kraloveckey/threat-intelligence-feeds
GitHub: kraloveckey/threat-intelligence-feeds
一个聚合多个免费开源威胁情报源的项目，提供无需认证的IOC数据供安全使用。
Stars: 0 | Forks: 0
# 🛡️ 威胁情报源
一个精心策划的开源免费威胁情报/IOC源合集 —— 无需账号或API密钥。
聚合来源：
- [Bert-JanP/Open-Source-Threat-Intel-Feeds](https://github.com/Bert-JanP/Open-Source-Threat-Intel-Feeds)
- [montysecurity/C2-Tracker](https://github.com/montysecurity/C2-Tracker)
- [MISP默认源](https://www.misp-project.org/feeds/)
- [firewall-e ipset封锁列表](https://github.com/kraloveckey/firewall-e)
- 其他社区项目
## 📊 源统计
| 类别 | 描述 | 数量 |
| --- | --- | --- |
| `IP` | 恶意/可疑IPv4地址和CIDR范围 | 133 |
| `DNS` | 恶意或可疑域名 | 24 |
| `URL` | 恶意/钓鱼/C2 URL | 37 |
| `MD5` | 恶意文件MD5哈希值 | 9 |
| `SHA1` | 恶意文件SHA1哈希值 | 3 |
| `SHA256` | 恶意文件SHA256哈希值 | 5 |
| `SSL` | 恶意SSL证书指纹 | 1 |
| `JA3` | JA3 TLS客户端指纹 | 1 |
| `CVEID` | 已知被利用的CVE标识符 | 4 |
| `RANSOMWARELEAK` | 勒索软件泄露站点受害者数据 | 1 |
| `NamePipe` | 可疑的Windows命名管道名称 | 1 |
| **总计** | | **219** |
## 📁 仓库结构
```
threat-intelligence-feeds/
├── ThreatIntelFeeds.csv ← master feed database (source of truth)
├── StatisticsTable.md ← auto-generated, do not edit manually
├── README.md ← auto-updated stats + feeds table
├── requirements.txt
├── scripts/
│ ├── Validator.py ← validates CSV format & categories
│ ├── FeedStatusChecker.py ← checks live HTTP status of all URLs
│ ├── GenerateTableStatistics.py← generates StatisticsTable.md (standalone)
│ └── UpdateREADME.py ← regenerates stats + feeds table in README
└── .github/workflows/
└── weekly-update.yml ← runs every Monday at 06:00 UTC
```
### 关于 ThreatIntelFeeds.csv
`ThreatIntelFeeds.csv` 是本项目的**单一真实来源**。
它通过手动维护（在此添加/删除源），但`FeedStatus`列由GitHub Actions每周通过`FeedStatusChecker.py`**自动填充**。然后，README中的表格会通过`UpdateREADME.py`从该CSV文件自动重新生成。
**格式：**
```
Vendor;Description;Category;Url;FeedStatus
Abuse.ch;Botnet C2 IP Blacklist;IP;https://sslbl.abuse.ch/blacklist/sslipblacklist.csv;Active
```
## 🚀 快速开始
### 创建一个新的空GitHub仓库后
```
# o" in English. I'll follow the instruction strictly.
git clone https://github.com/YOUR_USERNAME/threat-intelligence-feeds.git
cd threat-intelligence-feeds
# 2. "Copy all project files into it (unpack the archive)" – "Copy" is "复制", "all project files" is "所有项目文件", "into it" is "到其中", and "(unpack the archive)" is "（解压缩档案）". But "archive" might be technical, but it's not in the list to keep in English? The instruction says to keep professional terms, etc., in English, but "archive" here is part of the action. I think I should translate it. To be consistent, since "repo" is kept, but in parentheses, it might be translated. Let's see the example: in the translation, technical terms are kept, but here "archive" is not a proper noun or a specific tool. I'll translate the entire phrase.
tar xzf threat-intelligence-feeds.tar.gz --strip-components=1
# Translate: "复制所有项目文件到其中（解压缩档案）"
pip install -r requirements.txt
# 3. "Install Python dependencies" – "Install" is "安装", "Python" is a proper noun, keep in English, "dependencies" is "依赖项". So: "安装 Python 依赖项"
cd scripts
python3 Validator.py # validate the CSV
python3 FeedStatusChecker.py # check all feed URLs (~5 min, writes FeedStatus)
python3 UpdateREADME.py # regenerate README tables
# 4. "Run a full local update" – "Run" is "运行", "a full local update" is "一次完整的本地更新". So: "运行一次完整的本地更新"
cd ..
git add .
