01 · URLS↗
Phishing & malicious URLs
Ranked web indicators collected from public threat feeds.
100 indicatorsPUBLIC REVIEW FEEDS
Useful signals.
With their context.
Browse the Malicious Top 100 and public community source snapshots from feeds-dl. Review source, date, and reason, or download plain TXT and structured JSON.
Explore downloadsFREE FEED LIBRARY
Choose a feed to review or download.
Each category includes a reviewable JSON file with provenance and a line-oriented TXT file for easy inspection.
02 · IPV4⌁
Suspicious IPv4 addresses
Public IPv4 indicators with overlap, confidence, and source context.
100 indicators03 · SHA-256◉
Malware file hashes
SHA-256 hashes from public malware intelligence sources.
100 indicatorsAll three categoriesOne JSON bundle with metadata, methodology, source links, and 300 ranked indicators.
Download complete JSON ↓COMMUNITY SOURCE SNAPSHOTS
Download the free source feeds.
These no-key feeds are also included in the local unique search index. Review each publisher’s terms and context before using or redistributing data.
01 · PHISHING↗
OpenPhish Community
Community phishing URL feed. Usage is subject to OpenPhish’s terms.
02 · TOR IPs⌁
Tor Node List
Current Tor nodes. A Tor listing alone does not establish malicious activity.
03 · IP REPUTATION⌁
IPsum
IPs aggregated from publicly available threat lists, with the source score in the reason.
04 · IP REPUTATION⌁
CINS Army
Community reported suspicious IP addresses.
05 · C2 INDICATORS⌁
Cobalt Strike Servers
Fox-IT’s published list uses a historical HTTP response fingerprint; corroborate current activity.
FULL FEED · FEEDS-DL
Full Unique IP Feed
Explore the complete validated IPv4 and IPv6 feed, with JSON context and a clean TXT export.
126,492 unique IP records · 123,515 IPv4 + 2,977 IPv6 · data through October 5, 2026REVIEW THE FEED
Inspect the indicator context.
Indicators are displayed as plain text and are not linked or fetched by this page. Confidence and rank summarize available source data; they are not proof of malicious activity.
| Rank | Indicator | Score | Sources | Threat / reason |
|---|---|---|---|---|
| Loading indicators… | ||||
Loading indicators…
SOURCE PROVENANCE
Know where the signal came from.
Ranking is a composite of publisher weight, feed confidence, overlap across sources, recency metadata when available, and source-feed position. Scores help prioritize review; they do not mean a publisher independently confirmed every indicator.
Loading source list…
Use with care. These indicators are supplied for defensive review and enrichment. Shared infrastructure can appear in multiple threat lists. Confirm context before blocking. Check each publisher’s current license and terms before redistributing source data.
Back to Castle Cyber Security Intelligence Feeds products ↗