• Threat Intelligence
• Security Tools
• SOC Operations

12 Best Threat Intelligence Feeds (2026): Free and Paid, Compared by Data and Format

Josh Amishav · Last updated Oct 27, 2026 · 21 min read

Quick Summary

The best threat intelligence feeds are Breachsense for leaked credentials, stealer logs and ransomware leak data, CISA KEV and abuse.ch for free data on exploited vulnerabilities and malware, and Recorded Future for risk-scored indicators.

What to compare when you choose a threat intelligence feed

Compare threat intelligence feeds by the kind of data each one contains, such as exploited vulnerabilities or leaked credentials. Then check that your SIEM (security information and event management) or firewall can import the feed’s format. Check the license on free feeds too, because the free versions of LevelBlue OTX (Open Threat Exchange) and Spamhaus don’t allow business use.

In the SANS 2026 CTI Survey, 79% of security executives said information on vulnerabilities that attackers are actively targeting is a top priority for the next 12 months. CISA (Cybersecurity and Infrastructure Security Agency) lists vulnerabilities that attackers are exploiting in its free KEV (Known Exploited Vulnerabilities) catalog. Before you pay for a vulnerability feed, ask the vendor which exploited vulnerabilities the feed lists that KEV doesn’t.

Patching KEV vulnerabilities is the slow part. In Verizon’s 2026 DBIR (Data Breach Investigations Report), only 26% of KEV vulnerabilities were fully fixed in 2025. The median fix took 43 days.

Why listen to us?

Breachsense is a dark web monitoring API with over 42 billion leaked credentials indexed. We track 100+ ransomware groups and the victims they post on their leak sites. Our founder, Josh Amishav, spent nearly 20 years as a penetration tester. Leaked credentials often got him into client networks. We run a threat intelligence feed ourselves, so we know which fields a SIEM needs from a feed.

What are threat intelligence feeds?

A threat intelligence feed is threat data that a provider keeps updating, in a format your security tools can read without a person in the loop. Your SIEM, firewall or mail server reads the feed and blocks matching traffic or sends an alert.

Feeds contain five kinds of data:

• Attacker infrastructure. IP addresses, domains, URLs and file hashes tied to attacks, known as IOCs (indicators of compromise). URL feeds are more precise than domain feeds, because one domain can host both legitimate and malicious pages.
• Exploited vulnerabilities. CVEs (Common Vulnerabilities and Exposures) that attackers are exploiting now.
• Phishing URLs. The addresses of live fake sign-in pages.
• Scanner IPs. IP addresses of machines that scan the whole internet, labeled as harmless or malicious.
• Leaked data. Credentials and session cookies for your domains, and posts about your company on leak sites. Stolen credentials and session cookies both come from stealer logs, the files infostealer malware uploads from infected computers. Credentials also leak in third-party breaches, or when employees type their passwords into phishing pages.

Many feeds use STIX (Structured Threat Information Expression) over TAXII (Trusted Automated Exchange of Intelligence Information), a standard format and protocol for sharing threat data. Others offer a JSON API, CSV or text files, or a format MISP (Malware Information Sharing Platform) can import. Spamhaus answers DNS lookups. It also offers an RPZ (response policy zone) that your DNS server loads. GreyNoise gives you blocklist URLs for your firewall to pull. We send Breachsense alerts by webhook.

Why are threat intelligence feeds important?

• Attackers get in by exploiting vulnerabilities more than any other way. In Verizon’s 2026 DBIR, vulnerability exploitation accounted for 31% of breaches with a known initial access vector.
• Malicious URLs change constantly. Attackers move malware downloads and phishing pages to new addresses, so a blocklist goes stale fast. abuse.ch regenerates URLhaus’s download files every 5 minutes.
• Scanner labels clear noise. A feed that labels scanner IPs lets an analyst close an alert about a known, harmless scanner straight away.
• Stolen credentials often come before ransomware. Verizon looked at victims with a credential or infostealer leak in the year before the attack. Half of those victims had the leak in the 95 days before the attack.
• A supplier’s breach can expose your data. In the 2026 DBIR, 48% of breaches involved a supplier. Some started with a flaw in a supplier’s software. Others hit a supplier that held the victim’s data. When a ransomware group breaches one of your suppliers, the files it posts on its leak site can contain your data. The breach happened on the supplier’s systems, so none of your own security logs record it. With our third-party breach monitoring, we send an alert when a supplier on your watchlist shows up on a leak site.