git commit -m "Initial commit with feed status"
git push
```
### GitHub Actions（自动）
首次推送后，工作流**每周一 UTC 时间06:00** 运行，并执行以下操作：
1. 检查所有源URL的HTTP状态 → 更新CSV中的`FeedStatus`列
2. 验证CSV文件
3. 重新生成统计信息和README中的两个表格
4. 如有任何更改，则提交并推送
你也可以手动触发：**Actions → Weekly Feed Update → Run workflow**
## 📋 所有源
状态说明：🟢 活跃 🔴 离线 ⚪ 尚未检查
### 5. "Push to GitHub" – "Push" is "推送", "to GitHub" keep "GitHub" in English. So: "推送至 GitHub"
| 提供商 | 描述 | 状态 | URL |
| --- | --- | :---: | --- |
| Abuse.ch | 僵尸网络C2 IP黑名单 (CSV) | 🟢 | [↗](https://sslbl.abuse.ch/blacklist/sslipblacklist.csv) |
| Abuse.ch | 僵尸网络C2 IP黑名单 (TXT) | 🟢 | [↗](https://sslbl.abuse.ch/blacklist/sslipblacklist.txt) |
| Abuse.ch | 激进版僵尸网络C2 IP黑名单 (CSV) | 🟢 | [↗](https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.csv) |
| Abuse.ch | 激进版僵尸网络C2 IP黑名单 (TXT) | 🟢 | [↗](https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.txt) |
| Abuse.ch | 僵尸网络C2 IOC - 推荐封锁列表 | 🟢 | [↗](https://feodotracker.abuse.ch/downloads/ipblocklist_recommended.txt) |
| Abuse.ch | 僵尸网络C2 IOC | 🟢 | [↗](https://feodotracker.abuse.ch/downloads/ipblocklist.txt) |
| Abuse.ch | Feodo Tracker曾见过的所有僵尸网络C2 | 🟢 | [↗](https://feodotracker.abuse.ch/blocklist/) |
| Abuse.ch | Feodo IP封锁列表（激进版） | 🟢 | [↗](https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.txt) |
| AbuseIPDB | AbuseIPDB 评分100 - 最近1天 | 🟢 | [↗](https://raw.githubusercontent.com/borestad/blocklist-abuseipdb/main/abuseipdb-s100-1d.ipv4) |
| AbuseIPDB | AbuseIPDB 评分100 - 最近30天 | 🟢 | [↗](https://raw.githubusercontent.com/borestad/blocklist-abuseipdb/main/abuseipdb-s100-30d.ipv4) |
| Alienvault | Alienvault IP信誉 | 🟢 | [↗](http://reputation.alienvault.com/reputation.data) |
| AlienVault | 通用IP信誉 | 🟢 | [↗](https://reputation.alienvault.com/reputation.generic) |
| APNIC Honeynet | SSH暴力破解IP | 🟢 | [↗](https://feeds.honeynet.asia/bruteforce/latest-sshbruteforce-unique.csv) |
| APNIC Honeynet | Telnet暴力破解IP | 🟢 | [↗](https://feeds.honeynet.asia/bruteforce/latest-telnetbruteforce-unique.csv) |
| Binarydefense | Binary Defense Artillery 威胁情报封锁列表 | 🟢 | [↗](https://www.binarydefense.com/banlist.txt) |
| Blocklist.de | 最近48小时内攻击过客户/服务器的所有IP | 🟢 | [↗](https://lists.blocklist.de/lists/all.txt) |
| Blocklist.de | 最近48小时内攻击过SSH的IP | 🟢 | [↗](https://lists.blocklist.de/lists/ssh.txt) |
| Blocklist.de | 最近48小时内攻击过邮件/Postfix的IP | 🟢 | [↗](https://lists.blocklist.de/lists/mail.txt) |
| Blocklist.de | 最近48小时内攻击过Apache的IP | 🟢 | [↗](https://lists.blocklist.de/lists/apache.txt) |
| Blocklist.de | 最近48小时内攻击过IMAP/SASL/POP3的IP | 🟢 | [↗](https://lists.blocklist.de/lists/imap.txt) |
| Blocklist.de | 最近48小时内因IRC/BadBots/RFI攻击被报告的IP | 🟢 | [↗](https://lists.blocklist.de/lists/bots.txt) |
| Blocklist.de | 对Joomla/Wordpress/Web登录进行暴力破解攻击的IP | 🟢 | [↗](https://lists.blocklist.de/lists/bruteforcelogin.txt) |
| Blocklist.de | 攻击次数超过5000次且超过2个月的IP | 🟢 | [↗](https://lists.blocklist.de/lists/strongips.txt) |
| Blocklist.de | 最近48小时内攻击过FTP的IP | 🟢 | [↗](https://lists.blocklist.de/lists/ftp.txt) |
| Blocklist.de | 最近48小时内攻击过SIP的IP | 🟢 | [↗](https://lists.blocklist.de/lists/sip.txt) |
| Blocklist.net.ua | 乌克兰封锁列表（乌克兰CERT） | 🟢 | [↗](https://blocklist.net.ua/blocklist.csv) |
| Botvrij.eu | Botvrij IOC IP目标地址 (原始) | 🟢 | [↗](http://www.botvrij.eu/data/ioclist.ip-dst.raw) |
| Botvrij.eu | Botvrij IOC IP源地址 (原始) | 🟢 | [↗](http://www.botvrij.eu/data/ioclist.ip-src.raw) |
| BruteForceBlocker | SSH暴力破解封锁器IP | 🟢 | [↗](http://danger.rulez.sk/projects/bruteforceblocker/blist.php) |
| C2IntelFeeds | C2 IP地址 - 30天已验证 | 🟢 | [↗](https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/feeds/IPC2s-30day.csv) |
| C2IntelFeeds | 未验证的C2 IP | 🟢 | [↗](https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/feeds/unverified/IPC2s.csv) |
| Carbon Black | Cobalt Strike LuckyMouse / TA428 | 🟢 | [↗](https://raw.githubusercontent.com/carbonblack/active_c2_ioc_public/main/cobaltstrike/actor-specific/cobaltstrike_luckymouse_ta428.csv) |
| Carbon Black | Cobalt Strike Pyxie | 🟢 | [↗](https://raw.githubusercontent.com/carbonblack/active_c2_ioc_public/main/cobaltstrike/actor-specific/cobaltstrike_pyxie.csv) |
