Create an EDL from a public threat-intel feed. It's fetched now and kept up to date automatically. All feeds default ACL to * (any source) — restrict it afterwards on the EDL's edit page.
Aggregate of dshield/feodo/spamhaus_drop/fullbogons — max protection, minimal false positives.
Hijacked / cyber-crime-controlled netblocks. Do not fetch more than once per hour.
abuse.ch botnet C2 IPs (Dridex/Emotet/QakBot). May require an abuse.ch Auth-Key. May require an abuse.ch Auth-Key.
Cisco Talos reputation feed. Talos may rate-limit / block non-browser agents.
IPs of botnet C2 with "bad" SSL certs. May require an abuse.ch Auth-Key.
IPs appearing on ≥4 public feeds (high confidence).
ET compromised / block IPs.
Known active C&C IPs.
Live C2 IPs across many offensive frameworks.
Poorly-rated attacker IPs.
Honeypot brute-force / attack IPs.
Top attacking /24 networks.
Attackers seen probing many services.
Artillery honeypot banlist.
Current Tor exit node IPs.
abuse.ch ThreatFox malware/C2 domains. May require an Auth-Key. May require an abuse.ch Auth-Key.
Curated phishing domains.
Polish CERT malicious domain list.
Recent malicious domains.
Malware distribution URLs.
Live phishing URLs.
Recent malicious URLs.