12 best threat intelligence feeds

1. Breachsense
2. CISA KEV
3. abuse.ch
4. LevelBlue OTX
5. Spamhaus
6. OpenPhish
7. Shadowserver
8. GreyNoise
9. Recorded Future
10. Google Threat Intelligence
11. CrowdStrike Falcon Adversary Intelligence
12. Flashpoint

Entries 2 to 8 have a free tier. Breachsense and entries 9 to 12 are paid.

Checked in October 2026.

1. Breachsense

Breachsense is the feed for leaked credentials, stealer logs and ransomware leak data. It’s built for SOC (security operations center) teams with a SIEM to feed, and for companies that build our data into their own product. We send each finding as JSON to your webhook. Your tools can also pull findings from our dark web monitoring API.

Each stealer log alert includes the username, the plaintext password and the site it was used on. The alert also includes the malware family and the infection date when the stealer log records them. You can also monitor session tokens, the cookies that keep staff signed in to your web apps. You pick which cookies to monitor by name. When a stealer log contains one of those cookies, the alert includes the cookie’s value. An attacker who loads a stolen session cookie into a browser can bypass MFA. Resetting the password doesn’t always terminate the session. Use the cookie’s value to find that session on the server that issued it, and terminate it there.

When your company or a supplier on your watchlist shows up on a ransomware leak site, we send an alert. The alert includes the link to the leak post. We also index files leaked in ransomware attacks, third-party breaches and unsecured databases. You can search the text of those files for any term, such as your company name or a project name. When a term you monitor shows up in a new file, the alert includes the file’s URL. For Splunk or Sentinel, use our ready-made SIEM integrations.

Key features

• Stealer logs. Plaintext passwords from infected devices, with the site each password was used on.
• Session cookies. Sends an alert when a stealer log contains a session cookie you chose to monitor.
• Phishing kit credentials. Finds passwords employees typed into phishing pages.
• Cracked breach passwords. Cracks weakly hashed passwords from third-party breaches.
• Leaked file search. Lets you search leaked files for any term. Sends an alert when a term you monitor shows up in a new file.
• Device pivoting. Search by an infected device’s IP address to find the other credentials stolen from that device. You can also search by a username or a password.
• Webhooks. Sends alerts to a separate webhook for each monitored domain.

Pricing: Not published. The price depends on how many assets you monitor and which data sources you need. It also depends on how many API requests you send each month. A trial is available after a demo call.

Rating: 4.8/5 on G2

Pros

• Alerts include the plaintext password, so you can check whether the employee still uses it.
• You can search the text of leaked files for your company name, not only look up credentials.
• Pricing is based on usage, not seats.

Cons

• No attacker IOCs, such as malware hashes or command-and-control IP addresses.
• No STIX or TAXII. A TIP (threat intelligence platform) that reads only STIX needs a script to convert our JSON.
• No published prices.

2. CISA KEV

CISA’s KEV catalog lists the CVEs that attackers have exploited in the wild, with the action to take and a due date for each. The due dates bind only US federal civilian agencies, under Binding Operational Directive 26-04. CISA tells every other organization to use the catalog to set its own patching order.

The catalog held 1,754 entries on October 21, 2026. CISA flags 361 of those entries for known use in ransomware campaigns, so patch those vulnerabilities first.

Key features

• Data. Exploited CVEs, each with a required action, a due date and a ransomware-use flag.
• Format. JSON (with a published schema) and CSV.
• Ingestion. Download the file from cisa.gov. You don’t need an account or a key.
• Refresh. No fixed schedule. CISA adds entries as it confirms exploitation, on ten separate days so far in October 2026.