| Carbon Black | ShadowPad IOC 2022-09 | 🔴 | [↗](https://raw.githubusercontent.com/carbonblack/active_c2_ioc_public/main/shadowpad/shadowpad_202209.tsv) |
| CINSscore | CINS 恶意IP列表 (ci-badguys) | 🟢 | [↗](https://cinsscore.com/list/ci-badguys.txt) |
| Cisco Talos | Talos IP黑名单 | 🔴 | [↗](http://www.talosintelligence.com/documents/ip-blacklist) |
| CleanTalk | CleanTalk黑名单 - 今日提交 | 🟢 | [↗](https://cleantalk.org/blacklists/submited_today) |
| CleanTalk | CleanTalk黑名单 - 今日更新 | 🔴 | [↗](https://cleantalk.org/blacklists/updated_today) |
| CleanTalk | CleanTalk黑名单 - 前20名 | 🔴 | [↗](https://cleantalk.org/blacklists/top20) |
| CriticalPathSecurity | Abuse.ch IP封锁列表源 | 🟢 | [↗](https://raw.githubusercontent.com/CriticalPathSecurity/Public-Intelligence-Feeds/master/abuse-ch-ipblocklist.txt) |
| CriticalPathSecurity | Log4j扫描器和利用者 | 🟢 | [↗](https://raw.githubusercontent.com/CriticalPathSecurity/Public-Intelligence-Feeds/master/log4j.txt) |
| CyberCure | 已封锁IP源 | 🔴 | [↗](https://api.cybercure.ai/feed/get_ips?type=csv) |
| Daniel Austin MBCS | TOR出口节点 | 🟢 | [↗](https://www.dan.me.uk/torlist/?exit) |
| Daniel Austin MBCS | TOR所有节点 | 🟢 | [↗](https://www.dan.me.uk/torlist/?full) |
| darklist.de | Darklist.de IP黑名单 | 🟢 | [↗](http://www.darklist.de/raw.php) |
| DataPlane | SIP查询源IP | 🟢 | [↗](https://dataplane.org/sipquery.txt) |
| DataPlane | SSH密码认证源IP | 🟢 | [↗](https://dataplane.org/sshpwauth.txt) |
| DataPlane | SSH客户端源IP | 🟢 | [↗](https://dataplane.org/sshclient.txt) |
| DataPlane | SIP注册源IP | 🟢 | [↗](https://dataplane.org/sipregistration.txt) |
| DataPlane | VNC RFB源IP | 🟢 | [↗](https://dataplane.org/vncrfb.txt) |
| DataPlane | DNS递归期望 | 🟢 | [↗](https://dataplane.org/dnsrd.txt) |
| DataPlane | DNS递归期望 IN ANY | 🟢 | [↗](https://dataplane.org/dnsrdany.txt) |
| DataPlane | DNS CH TXT version.bind | 🟢 | [↗](https://dataplane.org/dnsversion.txt) |
| DataPlane | SIP邀请源IP | 🟢 | [↗](https://dataplane.org/sipinvitation.txt) |
| DataPlane | SMTP数据源IP | 🟢 | [↗](https://dataplane.org/smtpdata.txt) |
| DataPlane | SMTP问候源IP | 🟢 | [↗](https://dataplane.org/smtpgreet.txt) |
| DataPlane | IP协议41源IP | 🟢 | [↗](https://dataplane.org/proto41.txt) |
| DataPlane | Telnet登录源IP | 🟢 | [↗](https://dataplane.org/telnetlogin.txt) |
| DigitalSide Threat-Intel | 威胁情报IP - 最近7天 | 🔴 | [↗](https://osint.digitalside.it/Threat-Intel/lists/latestips.txt) |
| DShield | 攻击最多的前20个子网 | 🟢 | [↗](https://feeds.dshield.org/block.txt) |
| Ellio | 防火墙威胁列表（社区） | 🟢 | [↗](https://cdn.ellio.tech/community-feed) |
| Emerging Threats | Emerging Threats Tor规则 | 🟢 | [↗](http://rules.emergingthreats.net/blockrules/emerging-tor.rules) |
| Emerging Threats | Emerging Threats封锁IP | 🟢 | [↗](http://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt) |
| Firehol | Firehol一级封锁列表 (netset) | 🟢 | [↗](https://raw.githubusercontent.com/ktsaou/blocklist-ipsets/master/firehol_level1.netset) |
| Github | Fox-IT Cobalt Strike服务器 | 🟢 | [↗](https://raw.githubusercontent.com/fox-it/cobaltstrike-extraneous-space/master/cobaltstrike-servers.csv) |
| GreenSnow | IP封锁列表 | 🔴 | [↗](https://blocklist.greensnow.co/greensnow.txt) |
| GriffinGuard | GriffinGuard滥用7天前10K | 🟢 | [↗](https://griffinguard.io/feeds/abuse7d_top10k.txt) |
| home.nuug.no | POP3 探测器 | 🟢 | [↗](https://home.nuug.no/~peter/pop3gropers.txt) |
| Infoblox | Infoblox威胁情报 (MISP格式) | 🔴 | [↗](https://raw.githubusercontent.com/infobloxopen/threat-intelligence/main/indicators/misp) |
| ipspamlist | IP垃圾邮件列表 | 🟢 | [↗](http://www.ipspamlist.com/public_feeds.csv) |
| IPsum | 恶意和/或可疑IP地址 - 1级 | 🟢 | [↗](https://raw.githubusercontent.com/stamparm/ipsum/master/levels/1.txt) |
| IPsum | 恶意和/或可疑IP地址 - 2级 | 🟢 | [↗](https://raw.githubusercontent.com/stamparm/ipsum/master/levels/2.txt) |
| IPsum | 恶意和/或可疑IP地址 - 3级 | 🟢 | [↗](https://raw.githubusercontent.com/stamparm/ipsum/master/levels/3.txt) |
| IPsum | 恶意和/或可疑IP地址 - 4级 | 🟢 | [↗](https://raw.githubusercontent.com/stamparm/ipsum/master/levels/4.txt) |
| IPsum | 恶意和/或可疑IP地址 - 5级 | 🟢 | [↗](https://raw.githubusercontent.com/stamparm/ipsum/master/levels/5.txt) |
