IPs are checked against Icelandic IP ranges.
3. Storage — IoCs are stored in SQLite with deduplication (unique on type + value). Each record stores type, value, threat type, source, risk score, confidence, and timestamps.
4. Feed generation — Feed endpoints query the database with appropriate filters. Results are cached for 5 minutes. For IP feeds, port numbers are stripped from ip:port pairs.
5. Delivery — Plain text response with a comment header followed by one indicator per line. The X-Feed-Count header contains the entry count.

Response Format

HTTP Headers:

• Content-Type: text/plain; charset=utf-8
• Cache-Control: public, max-age=1800 (30 minutes)
• X-Feed-Count: N (number of entries, excluding comment lines)

Bulk Counts API

Get all feed counts in a single request (useful for dashboards):

Device Compatibility

Our feeds use plain text format (one IoC per line, # comment header) which is compatible with most security devices out of the box:

Integration Examples

FortiGate (External Threat Feed)

Palo Alto Networks (External Dynamic List)

pfSense / OPNsense

CrowdSec

Suricata (IP Reputation)

Sophos XG/XGS

MikroTik

Snort (IP Reputation)

Splunk Enterprise Security

Python

Terms of Use

• These feeds are provided free of charge for both personal and commercial use.
• Data originates from multiple open-source threat intelligence providers under their respective terms of use.
• This is not a production-grade service. The data is community-sourced and may contain false positives, stale indicators, or errors. Use at your own risk.
• False positives can cause outages. Blocking a legitimate IP or domain can disrupt services. Always validate IoCs before deploying to production firewalls.
• Recommended approach: start with the high-risk feed in monitor/log mode, review alerts, then move to blocking once you trust the data for your environment.
• No guarantee of completeness, accuracy, or availability. The operators assume no liability for any damage caused by the use of these feeds.
• Please don't poll more frequently than every 30 minutes — the data doesn't change faster than that.
• Questions? Contact admin@1881.is.