Pricing: Free. The catalog is released under the CC0 public-domain license, so commercial use is allowed.

Rating: Not enough reviews

3. abuse.ch

abuse.ch runs a set of free malware feeds, now operated with Spamhaus. Teams load abuse.ch feeds into firewall and IDS (intrusion detection system) rules, or into a DNS blocklist. URLhaus lists URLs that spread malware. ThreatFox lists IOCs tagged by malware family. MalwareBazaar collects malware samples. SSLBL (SSL Blacklist) lists malicious SSL certificates. Feodo Tracker lists botnet command-and-control servers, though its datasets are currently empty after law enforcement takedowns, including Operation Endgame.

To download URLhaus files, you need a free Auth-Key from abuse.ch.

Key features

• Data. Malware URLs, IOCs, samples and malicious SSL certificates.
• Format. CSV, JSON, MISP events, Snort and Suricata rules, RPZ and plain text.
• Ingestion. Download by URL with your Auth-Key, or query the API.
• Refresh. Every 5 minutes for most URLhaus downloads, and for ThreatFox’s RPZ, hostfile and Suricata exports. The URLhaus MISP feed updates daily.

Pricing: Feodo Tracker and SSLBL are free for any use, under the CC0 public-domain license. URLhaus, ThreatFox and MalwareBazaar are free only for not-for-profit use. Commercial users may need a paid subscription through Spamhaus.

Rating: Not enough reviews

4. LevelBlue OTX

LevelBlue OTX, formerly AlienVault OTX, is a community where members publish indicators in groups called pulses. A pulse contains a summary of a threat and its IOCs, such as IP addresses, domains, file hashes and CVEs. OTX suits researchers and non-profits that want community indicators in a firewall or IDS.

Your tools pull the pulses you subscribe to through the DirectConnect API. Any member can publish a pulse, so check who published it before you subscribe.

Key features

• Data. Community pulses with IP addresses, domains, URLs, file hashes and CVEs.
• Format. JSON over the API, and STIX over TAXII 1.1.
• Ingestion. The DirectConnect API with an API key, with SDKs for Python, Java and Go.
• Refresh. No fixed schedule. Authors update pulses whenever they choose.

Pricing: Free for non-commercial use only, under the OTX end user license.

Rating: Not enough reviews

5. Spamhaus

Spamhaus publishes IP and domain blocklists, used mostly by mail servers to filter spam. Its ZEN list combines Spamhaus’s IP blocklists, including the SBL (Spamhaus Blocklist), XBL (Exploits Blocklist) and PBL (Policy Blocklist), in one DNS query. The SBL lists malicious networks. The XBL lists compromised machines. The PBL lists IP addresses that shouldn’t send email directly. The DBL (Domain Blocklist) covers low-reputation domains.

Spamhaus’s free mirrors refuse queries sent through public DNS resolvers, such as Google Public DNS or Cloudflare. Spamhaus also blocks queries from Microsoft’s network (since April 2025) and Oracle’s (since April 2026). Non-commercial users can switch to the free Blocklists via DNS Query account (formerly the Data Query Service), which works through public resolvers.

Key features

• Data. IP and domain reputation lists (SBL, XBL, PBL and DBL).
• Format. DNS lookups. DROP (Don’t Route Or Peer), Spamhaus’s list of highly malicious networks, is the only Spamhaus list in the free account’s RPZ feed.
• Ingestion. Your mail server queries the lists with the key from your free account.
• Refresh. Spamhaus lists new entries in real time on the free account.

Pricing: Free for non-commercial small organizations and individuals that stay under 100,000 queries a day. Commercial users need a paid account.

Rating: Not enough reviews

6. OpenPhish

OpenPhish lists the URLs of live phishing pages. The free Community feed is a plain text file of URLs, updated every 12 hours. Premium and Platinum feeds update every 5 minutes and add the targeted brand and hosting network for each URL.

