Netcraft Threat Feeds

Netcraft Threat Feeds provides threat intelligence feeds that deliver malicious site and threat data to organizations for blocking malicious activity. The service ingests over 23 billion proprietary data points annually and maintains a false positive rate of 0.02%. The feeds cover over 100 attack types across website-based, email-based, and infrastructure-based threats including phishing, support scams, fake shops, web-inject malware, malicious email addresses, and cryptominers. Feed updates are published delta every 5 minutes with new blocks and unblocks. The service includes a fraudcasting process that distributes threat intelligence to major web browser anti-phishing programs and security vendors including anti-virus, firewall, intrusion detection, and content filtering companies. This enables blocking of malicious URLs for downstream users at scale. Netcraft monitors compromised sites continuously to detect when they have been remediated, allowing feed subscribers to restore access once threats are removed. The service maintains 3 to 5 million live block patterns and has blocked over 220 million attacks to date. The feeds are designed for integration into security infrastructure to provide protection against emerging threats with minimal delay between detection and blocking.