| IPsum | 恶意和/或可疑IP地址 - 6级 | 🟢 | [↗](https://raw.githubusercontent.com/stamparm/ipsum/master/levels/6.txt) |
| IPsum | 恶意和/或可疑IP地址 - 7级 | 🟢 | [↗](https://raw.githubusercontent.com/stamparm/ipsum/master/levels/7.txt) |
| IPsum | 恶意和/或可疑IP地址 - 8级 | 🟢 | [↗](https://raw.githubusercontent.com/stamparm/ipsum/master/levels/8.txt) |
| James Brine | James Brine暴力破解IP | 🔴 | [↗](https://jamesbrine.com.au/csv) |
| MalSilo | MalSilo IPv4列表 | 🟢 | [↗](https://malsilo.gitlab.io/feeds/dumps/ip_list.txt) |
| Maltrail | Maltrail大规模扫描器IP | 🟢 | [↗](https://raw.githubusercontent.com/stamparm/maltrail/master/trails/static/mass_scanner.txt) |
| mirai.security.gives | Mirai僵尸网络IP | 🟢 | [↗](https://mirai.security.gives/data/ip_list.txt) |
| MISP Abuse.ch | MISP Abuse.ch Feodo Tracker | 🔴 | [↗](https://feodotracker.abuse.ch/downloads/misp/) |
| montysecurity | Brute Ratel C4 C2 IP | 🔴 | [↗](https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/Brute%20Ratel%20C4%20IPs.txt) |
| montysecurity | Cobalt Strike C2 IP | 🔴 | [↗](https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/Cobalt%20Strike%20C2%20IPs.txt) |
| montysecurity | Posh C2 IP | 🔴 | [↗](https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/Posh%20C2%20IPs.txt) |
| montysecurity | Sliver C2 IP | 🔴 | [↗](https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/Sliver%20C2%20IPs.txt) |
| montysecurity | Metasploit框架 C2 IP | 🔴 | [↗](https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/Metasploit%20Framework%20C2%20IPs.txt) |
| montysecurity | Havoc C2 IP | 🔴 | [↗](https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/Havoc%20C2%20IPs.txt) |
| montysecurity | BurpSuite IP | 🔴 | [↗](https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/BurpSuite%20IPs.txt) |
| montysecurity | Deimos C2 IP | 🔴 | [↗](https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/Deimos%20C2%20IPs.txt) |
| montysecurity | GoPhish IP | 🔴 | [↗](https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/GoPhish%20IPs.txt) |
| montysecurity | Gotham Stealer IP | 🔴 | [↗](https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/Gotham%20Stealer%20IPs.txt) |
| montysecurity | Hashcat破解工具 IP | 🔴 | [↗](https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/Hachcat%20Cracking%20Tool%20IPs.txt) |
| montysecurity | Mythic C2 IP | 🔴 | [↗](https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/Mythic%20C2%20IPs.txt) |
| montysecurity | NimPlant C2 IP | 🔴 | [↗](https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/NimPlant%20C2%20IPs.txt) |
| montysecurity | PANDA C2 IP | 🔴 | [↗](https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/PANDA%20C2%20IPs.txt) |
| montysecurity | PowerSploit IP | 🔴 | [↗](https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/PowerSploit%20IPs.txt) |
| montysecurity | XMRig Monero加密货币矿工 IP | 🔴 | [↗](https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/XMRig%20Monero%20Cryptominer%20IPs.txt) |
| montysecurity | 所有C2 Tracker IP（合并） | 🔴 | [↗](https://raw.githubusercontent.com/montysecurity/C2-Tracker/main/data/all.txt) |
| Mr. Looquer | IOC源 (IP和DNS) | 🔴 | [↗](https://iocfeed.mrlooquer.com/feed.csv) |
| mthcht | NordVPN IP列表 | 🟢 | [↗](https://github.com/mthcht/awesome-lists/blob/main/Lists/VPN/NordVPN/nordvpn_ips_list.csv) |
| mthcht | ProtonVPN IP列表 | 🟢 | [↗](https://github.com/mthcht/awesome-lists/blob/main/Lists/VPN/ProtonVPN/protonvpn_ip_list.csv) |
| Ngosang | BitTorrent Tracker IP列表 | 🟢 | [↗](https://raw.githubusercontent.com/ngosang/trackerslist/master/trackers_all_ip.txt) |
| opsxcq | 开放代理列表 | 🟢 | [↗](https://raw.githubusercontent.com/opsxcq/proxy-list/master/list.txt) |
| pan-unit42 | DiamondFox控制面板 | 🟢 | [↗](https://raw.githubusercontent.com/pan-unit42/iocs/master/diamondfox/diamondfox_panels.txt) |
| Proofpoint | 受侵害IP地址列表 (Emerging Threats) | 🟢 | [↗](https://rules.emergingthreats.net/blockrules/compromised-ips.txt) |
| Sblam | Sblam垃圾评论IP | 🟢 | [↗](http://sblam.com/blacklist.txt) |
| SecOps-Institute | Tor节点列表 | 🟢 | [↗](https://raw.githubusercontent.com/SecOps-Institute/Tor-IP-Addresses/master/tor-nodes.lst) |
