Spamhaus DROP
High confidence malicious network ranges, useful for network screening. Collector checks no more than daily and preserves the provider’s original attribution header.
Usage and redistribution terms ↗COLLECTION & PROVENANCE
Threat feed
sources.
See which public and community sources feed the local Castle snapshot, what access they require, and where redistribution needs extra care.
IN THE LOCAL ARMORY SNAPSHOT
Ready to collect
These sources are configured in feeds-dl. The snapshot is copied to the private site/private-feeds directory after a feed run.
TweetFeed
Community reported IPs, domains, URLs, and SHA-256 values from the prior week. Treat as hunting context and corroborate indicators before blocking.
API, feed formats, and license ↗AVAILABLE WITH ACCESS OR APPROVAL
Sources evaluated for a later connection
These providers offer free community access in some form, but credentials, account eligibility, or commercial terms need to be satisfied first.
abuse.ch
MalwareBazaar, ThreatFox, and URLhaus provide community APIs. The APIs require a free Auth-Key and fair use. abuse.ch says companies or for-profit use may require its enhanced commercial API, so the feeds are not included in Castle’s distributed feed bundle until that use is cleared.
CrowdSec
Community blocklists are available to subscribed CrowdSec Security Engines. The free list is tailored to engine participation and is not a general anonymous bulk-download feed.
Community list eligibility ↗Shadowserver
Free daily remediation reports for verified networks or constituencies, delivered by email or API after approval. It is designed for owners or authorized representatives of the covered network.
Request reports and API access ↗VMRay UniqueSignal
STIX 2.1 over TAXII with URLs, IPs, hashes, behavior, and ATT&CK mapping. VMRay describes a 60-day early adopter trial; ongoing access needs a provider agreement.
Trial details ↗ThreatFeeds.io
A directory of open-source feeds, rather than one unified feed. Each listed feed has its own owner, update schedule, and license; review those details before adding it to a commercial product.
Browse the directory ↗FalconFeeds.io
Commercial threat intelligence platform with trial and API integration options. It is not presented as a public, no-auth downloadable feed.
Integration documentation ↗Feed presence indicates a provider report, not a guarantee that an indicator is currently active or malicious. Verify context and timestamps before operational blocking.