Voting was added to ThreatCrowd recently, and I've been pleased to see a number of users regularly contributing votes.
These votes provide a useful source of malicious indicators, and so I've now put these into a feed in two files:
https://www.threatcrowd.org/feeds/domains.txt
https://www.threatcrowd.org/feeds/ips.txt
https://www.threatcrowd.org/feeds/hashes.txt
These feeds are not a substitute for the scale of auto-extracted command and control domains or the quality of some commercially provided feeds. But crowd-sourcing does go some way towards the quick sharing of threat intelligence between the community.
Updates
These files are updated once per hour, on the hour.
API
You can submit votes via the interface, or a simple API:
This will place a vote for "good.com" being non-malicious:
https://www.threatcrowd.org/vote.php?vote=1&value=good.com
This will place a vote for "bad.com" being malicious:
https://www.threatcrowd.org/vote.php?vote=0&value=bad.com
License
This data is available for free, and commercial use is allowed. It's licensed under http://www.apache.org/licenses/LICENSE-2.0
I make no guarantees to the quality of the data.