| SecOps-Institute | Tor出口节点列表 | 🟢 | [↗](https://raw.githubusercontent.com/SecOps-Institute/Tor-IP-Addresses/master/tor-exit-nodes.lst) |
| SNORT | 官方Snort IP封锁列表 | 🟢 | [↗](https://snort.org/downloads/ip-block-list) |
| Spamhaus | Spamhaus DROP列表（旧版txt） | 🟢 | [↗](http://www.spamhaus.org/drop/drop.txt) |
| Spamhaus Project | Don't Route Or Peer (DROP) 列表 | 🟢 | [↗](https://www.spamhaus.org/drop/drop_v4.json) |
| StopForumSpam | 论坛垃圾邮件发送者IP（最近1天） | 🟢 | [↗](https://www.stopforumspam.com/downloads/listed_ip_1.txt) |
| StopForumSpam | 论坛垃圾邮件发送者IP（最近7天） | 🔴 | [↗](https://www.stopforumspam.com/downloads/listed_ip_7.txt) |
| StopForumSpam | 论坛垃圾邮件发送者IP（最近30天） | 🔴 | [↗](https://www.stopforumspam.com/downloads/listed_ip_30.txt) |
| StopForumSpam | 论坛垃圾邮件发送者IP - 1天 (zip) | 🟢 | [↗](http://www.stopforumspam.com/downloads/listed_ip_1.zip) |
| StopForumSpam | 论坛垃圾邮件发送者IP - 7天 (zip) | 🟢 | [↗](http://www.stopforumspam.com/downloads/listed_ip_7.zip) |
| StopForumSpam | 论坛垃圾邮件发送者IP - 30天 (zip) | 🟢 | [↗](http://www.stopforumspam.com/downloads/listed_ip_30.zip) |
| StopForumSpam | 论坛垃圾邮件发送者IP - 90天 (zip) | 🟢 | [↗](http://www.stopforumspam.com/downloads/listed_ip_90.zip) |
| StopForumSpam | 论坛垃圾邮件发送者IP - 180天 (zip) | 🟢 | [↗](http://www.stopforumspam.com/downloads/listed_ip_180.zip) |
| StopForumSpam | 有害IP CIDR | 🟢 | [↗](http://www.stopforumspam.com/downloads/toxic_ip_cidr.txt) |
| threatview.io | 来自Twitter和Pastebin的OSINT IOC | 🟢 | [↗](https://threatview.io/Downloads/Experimental-IOC-Tweets.txt) |
| threatview.io | 高置信度Cobalt Strike C2源 | 🟢 | [↗](https://threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt) |
| threatview.io | IP高置信度源 | 🟢 | [↗](https://threatview.io/Downloads/IP-High-Confidence-Feed.txt) |
| TorProject | Tor出口地址（TorProject官方） | 🟢 | [↗](https://check.torproject.org/exit-addresses) |
| tweetfeed.live | 信息安全社区在Twitter分享的IOC - 今日 (IP/URL/DNS/哈希) | 🟢 | [↗](https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/today.csv) |
| tweetfeed.live | 信息安全社区在Twitter分享的IOC - 一周 (IP/URL/DNS/哈希) | 🟢 | [↗](https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/week.csv) |
| tweetfeed.live | 信息安全社区在Twitter分享的IOC - 一月 (IP/URL/DNS/哈希) | 🟢 | [↗](https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/month.csv) |
| tweetfeed.live | 信息安全社区在Twitter分享的IOC - 一年 (IP/URL/DNS/哈希) | 🟢 | [↗](https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/year.csv) |
| Ultimate-Hosts-Blacklist | Ultimate Hosts黑名单 IP | 🟢 | [↗](https://raw.githubusercontent.com/Ultimate-Hosts-Blacklist/Ultimate.Hosts.Blacklist/master/ips/ips0.list) |
| X4BNet | VPN IP | 🟢 | [↗](https://raw.githubusercontent.com/X4BNet/lists_vpn/main/output/vpn/ipv4.txt) |
| Yoyo | Yoyo广告服务器IP | 🟢 | [↗](http://pgl.yoyo.org/adservers/iplist.php?ipformat=plain&showintro=0&mimetype=plaintext) |
### Now, for the technical terms with numbers in parentheses:
| 提供商 | 描述 | 状态 | URL |
| --- | --- | :---: | --- |
| Abuse.ch | 主机文件包含有效载荷投递域和僵尸网络C2域（最近6个月） | 🟢 | [↗](https://threatfox.abuse.ch/downloads/hostfile/) |
| Botvrij.eu | 黑名单域名 | 🟢 | [↗](https://www.botvrij.eu/data/blocklist/blocklist_domain.csv) |
| C2IntelFeeds | C2域名列表 - 30天过滤被滥用 | 🟢 | [↗](https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/feeds/domainC2s-30day-filter-abused.csv) |
| C2IntelFeeds | C2域名列表 | 🟢 | [↗](https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/feeds/domainC2s.csv) |
| CERT-PL | 波兰恶意域名列表 (txt) | 🟢 | [↗](https://hole.cert.pl/domains/domains.txt) |
| Cert.PL | 恶意域名 | 🟢 | [↗](https://hole.cert.pl/domains/domains.csv) |
| DigitalSide Threat-Intel | 威胁情报域名 - 最近7天 | 🔴 | [↗](https://osint.digitalside.it/Threat-Intel/lists/latestdomains.txt) |
| MalSilo | MalSilo域名列表 | 🟢 | [↗](https://malsilo.gitlab.io/feeds/dumps/domain_list.txt) |
| Mr. Looquer | IOC源 (IP和DNS) | 🔴 | [↗](https://iocfeed.mrlooquer.com/feed.csv) |
| osint.bambenekconsulting.com | DGA高置信度恶意域名 | 🔴 | [↗](https://osint.bambenekconsulting.com/feeds/dga-feed-high.csv) |
| osint.bambenekconsulting.com | 高置信度基于DGA的C2域名 | 🔴 | [↗](https://osint.bambenekconsulting.com/feeds/c2-dommasterlist-high.txt) |