OpenPhish’s terms allow the free feed only for personal use and research. The terms also rule out security operations and detection without OpenPhish’s written consent.

Key features

• Data. Phishing URLs. Premium and Platinum add the targeted brand and hosting network.
• Format. A plain text URL list (free). CSV or JSON (Premium).
• Ingestion. Download the text file over HTTPS. You don’t need a key.
• Refresh. Every 12 hours (free), or every 5 minutes (Premium).

Pricing: The Community feed is free for personal use and research. For Premium pricing, contact OpenPhish.

Rating: Not enough reviews

7. Shadowserver

The Shadowserver Foundation sends free daily reports about exposed and infected systems on networks you own. The reports are built for organizations that own their IP address ranges, such as ISPs, universities and hospitals. Shadowserver builds its reports from internet-wide scans, sinkholes and honeypots. A report can list an open database server or an infected host in your IP range.

Shadowserver says it sends reports to more than 10,000 vetted subscribers, including 201 national CSIRTs (computer security incident response teams). Before sending reports about a network, Shadowserver checks that you control it.

Key features

• Data. Exposed services, vulnerable systems and infected hosts on your networks.
• Format. CSV files.
• Ingestion. Email with a download link, or the API with a key you request.
• Refresh. Daily, covering the previous 24 hours. You get a report only on days Shadowserver finds an exposed or infected system on your networks.

Pricing: Free. Shadowserver says it doesn’t sell data.

Rating: Not enough reviews

8. GreyNoise

GreyNoise is for SOC teams that get many alerts from internet scanners. GreyNoise runs what it calls a global grid of thousands of sensors, which record the IPs scanning the internet. It labels each IP as benign, malicious, suspicious or unknown.

A benign label means GreyNoise has tied the IP to a known, legitimate actor. An IP that an attacker uses only against your network never reaches GreyNoise’s shared sensors, so GreyNoise has no label for it.

Key features

• Data. Scanner IPs, each with a classification and tags for what it’s scanning for.
• Format. JSON over the API, plus blocklists as URLs. Event feeds come with the Advanced and Elite plans.
• Ingestion. Your firewall pulls a blocklist URL. GreyNoise says it has 80+ integrations with SIEMs, SOAR (security orchestration, automation and response) tools and firewalls.
• Refresh. Blocklists update every hour. GreyNoise’s data refreshes every 8 hours on the free plan and every hour on Elite.

Pricing: Paid plans aren’t priced on GreyNoise’s site. The free plan includes up to 10 days of history, 50 searches a week and Community API access.

Rating: 4.8/5 on G2

Pros

• Labels the IPs that scan the whole internet, so analysts can drop alerts about those IPs from the queue.
• Each lookup shows an IP’s tags, classification and past activity, including what it was scanning for.
• Malicious IPs come already classified, which makes firewall block rules easier to write.

Cons

• Many IPs come back with little or no data, so analysts still check other lookup tools.
• The scan history doesn’t go back far enough for some compliance checks.
• Some analytics and tagging features come only with higher-priced plans, which small teams find expensive.

9. Recorded Future

Recorded Future, owned by Mastercard since December 2024, sells risk lists of IP addresses, domains, URLs, file hashes and vulnerabilities. It suits SOCs that want risk-scored indicators in their SIEM. The default lists include only indicators that Recorded Future scores in its Malicious tier or higher.

Recorded Future caps its default TAXII collection at 100,000 indicators and vulnerabilities. A larger collection, with a lower risk threshold, is capped at 1 million. Lower-scoring indicators reach your SIEM only if you poll the larger collection. Recorded Future sells credential alerts in a separate Identity Intelligence module, which our guide to Recorded Future alternatives compares with ours.

