Cyber Threat Feeds
Netcraft’s validated threat feeds are truly global, and protect the entire internet ecosystem from online threats
Best-in-class threat intelligence
Netcraft provides complete, global cyber threat feeds across a large variety of threat types that cover all impersonated institutions—not just Netcraft customers. Threat data is available in standalone feeds, or integrated into our complete digital risk protection platform.
Netcraft’s threat intelligence is powered by automation using machine learning and AI alongside thousands of carefully curated rules. Millions of suspected threats are collected across a multitude of noisy sources each day and are transformed into verified and actionable cyber threat intelligence.
Netcraft’s phishing site feed has been running since 2005, and our feeds are trusted by key internet infrastructure providers, including browsers, antivirus companies and Netcraft’s threat data partners.
Defeating cyber attacks with unmatched scale and effectiveness
Netcraft’s online brand protection operates 24/7 to discover phishing, fraud, scams, and cyber attacks through extensive automation, AI, machine learning, and human insight. Our disruption & takedown service ensures that malicious content is blocked and removed quickly and efficiently—typically within hours.
of the world’s phishing attacks taken down
threat reports and suspicious URLs analyzed every day
cybercrime attacks blocked to date
attacks taken down and growing
Block exposure to threats within seconds
In addition to URLs reported by our anti-cybercrime community, Netcraft collates and validates reports from many of the world’s largest banks, open-source data, and other industry partners. We also recover URLs from ongoing analysis of malicious email attachments, many of which serve as key infrastructure in malware operations.
Feeds can be delivered via a five-minutely updating JSON feed, or directly within the web interface and API of our digital risk protection platform.
Netcraft offers its collections of apps and extensions for enterprise use. Block cybercrime threats from Netcraft’s threat intelligence feeds on employee devices from the moment we discover them.
This protection can be deployed effortlessly across all of your devices via MDM with just a few clicks. Additional management and configurations options are available to unlock functionality or subscriptions.
Netcraft’s malicious site and threat intelligence feeds are available as a collection of continuously updated feeds, suitable for security engineers, network administrators, and internet service providers.
Phishing sites are designed to trick visitors into submitting private information by posing as a trusted or legitimate entity. Netcraft’s phishing site feed is used by major web browsers to protect their users, and is also licensed by many of the leading antivirus, content filtering, web-hosting, and domain registration companies.
Fake shops claim to offer highly discounted luxury goods, typically for premium clothing, shoe, or electronics brands. In reality, they are simply a front to capture users’ payment information. After the victim completes the checkout process, they will be delivered counterfeit products, or possibly even no products at all.
Fake pharmacies claim to sell pharmaceuticals but have none of the licensing required by the jurisdictions in which they offer products. While many fake pharmacy sites will actually deliver to victims, the drugs delivered are likely to be incorrect, substandard, or counterfeit.
Shopping Site Skimmers
Web shells are backdoor control panels that allow total control over a compromised web server, letting fraudsters easily steal data from the server, launch phishing attacks, join the server to a botnet, engage in DDoS attacks, and distribute malware, to name a few. The web shell feed provides a list of web shells and the associated compromised sites.
Technical Support Scams
Fraudsters make use of scam websites purporting to be legitimate technical support sites to trick visitors into actions such as installing malware, making financial transfers, using premium rate services or allowing remote access to their machines.
Health Product Scams
Health product scams attempt to lure victims into purchasing fake health products such as weight loss pills, or fake oils. These sites often claim the products are endorsed or used by celebrities, and typically use fake seals to appear more legitimate.
Investment scams encourage victims to transfer funds to the fraudster on the promise of large returns, often impersonating well-known public figures (such as Sir Richard Branson) to promote the scheme. These scams are among the highest volume attacks seen by Netcraft.
Survey scams mislead victims into thinking they are being marketed to by a well-known company or brand and will receive a high-value reward or prize by answering a few simple questions. After answering these questions, the victim is told they’ve won, and then redirected to another scam or a third-party affiliate link under the guise of redeeming their prize. They may subsequently be tricked into giving away personal information or installing malicious software.
Malware Infrastructure URLs
Netcraft processes millions of spam emails every day, and any malware attachments are analyzed to identify key infrastructure URLs. Running the malware in a sandbox environment reveals the URLs that it attempts to connect to, including those that transmit operational instructions for the malware, download further stages of the attack, or receive payment for malware such as ransomware.
Malicious Email Addresses
Netcraft can also provide a feed of email addresses participating in advance fee fraud schemes, found in the millions of spam emails that it analyzes. This feed also contains any addresses intended to receive credentials captured by the phishing attacks that Netcraft identifies.
Frequently Asked Questions
The feeds are available as either an encrypted database (with which specific identifiers can be looked up to determine whether they’re blocked) or a plain text database (in TSV or JSONL format).
The TSV/JSONL format allows you to view the full contents of the feed, and offers extra information about the threats such as attack targets and IP addresses.
Yes. This ensures that customers who have fallen behind can catch up incrementally, or if necessary, by requesting the full feed.
We re-test malicious URLs so that they can be removed from the feed once the malicious content has been taken down, which ensures legitimate content on a previously compromised site is no longer blocked.
Schedule time with us
Learn more about Netcraft’s powerful brand protection, external threat intelligence and digital risk protection platform