| shreshtait.com | 新注册域名 - 1个月 | 🟢 | [↗](https://shreshtait.com/newly-registered-domains/nrd-1m) |
| shreshtait.com | 新注册域名 - 1周 | 🟢 | [↗](https://shreshtait.com/newly-registered-domains/nrd-1w) |
| threatview.io | 高置信度Cobalt Strike C2源 | 🟢 | [↗](https://threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt) |
| threatview.io | 域名高置信度源 | 🟢 | [↗](https://threatview.io/Downloads/DOMAIN-High-Confidence-Feed.txt) |
| tsirolnik | 垃圾邮件域名列表 | 🟢 | [↗](https://raw.githubusercontent.com/tsirolnik/spam-domains-list/master/spamdomains.txt) |
| tweetfeed.live | 信息安全社区在Twitter分享的IOC - 今日 (IP/URL/DNS/哈希) | 🟢 | [↗](https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/today.csv) |
| tweetfeed.live | 信息安全社区在Twitter分享的IOC - 一周 (IP/URL/DNS/哈希) | 🟢 | [↗](https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/week.csv) |
| virtualfabric | NRD列表 - 新注册域名 (32天) | 🔴 | [↗](https://nocdn.nrd-list.com/0/nrd-list-32-days.txt) |
| virtualfabric | 威胁域名列表（直接） | 🔴 | [↗](https://nocdn.threat-list.com/0/domains.txt) |
| virtualfabric | 威胁域名列表（下载CDN） | 🔴 | [↗](https://dl.threat-list.com/1/domains.txt) |
| ZeroDot1 | CoinBlockerLists - 浏览器挖矿域名 | 🔴 | [↗](https://gitlab.com/ZeroDot1/CoinBlockerLists/raw/master/list_browser.txt?inline=false) |
| ZeroDot1 | CoinBlockerLists - 所有域名 | 🔴 | [↗](https://gitlab.com/ZeroDot1/CoinBlockerLists/raw/master/list.txt?inline=false) |
| ZeroDot1 | CoinBlockerLists - 可选域名 | 🔴 | [↗](https://gitlab.com/ZeroDot1/CoinBlockerLists/raw/master/list_optional.txt?inline=false) |
### 6. "IP (133)" – "IP" is a technical term, keep in English, and "(133)" might indicate a count or something. Since the instruction is to keep terms in English, I should keep "IP" in English and translate the number if needed? But the number is in parentheses and might be part of the data. In the output, I need to translate the heading. The heading is "IP (133)", so I should translate it as is, keeping "IP" in English. But in Chinese, numbers are often the same, so I can keep the number as is.
| 提供商 | 描述 | 状态 | URL |
| --- | --- | :---: | --- |
| Abuse.ch | 近期有效载荷投递和僵尸网络C2 URL (ThreatFox) | 🟢 | [↗](https://threatfox.abuse.ch/export/csv/urls/recent/) |
| Abuse.ch | 近期恶意软件URL (URLhaus) | 🟢 | [↗](https://urlhaus.abuse.ch/downloads/csv_recent/) |
| Abuse.ch | ThreatFox IOC - 近期（所有类型） | 🟢 | [↗](https://threatfox.abuse.ch/export/csv/recent/) |
| APNIC Honeynet | 蜜罐中看到的URL | 🟢 | [↗](https://feeds.honeynet.asia/url/latest-url-unique.csv) |
| Benkow.cc | Benkow控制面板追踪器 | 🔴 | [↗](https://benkow.cc/export.php) |
| C2IntelFeeds | 带URL的C2域名 - 30天过滤被滥用 | 🟢 | [↗](https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/feeds/domainC2swithURL-30day-filter-abused.csv) |
| C2IntelFeeds | 带URL的C2域名 - 过滤被滥用 | 🟢 | [↗](https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/feeds/domainC2swithURL-filter-abused.csv) |
| C2IntelFeeds | 带URL和IP的C2域名 - 30天过滤被滥用 | 🟢 | [↗](https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/master/feeds/domainC2swithURLwithIP-30day-filter-abused.csv) |
| cybercrime-tracker.net | 网络犯罪追踪器 -2 | 🟢 | [↗](https://cybercrime-tracker.net/all.php) |
| cybercrime-tracker.net | 网络犯罪追踪器 - 门列表 | 🟢 | [↗](https://cybercrime-tracker.net/ccamgate.php) |
| CyberCure | 已封锁URL源 | 🔴 | [↗](https://api.cybercure.ai/feed/get_url?type=csv) |
| DigitalSide Threat-Intel | 威胁情报URL - 最近7天 | 🔴 | [↗](https://osint.digitalside.it/Threat-Intel/lists/latesturls.txt) |
| DigitalSide Threat-Intel | DigitalSide OSINT源 (MISP格式) | 🔴 | [↗](https://osint.digitalside.it/Threat-Intel/digitalside-misp-feed/) |
| Github | APT Notes CSV | 🟢 | [↗](https://raw.githubusercontent.com/aptnotes/data/master/APTnotes.csv) |
| MalSilo | MalSilo URL列表 | 🟢 | [↗](https://malsilo.gitlab.io/feeds/dumps/url_list.txt) |
| MISP Abuse.ch | MISP Abuse.ch URLhaus | 🟢 | [↗](https://urlhaus.abuse.ch/downloads/misp/) |
| MISP Project | MISP默认源（元数据） | 🟢 | [↗](https://raw.githubusercontent.com/MISP/MISP/2.4/app/files/feed-metadata/defaults.json) |
| OpenPhish | 钓鱼URL | 🟢 | [↗](https://openphish.com/feed.txt) |
