===== 📡 Intelligence Feeds =====


==== Community Threat Feeds ====
    * [[https://threatfox.abuse.ch/|ThreatFox]] — Community-driven IOC feed  
    * [[https://urlhaus.abuse.ch/|URLhaus]] — Malicious URL tracker  
    * [[https://feodotracker.abuse.ch/|Feodo Tracker]] — Banking trojan command and control trackers  
    * [[https://bazaar.abuse.ch/|MalwareBazaar]] — Malware sample and hash sharing platform  
    * [[https://otx.alienvault.com/|AlienVault OTX]] — Open threat exchange community  

==== Commercial and Specialized Feeds ====
    * [[https://www.spamhaus.org/|Spamhaus]] — Blocklists for IPs, domains, and spam sources  
    * [[https://www.abuseipdb.com/|AbuseIPDB]] — Community-reported IP abuse database  
    * [[https://www.circl.lu/services/osint/|CIRCL OSINT Feeds]] — Public OSINT-based threat feeds from Luxembourg  
    * [[https://sslbl.abuse.ch/|Abuse.ch SSLBL]] — SSL certificate blocklist for malicious infrastructure  
    * [[https://phishtank.org/|PhishTank]] — Community phishing URL repository (overlaps phishing but also feed source)  
    * [[https://openphish.com/|OpenPhish]] — Automated phishing intelligence feed  

==== Attack Surface and Internet Scanning ====
    * [[https://www.greynoise.io/|GreyNoise]] — Contextual intelligence for internet scanners  
    * [[https://www.shodan.io/alerts|Shodan Alerts]] — Monitor exposure of internet-connected assets  
    * [[https://censys.io/|Censys Search and Data]] — Enriched dataset of hosts and certificates