A threat intelligence feed without the noise.
Evidence-backed malicious domains and IPs for blocking and detection. Try it on your own logs for 14 days.
Run your feed against what we delisted.
Every host we turn down goes on our delisted feed with the date and the reason, so during your evaluation you'll see which hosts in the feed you use now we checked and rejected, and why.
A lot of threat feeds are built from reports: another feed, a researcher or a sandbox flags a host, and the feed passes it on. We get those reports too, and each one is a place for us to look. Nothing gets in on someone else's word. A host only goes into the feed when our scanner, our sandbox, our contract monitor or one of our analysts can show why.
The feed holds 111,504 hosts. Last week we added 7,820 and removed 3,793 remediated indicators. In the same week 6,983 websites were flagged for review, and 1,206 of them did not hold up. A feed that takes reports at their word puts every one of those on your block list.
When a host comes out, your block list drops it.
Hacked sites get cleaned up and reports turn out to be wrong. A removed host moves to the delisted feed with the date and a plain-English reason, and over TAXII it arrives as a revoked indicator.
Read about the delisted feed in the API docs{
"host": "softify[.]lat",
"reason": "Decoded contract 0x289fd372fc932a5c68846b97e249a4e4299f4f48 on chain 137 named this host as a destination.",
"decidedBy": "automated",
"feedTypes": ["c2"],
"families": ["lenai"],
"tags": ["clickfixc2"],
"infraTypes": ["hosting"],
"countries": ["US"],
"asns": [16509],
"asOrgs": ["Amazon.com, Inc."],
"resolvedIps": ["216.198.79[.]1"],
"ports": [],
"sha256Samples": [],
"dnsStatus": "live",
"passiveDnsHits": 0,
"trancoRank": null,
"firstSeen": "2026-11-03T16:05:29.809571Z",
"lastSeen": "2026-11-04T08:00:59.929837Z",
"addedAt": "2026-11-04T08:01:00.879038Z"
}/v1/indicators returned it on 5 November 2026, defanged for this page. It's a LenAI control server we found through a contract on the EtherHiding tracker.Phishing pages, C2 servers and hacked sites, told apart.
An alert on a bare domain leaves your analyst starting from scratch. Every host in the feed tells you whether it's the page people land on or the server behind it, and whether it's a real business that's been hacked. You block a phishing kit outright. A hacked shop is somebody's business, and you may want an alert instead.
Every host carries one sentence on what put it in the feed. In this record, it's a contract that named the host.
Read about the kits on Web Threats
We built Ohey because threat intelligence is too trusting.
We're malware researchers, and Ohey grew out of our work at Derp.ca.
Post a host to one of the main sharing sites and within a day it shows as malicious on VirusTotal. Not every one of those has evidence behind it, and some of it is plain manipulation.
Commodity malware like AsyncRAT and Remcos kept turning up with South Asian gambling sites in its config, and the network logs never showed those domains answering. Working with Hieu Ngo of TRM Labs, we figured out why: it was black-hat SEO. Every researcher, sandbox and feed that published those domains gave them another link.
On 10 October 2026, reporters on another feed flagged 11 clinic websites for credential theft. We read the code. They were a web agency's demo pages, and not one of them had an input field.
Read the full storyOur latest research.
Write-ups of the campaigns we find, with the hosts, hashes and code behind them.
All research
Commands and contracts, tracked daily.
A ClickFix lure copies a command for the visitor to paste into Run, PowerShell or Terminal. We decode every command our scanner captures and list the hosts they download from, with the kit behind each.
EtherHiding kits read their next stage from a smart contract, so the operator can swap servers without touching the hacked sites. We read each contract we track once a day and record every change of destination.
Common questions about the threat feed.
How noisy will it be?
Quiet. Big platforms, shared hosting and the most visited sites never go into the feed without an analyst's decision, so one phishing page on a shared server does not put everyone else on it in your block list.
How often does it update?
The feed rebuilds every hour and we check DNS on every host daily. We rescan hacked sites every 30 days and take them out once they're clean, and an IP with no new evidence for 30 days comes out.
What format is it in?
STIX 2.1 over TAXII for your SIEM or TIP, plain lists of domains and IPs for your firewall or DNS filter, and JSON through the API. Microsoft Sentinel, OpenCTI and MISP connect to the TAXII server with your API key.
Threat feed licences and a 14-day evaluation.
Pick the licence by where the data ends up. Blocklists are $500 a month and the full feed is from $2,000.
| Licence | What it allows |
|---|---|
| Internal | Block, alert and investigate inside your own organization. Nothing derived from the data leaves it. |
| Redistribution | Use it in what you deliver to your customers. |
| Research | One researcher investigating and publishing, in the portal. |
Test it before you pick. Request an evaluation and we'll send you a live API key for 14 days, with the same feed, removals and reasons a customer gets, to run against your own logs and the feed you use now.