| Phishing Army | Phishing Army封锁列表 | 🟢 | [↗](https://phishing.army/download/phishing_army_blocklist.txt) |
| Phishing Army | Phishing Army封锁列表扩展版 | 🟢 | [↗](https://phishing.army/download/phishing_army_blocklist_extended.txt) |
| PhishStats | PhishScore CSV | 🔴 | [↗](https://phishstats.info/phish_score.csv) |
| PhishTank | PhishTank在线有效钓鱼 | 🟢 | [↗](https://data.phishtank.com/data/online-valid.csv) |
| PhishTank | PhishTank在线有效钓鱼 (JSON) | 🔴 | [↗](http://data.phishtank.com/data/online-valid.json) |
| ThreatMon | ThreatMon每日C2源 | 🟢 | [↗](https://github.com/ThreatMon/ThreatMon-Daily-C2-Feeds) |
| threatview.io | URL高置信度源 | 🟢 | [↗](https://threatview.io/Downloads/URL-High-Confidence-Feed.txt) |
| threatview.io | 比特币地址情报 | 🟢 | [↗](https://threatview.io/Downloads/MALICIOUS-BITCOIN_FEED.txt) |
| tweetfeed.live | 信息安全社区在Twitter分享的IOC - 今日 (IP/URL/DNS/哈希) | 🟢 | [↗](https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/today.csv) |
| tweetfeed.live | 信息安全社区在Twitter分享的IOC - 一周 (IP/URL/DNS/哈希) | 🟢 | [↗](https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/week.csv) |
| tweetfeed.live | 信息安全社区在Twitter分享的IOC - 一月 (IP/URL/DNS/哈希) | 🟢 | [↗](https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/month.csv) |
| tweetfeed.live | 信息安全社区在Twitter分享的IOC - 一年 (IP/URL/DNS/哈希) | 🟢 | [↗](https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/year.csv) |
| urlabuse | URL滥用黑名单源 | 🟢 | [↗](https://urlabuse.com/public/data/data.txt) |
| urlabuse | 恶意软件URL源 | 🟢 | [↗](https://urlabuse.com/public/data/malware_url.txt) |
| urlabuse | 钓鱼URL源 | 🟢 | [↗](https://urlabuse.com/public/data/phishing_url.txt) |
| urlabuse | 被黑URL源 | 🟢 | [↗](https://urlabuse.com/public/data/hacked_url.txt) |
| urlabuse | URL滥用数据库 - 最新500条记录 (CSV) | 🟢 | [↗](https://urlabuse.com/public/data/data_csv.txt) |
| VXVault | VXVault恶意软件URL列表 | 🟢 | [↗](http://vxvault.net/ViriList.php?s=0&m=100) |
| VXVault | VXVault URL列表 | 🟢 | [↗](http://vxvault.net/URL_List.php) |
### The instruction says: "output exactly 16 line(s) of translation, one per line, in the same order." And "Keep all professional terms... in their original English form." So for these, I should keep "IP", "DNS", etc., in English, and the numbers in parentheses might be translated or kept? Numbers are universal, but in context, they might be part of the data. I think I should keep the entire line as is, but translate any descriptive text. Here, it's just the term and a number, so perhaps I don't need to translate the number, but since it's part of the line, I should output it in Chinese context.
| 提供商 | 描述 | 状态 | URL |
| --- | --- | :---: | --- |
| Abuse.ch | MD5哈希值 - 近期新增 (MalwareBazaar) | 🟢 | [↗](https://bazaar.abuse.ch/export/txt/md5/recent/) |
| Abuse.ch | MD5哈希值 - C2上近期恶意文件 (ThreatFox) | 🟢 | [↗](https://threatfox.abuse.ch/export/csv/md5/recent/) |
| Botvrij.eu | IOC列表 MD5 | 🟢 | [↗](https://www.botvrij.eu/data/ioclist.md5) |
| cybercrime-tracker.net | 网络犯罪追踪器 - 哈希列表 | 🟢 | [↗](https://cybercrime-tracker.net/ccamlist.php) |
| CyberCure | 恶意哈希源 | 🔴 | [↗](https://api.cybercure.ai/feed/get_hash?type=csv) |
| malshare.com | Malshare当前全部 | 🟢 | [↗](https://malshare.com/daily/malshare.current.all.txt) |
| MISP CIRCL | MISP CIRCL OSINT源 - 哈希值 | 🟢 | [↗](https://www.circl.lu/doc/misp/feed-osint/) |
| MISP Feed CERT-FR | MISP源 CERT-FR 哈希值 | 🟢 | [↗](https://misp.cert.ssi.gouv.fr/feed-misp/hashes.csv) |
| threatview.io | MD5哈希封锁列表 | 🟢 | [↗](https://threatview.io/Downloads/MD5-HASH-ALL.txt) |
### To be safe, I'll keep the terms in English and the numbers as is, since numbers are not language-specific.
| 提供商 | 描述 | 状态 | URL |
| --- | --- | :---: | --- |
| Abuse.ch | SHA1哈希值 - 近期新增 (MalwareBazaar) | 🟢 | [↗](https://bazaar.abuse.ch/export/txt/sha1/recent/) |
| Botvrij.eu | IOC列表 SHA1 | 🟢 | [↗](https://www.botvrij.eu/data/ioclist.sha1) |
| threatview.io | SHA文件哈希源 | 🟢 | [↗](https://threatview.io/Downloads/SHA-HASH-FEED.txt) |
### But let's see the example: the user didn't provide a direct example for such lines. However, in the list, it's like technical terms with counts, so I should output them similarly.
