Diamond Introducing

C2 Feeds

New feeds focused exclusively on command & control (C2) IOCs. Starting April 20, new IOCs will be manually reviewed and C2s are added to these curated feeds.

The result: significantly less noise, higher confidence, and more actionable insights compared to general IOC feeds—so you can focus on what truly matters.

Command & Control Feeds entries built according to the following rules:

  • They only contain command-and-control servers.
  • They only contain network IOCs that were added within the last 90 days.
  • They need to have a false positive risk score of at most "low".

Generic Feeds

Generic Feeds contain all IOC types, including domain:port, ip:port, and domain:ip composites.

Should be used for
Generic JSON Lines
Custom integrations
Generic CSV
Custom integrations
Generic Plain Text
Custom integrations

Domain Feeds

These feeds contain only domains.

Should be used for
AdBlock
Pi-hole, AdGuard, AdGuard Home, eBlocker, uBlock Origin, AdBlock, Adblock Plus, Opera, Vivaldi, Brave, AdNauseam, Little Snitch Mini, TechnitiumDNS
DNSMasq
DNSMasq (v2.86 or newer), adblock-lean, Diversion (v5 or newer)
Domains Subdomains
Blocky (older than v0.23), Diversion (older than v5), OpenSnitch, PersonalBlocklist, pfBlockerNG
Hosts
AdAway, uMatrix, DNS66, GasMask, NetGuard
Hosts (compressed)
Hostfile, Linux, Windows
PAC
Proxy Auto Configuration
RPZ
Response Policy Zone, Bind, Knot, PowerDNS, Unbound
Wildcard Asterisks
Blocky (v0.23 or newer), Nebulo, NetDuma, OPNsense, YogaDNS
Wildcard Domains
DNSCloak, DNSCrypt, TechnitiumDNS, PersonalDNSfilter, InviZible Pro

Product-Specific Feeds

Product-specific feeds contain IOCs relevant to specific cyber-security products.

Checkpoint

All Types Domains IPs IP ranges MD5s SHA-1s SHA-256s

Fortinet

Domains IPs Hashes

Microsoft Defender for Endpoint

All Types Domains IPs SHA-1s SHA-256s

Cortex XDR

CSV JSON

Export of all C&C IOCs

This is a bulk export of all command-and-control IOCs, not time-limited or risk-filtered.

Loading bulk exports