Phishing & malicious URLs
Ranked web indicators collected from public threat feeds.
100 indicatorsPUBLIC REVIEW FEEDS
Browse the Malicious Top 100 indicator feed from feeds-dl. Review source, confidence, score, and threat context, or download plain TXT and structured JSON.
Explore downloadsFREE FEED LIBRARY
Each category includes a reviewable JSON file with provenance and a line-oriented TXT file for easy inspection.
Ranked web indicators collected from public threat feeds.
100 indicatorsPublic IPv4 indicators with overlap, confidence, and source context.
100 indicatorsSHA-256 hashes from public malware intelligence sources.
100 indicatorsFULL FEED · FEEDS-DL
Explore the complete validated IPv4 and IPv6 feed, with JSON context and a clean TXT export.
126,492 unique IP records · 123,515 IPv4 + 2,977 IPv6 · data through October 5, 2026REVIEW THE FEED
Indicators are displayed as plain text and are not linked or fetched by this page. Confidence and rank summarize available source data; they are not proof of malicious activity.
| Rank | Indicator | Score | Sources | Threat / reason |
|---|---|---|---|---|
| Loading indicators… | ||||
Loading indicators…
SOURCE PROVENANCE
Ranking is a composite of publisher weight, feed confidence, overlap across sources, recency metadata when available, and source-feed position. Scores help prioritize review; they do not mean a publisher independently confirmed every indicator.
Loading source list…
Use with care. These indicators are supplied for defensive review and enrichment. Shared infrastructure can appear in multiple threat lists. Confirm context before blocking. Check each publisher’s current license and terms before redistributing source data.
Back to Castle Cyber Security Intelligence Feeds products ↗