| 提供商 | 描述 | 状态 | URL |
| --- | --- | :---: | --- |
| Abuse.ch | SHA256哈希值 - 近期新增 (MalwareBazaar) | 🟢 | [↗](https://bazaar.abuse.ch/export/txt/sha256/recent/) |
| Abuse.ch | SHA256哈希值 - C2上近期恶意文件 (ThreatFox) | 🟢 | [↗](https://threatfox.abuse.ch/export/csv/sha256/recent/) |
| Banco do Brasil | 恶意哈希列表 (SHA256) | 🔴 | [↗](https://cti.bb.com.br:8443/hash-list.csv) |
| Botvrij.eu | IOC列表 SHA256 | 🟢 | [↗](https://www.botvrij.eu/data/ioclist.sha256) |
| tweetfeed.live | 信息安全社区在Twitter分享的IOC - 今日 (IP/URL/DNS/哈希) | 🟢 | [↗](https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/today.csv) |
### Translate: "IP (133)" to "IP (133)" – but I need to translate it to Simplified Chinese. In Chinese, it might be written the same way, with IP in English and the number in Arabic numerals. I think I can keep it as "IP (133)", but that's not a translation. I need to translate the text. Perhaps for these, since they are proper nouns or codes, I keep them in English, but the parentheses might contain numbers that are the same in Chinese.
| 提供商 | 描述 | 状态 | URL |
| --- | --- | :---: | --- |
| Abuse.ch | SSL证书黑名单 | 🟢 | [↗](https://sslbl.abuse.ch/blacklist/sslblacklist.csv) |
### I think for consistency, I should output the terms in English and the numbers as is, but the instruction is to translate the headings. The headings are given, and I need to translate them.
| 提供商 | 描述 | 状态 | URL |
| --- | --- | :---: | --- |
| Abuse.ch | JA3指纹黑名单 | 🟢 | [↗](https://sslbl.abuse.ch/blacklist/ja3_fingerprints.csv) |
### Let's read the instruction carefully: "Translate each of the following headings to Simplified Chinese." And "Keep all professional terms... in their original English form." So for these technical terms, they should remain in English. The numbers in parentheses might be part of the data, so I should keep them as is.
| 提供商 | 描述 | 状态 | URL |
| --- | --- | :---: | --- |
| CISA | 已知被利用漏洞目录 (CSV) | 🟢 | [↗](https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv) |
| CISA | 已知被利用漏洞目录 (JSON) | 🟢 | [↗](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) |
| eCrimeLabs | 有Metasploit可用的漏洞 | 🟢 | [↗](https://feeds.ecrimelabs.net/data/metasploit-cve) |
| NIST | 国家漏洞数据库CVE | 🟢 | [↗](https://services.nvd.nist.gov/rest/json/cves/2.0) |
### For example, if it were "IP Address", I might translate to "IP 地址", but here it's just "IP (133)", so "IP" stays in English, and "(133)" is kept.
| 提供商 | 描述 | 状态 | URL |
| --- | --- | :---: | --- |
| ransomware.live | 泄露站点上所有勒索软件受害者 | 🟢 | [↗](https://api.ransomware.live/allcyberattacks) |
### So for line 6: "IP (133)" -> "IP (133)" but in Simplified Chinese context, it might be the same. However, to be precise, I should output it as is, but the instruction says to translate, so perhaps I need to ensure the text is in Chinese. But since "IP" is English and numbers are universal, I can output "IP (133)" as the translation.
| 提供商 | 描述 | 状态 | URL |
| --- | --- | :---: | --- |
| mthcht | 可疑命名管道列表 | 🔴 | [↗](https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_named_pipe_list.csv) |
## 🤝 贡献指南
1. 在`ThreatIntelFeeds.csv`中添加一行：
提供商;描述;类别;URL
2. 源必须**免费且公开可访问** —— 无需账号/API密钥。
3. 有效类别：`SSL` `IP` `DNS` `URL` `MD5` `SHA1` `SHA256` `CVEID` `RANSOMWARELEAK` `JA3` `NamePipe`
4. 验证：`cd scripts && python3 Validator.py`
5. 更新README：`python3 UpdateREADME.py`
6. 发起一个拉取请求。
## 🔗 致谢
- [Bert-JanP/Open-Source-Threat-Intel-Feeds](https://github.com/Bert-JanP/Open-Source-Threat-Intel-Feeds)
- [montysecurity/C2-Tracker](https://github.com/montysecurity/C2-Tracker)
- [MISP项目源](https://www.misp-project.org/feeds/)
- [firehol/blocklist-ipsets](https://github.com/firehol/blocklist-ipsets)
- [Bert-JanP/Hunting-Queries-Detection-Rules](https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules)
标签：AMSI绕过, CVE漏洞, IOC源, JA3指纹, masscan, meg, SSL证书, URL黑名单, 信息安全, 免费资源, 勒索软件, 哈希验证, 威胁情报, 威胁情报平台, 威胁检测, 安全聚合, 开发者工具, 恶意IP, 恶意域名, 指标收集, 数据聚合, 社区项目, 网络安全, 自动化验证, 逆向工具, 防御资源, 隐私保护, 黑名单