## 📡 Intelligence Feeds

[← Back to Index](../README.md)

### Community Threat Feeds
- [ThreatFox](https://threatfox.abuse.ch/) — Community-driven IOC feed  
- [URLhaus](https://urlhaus.abuse.ch/) — Malicious URL tracker  
- [Feodo Tracker](https://feodotracker.abuse.ch/) — Banking trojan command and control trackers  
- [MalwareBazaar](https://bazaar.abuse.ch/) — Malware sample and hash sharing platform  
- [AlienVault OTX](https://otx.alienvault.com/) — Open threat exchange community  

### Commercial and Specialized Feeds
- [Spamhaus](https://www.spamhaus.org/) — Blocklists for IPs, domains, and spam sources  
- [AbuseIPDB](https://www.abuseipdb.com/) — Community-reported IP abuse database  
- [CIRCL OSINT Feeds](https://www.circl.lu/services/osint/) — Public OSINT-based threat feeds from Luxembourg  
- [Abuse.ch SSLBL](https://sslbl.abuse.ch/) — SSL certificate blocklist for malicious infrastructure  
- [PhishTank](https://phishtank.org/) — Community phishing URL repository (overlaps phishing but also feed source)  
- [OpenPhish](https://openphish.com/) — Automated phishing intelligence feed  

### Attack Surface and Internet Scanning
- [GreyNoise](https://www.greynoise.io/) — Contextual intelligence for internet scanners  
- [Shodan Alerts](https://www.shodan.io/alerts) — Monitor exposure of internet-connected assets  
- [Censys Search and Data](https://censys.io/) — Enriched dataset of hosts and certificates