Essential Protection for Devices: Feeds

Overview

Our feeds contain lists of IP addresses (both single hosts and/or networks) from which we recommend not to allow any incoming and/or outgoing traffic. Kindly choose from the following list depending on your network environment (IPv4, IPv6) and the capabilities of your device:

Feed	Description
`bad-ipaddr`	single host IPs, both IPv4 and IPv6
`bad-ipaddr-ipv4`	single host IPs, IPv4 only
`bad-ipaddr-ipv6`	single host IPs, IPv6 only
`bad-networks`	IP networks, both IPv4 and IPv6
`bad-networks-ipv4`	IP networks, IPv4 only
`bad-networks-ipv6`	IP networks, IPv6 only
`bad-networks-ipaddr`	single host IPs and IP networks combined, both IPv4 and IPv6
`bad-networks-ipaddr-ipv4`	single host IPs and IP networks combined, IPv4 only
`bad-networks-ipaddr-ipv6`	single host IPs and IP networks combined, IPv6 only

OPNsense® or pfSense® can utilise feeds with single host IP addresses and networks in one feed, which makes bad-networks-ipaddr the perfect choice for these platforms.

Accessing the feeds

You need a valid subscription (either paid or trial) to access our feeds.
All feeds must be accessed via HTTP GET.
Platform like OPNsense® or pfSense® have builtin support for HTTP GET.
Other platforms or servers might need command line clients or libraries like curl or wget.

Please construct all URLs according to the following scheme to access the feeds:

https:// fulfilment.threatint.eu /tdf ? email=[email address] & subscription=[subscription ID] & feed=[feed]

Part	Description
[email]	Email address used to purchase the subscription
[subscription ID]	Subscription ID from the welcome mail you received from us after subscribing
[feed]	Feed, see table above

We have intentionally added whitespaces to all URLs to prevent search engines like Google or Bing from crawling these URLs. Please remove all whitespaces from all URLs before using them.

Last updated: 2025-09-22T10:15:51Z