Key features

• Data. Risk-scored IP addresses, domains, URLs, file hashes and CVEs.
• Format. CSV by default, or STIX 1.1.1, 1.2 or 2.1.
• Ingestion. Download risk lists, or poll the TAXII 2.1 server with your API token.
• Refresh. TAXII collections are built when you request them. Recorded Future suggests polling its IP command-and-control collection every hour.

Pricing: Not published. Recorded Future prices by package and organization size, measured by unique workforce credentials, plus any add-ons.

Rating: 4.5/5 on G2

Pros

• The Intelligence Graph links an indicator to the threat actors and exploits behind it in one view.
• Analysts can build their own threat reports on findings from Insikt Group, Recorded Future’s research team.
• Shows a risk score for an IP address or CVE, with the reason it was flagged.

Cons

• Identity intelligence and third-party risk are sold as separate add-on modules.
• Field names in the query language differ from the platform’s variable names, so queries are hard to write.
• WHOIS and passive DNS coverage is thin.

10. Google Threat Intelligence

Google Threat Intelligence combines Mandiant’s incident response intelligence and VirusTotal’s malware data with Google’s own threat data. It suits teams that want to load only the threat types they care about into their SIEM.

Each hourly Google threat list becomes available to download two hours after Google publishes it. Only the ransomware and malicious network infrastructure lists come with every license. The phishing and infostealer lists need Enterprise Plus.

Key features

• Data. 14 threat lists, such as ransomware, phishing, infostealers and cryptominers.
• Format. JSON, CSV, STIX or MISP. The MISP export contains only the indicator values.
• Ingestion. API calls, with a maximum of 4,000 indicators per request. You can fetch lists from the past 30 days.
• Refresh. Hourly, two hours behind the current time.

Pricing: Not published. Google charges a flat annual rate for each subscription level, with a set number of API calls. Extra API calls are sold in packs.

Rating: 10/10 on TrustRadius

Pros

• Detailed research on threat actors and their tactics.
• Vulnerability intelligence includes an analyst’s assessment of each CVE.
• The API and third-party integrations are easy to set up.

Cons

• The portal’s layout and navigation are hard to customize.
• Support is slow on requests that aren’t urgent.
• Lower subscription levels lock some data, so analysts can get stuck partway through an investigation.

11. CrowdStrike Falcon Adversary Intelligence

CrowdStrike Falcon Adversary Intelligence is for Falcon customers who want to know which threat actor is behind an EDR (endpoint detection and response) detection. CrowdStrike says it includes real-time indicators, dark web monitoring and a built-in malware sandbox. With Premium, CrowdStrike says, Threat AI “provides prebuilt defenses” and delivers intelligence reports.

To use CrowdStrike’s indicators outside Falcon, such as in your SIEM or firewall, pull them from CrowdStrike’s API. CrowdStrike also publishes an open-source importer on GitHub that loads its adversaries, indicators and reports into MISP. The importer isn’t a supported CrowdStrike product.

Key features

• Data. Indicators linked to the adversaries CrowdStrike tracks, plus adversary profiles and reports.
• Format. Indicators over CrowdStrike’s API, or MISP events through the importer.
• Ingestion. CrowdStrike’s API, or prebuilt playbooks that send indicators to security tools outside Falcon.
• Refresh. CrowdStrike calls its indicators real time.

Pricing: Not published. CrowdStrike licenses Adversary Intelligence by endpoint, server or employee count.

Rating: 4.7/5 on Gartner Peer Insights

Pros

• When an alert fires, analysts can open the threat actor’s profile, with its techniques mapped to MITRE ATT&CK (Adversarial Tactics, Techniques and Common Knowledge).
• The intelligence is built into Falcon’s EDR detections, so analysts move from an indicator to live endpoint activity in one console.

Cons

• Licensing and add-ons push up the total cost.
• The intelligence feeds need tuning when you first set them up.
• The dashboards are hard to customize.

12. Flashpoint

Flashpoint is for fraud and threat intelligence teams that investigate criminal communities. It collects posts and files from sources such as ransomware sites and closed Telegram channels. Flashpoint’s API includes technical indicators and stolen credentials, which our guide to Flashpoint alternatives compares with ours. Flashpoint also serves indicators as STIX over TAXII.

