Public access
Please use the URL https://fulfilment.threatint.com/tdf?feed=<feed> to download our publicly available Threat Data Feeds and replace <feed> with one of the following:
bad-ips
bad-networks
bad-domains
bad-fqdns
bad-urls
anonymiser-ips

The public lists shown above contain about 1% of all Threat Data Feeds we provide to subscribers.

Subscribers
If you have a valid subscription, the URLs differ slightly. The basic format is:

https://fulfilment.threatint.com/tdf?email=<email>&subscription=<subscription-id>&feed=<feed>

Kindly use the <email> used when subscribing and the <subscription-id> from your welcome email

Notice:
You may need to encode your email address, e.g. if it contains characters like + , . Please see
RFC#3986, section 2.1 ("percent encoding") or
developer.mozilla.org/en-US/docs/Glossary/percent-encoding or
developers.google.com/maps/url-encoding
for details.
Was this article helpful?
Cancel
Thank you!