Best Cyber Threat Intelligence Feeds

screenshot of the Feed Performance data dashboard

Evaluating Threat Intelligence Feeds

Your security team likely uses many threat intelligence feeds to detect and block threats on your network. But which of these are the best? And what does ‘best’ even mean in this case?

Silent Push helps you answer these questions.

In this blog post, we use a number of open source feeds to show two indicators of feeds that we use to determine the quality of feeds: originator percentage and overlap percentage. Contact us directly if you are interested in having your paid feeds evaluated for their quality — and possibly saving you quite a bit of money.


  • Originator %

In the first chart, we look at the originator percentage: the percentage of data in each feed for which it was the first to report it. Many indicators are only active for a short period of time, so the earlier they are included in a feed, the better.

Originator and Overlap

In the second chart, we have added the overlap percentage: what percentage of the data in a feed also appears in other feeds. Low overlap makes a feed very valuable, as it provides data no other feed provides, but the reverse isn’t automatically true: a feed may have a high overlap score, but still be very valuable because it is often the first to report observables. This is why we weigh the originator score more heavily than the overlap score. 

If you have open source feeds you want us to add to the report please contact us. We will expand on this report each month.

If you want to evaluate your intelligence feeds please contact us to set up a trial. You can ingest your feed to the platform and receive statistics for the contents quickly with many more factors included than what is listed above.

List Of Open Source Feeds and Vendors

Name Vendor


OpenPhish OpenPhish

Malicious Domain Blacklist Rescure

Bot Scout Bot Scout

Tweetfeed URL Daniel López



Tweetfeed Daniel López

AlienVault Domain AlienVault


ThreatFox recent domains

Rutgers Rutgers

MalSilo Domain MalSilo

MiraiIp MiraiTracker

MalSilo IP MalSilo

Maltrail Maltrail

AlienVault IP AlienVault

Green Snow Green Snow

ThreatFox recent urls

CyberCure IP CyberCure

Threat Fox recent IP

Phishing Feed- New Today mitchell krogza

Emerging Threat IP Emerging Threat


Malicious IP Blacklist Rescure

log4j-scanning Ips Greynoise

VX Vault VX Vault

List of Links To Feeds

Name url

UrlHaus url:””

OpenPhish url:””

Malicious Domain Blacklist url:””

Bot Scout url:””

Tweetfeed URL url:””

BBCAN url:””

CINS Army List IP url:””

Tweetfeed url:””

AlienVault Domain url:””

FeodoTracker url:””

ThreatFox recent domains url:null

Rutgers url:””

MalSilo Domain url:””

MiraiIp url:””

MalSilo IP url:””

Maltrail url:””

AlienVault IP url:””

Green Snow url:””

ThreatFox official recent urls url:””

CyberCure IP url:””

Threat Fox recent IP url:””

Phishing Feed- New Today url:””

Emerging Threat IP url:””

BlockListIP url:””

Malicious IP Blacklist url:””

log4j-scanning Ips url:””

VX Vault url:””