Flashpoint’s Splunk app checks Flashpoint indicators against your logs and sends an alert on each match. Flashpoint’s analysts also write intelligence reports and answer requests for information.

Key features

• Data. Technical indicators, plus stolen credentials from Flashpoint’s Account Takeover data.
• Format. STIX over TAXII, or Flashpoint’s API.
• Ingestion. The Splunk app, or the MISP and STIX/TAXII integrations.
• Refresh. Not published.

Pricing: Not published. Flashpoint’s pricing page lists what each package includes, with a “Get Pricing” request for each.

Rating: 4.5/5 on G2

Pros

• Shows the original criminal posts and listings, and where each one came from.
• The search is easy to filter by channel and author.
• Analysts answer requests for information quickly, with thorough reports.

Cons

• Flashpoint sends a lot of false-positive keyword alerts. Tuning those alerts takes work with Flashpoint’s team.
• Each request for information draws down a block of analyst hours, so costs are hard to predict.
• Frequent platform changes have broken integrations for some customers.

Selection criteria

How we evaluated

• Data. What the feed contains, and what your team uses it for, such as deciding what to patch or what to block at the firewall.
• Format and ingestion. Whether your tools can read the feed without a custom parser.
• Refresh. How often the provider updates the feed. URLhaus generates files every 5 minutes. OpenPhish’s free feed updates every 12 hours. Shadowserver sends reports daily.
• Context. Whether each indicator says why it’s listed, and whether old indicators expire. ThreatFox stops serving IOCs older than six months through its API and exports, because cloud IP addresses change owners quickly.
• License. Whether the free terms let you use the feed at work.
• Reviews. Ratings, pros and cons from G2, Gartner Peer Insights or TrustRadius, checked in October 2026.

Before you commit to an IOC feed, run it against a week of your firewall or proxy logs. Count how many of its matches turn out to be legitimate traffic.

Whichever of the dark web monitoring approaches you pick, ask the vendor whether it includes passwords employees typed into phishing pages. Our September 2026 phishing report looked at phished addresses outside the major webmail providers. For 98.8% of those addresses, the stolen password wasn’t in any breach record or combo list we hold.

How to get a threat intelligence feed into your SIEM, firewall or mail server

• TAXII. Recorded Future and Flashpoint serve STIX over TAXII. OTX runs an older TAXII 1.1 server. Point your SIEM’s TAXII client at the vendor’s collection URL.
• Files. Download KEV, abuse.ch’s lists and Google’s threat lists on a schedule, then import them.
• DNS and RPZ. Your mail server queries Spamhaus’s lists for each sender. Your DNS server can load a Spamhaus RPZ.
• Blocklist URLs. Your firewall pulls the blocklist from a GreyNoise URL every hour.
• Webhooks. We send Breachsense alerts as JSON to an HTTP input on your SIEM or SOAR.

Microsoft Sentinel’s TAXII connector pulls only from TAXII 2.0 or 2.1 servers. To get OTX pulses into Sentinel, run them through a threat intelligence platform such as MISP or OpenCTI first.

If you run MISP, check its feed catalog before you write a parser. MISP lists 108 default feeds from 52 providers, including eight from abuse.ch.

How to choose

OTX, abuse.ch, Spamhaus and OpenPhish limit commercial use of their free feeds.

With our dark web monitoring, we send an alert when we find your staff’s passwords or session cookies, or your company’s files. MSSPs (managed security service providers) can set up a separate watchlist and webhook for each of their MSSP clients.

Wrapping up

Start with free feeds whose license covers business use, such as KEV for deciding what to patch. Add a paid feed when your analysts need context, such as who is behind an indicator. Then add a credential feed for your own leaked passwords, session cookies and files.

To see how many of your company’s credentials have leaked, run our free dark web scan on your domain.

Then book a demo and we’ll run a live search on your domains.