Threat Intelligence Feeds & Services

Add a new layer of protection to your network and web security solutions for effective defense against cyber threats.

Bitdefender Threat Feeds & Services represent a broad portfolio of unique, machine-readable (MRTI) data feeds and services, collected from a global network of sensors, including some of our technology partners and curated by 800+ engineers and researchers in the Bitdefender Labs that can be automatically integrated into partners’ tools and security solutions.

Wide array of sources for collection

The data is collected from various sources, such as Bitdefender’s more than 500 million endpoints, deep web monitoring, web crawling systems, sandbox analyzer services, advanced heuristic and content analyzers, email spam traps, honeypots and monitored botnets, and industry partners.

Wide array of cyber threats data
Automatically filtered threat intelligence feeds

Curated data

The data is automatically curated to remove duplicate entries, categorize threat objects, reduce false positives and update reputation. Moreover, our 800+ engineers and researchers ensure the data is accurate and actionable. The context offered to customers include region and industry tagging, threat information such as first/last seen, threat score, threat family, etc.

Platform agnostic threat intelligence feeds.

Easy-to-consume threat intelligence

Our unique, platform-agnostic approach is compatible with any SIEM (security information and event management) or TIP (threat intelligence platform) familiar with consuming a REST API and the TAXII/STIX format. This way, security professionals integrate our threat feeds and services into any platform or infrastructure in minutes.

Augment your security technologies and solutions by integrating machine-readable threat intelligence feeds and services as a database with easy-to-access information about the latest known cyberattacks.

The feeds and services can be integrated with security solutions such as firewalls and unified threat management (UTM) systems, intrusion detection and prevention (IDP), SWGs and secure email gateways (SEGs), endpoint protection (EPP), web application firewalls (WAFs), distributed denial of service (DDoS), security information and event management (SIEM), and security orchestration solutions.

Improved threat detection

Improve detection rate by automatically receiving intelligence on the latest cyber threats

Reduced alert fatigue Automatically with AI-driven data icon

Automatically reduce alert fatigue by correlating SIEM logs with best-in-class threat data

Optimized detection time icon

Reduce breach-detection time by integrating the latest threat data into your EDR platform

Feeds & Services

Bitdefender cyber threat intelligence (CTI) feeds and services provide organizations, such as security solutions vendors, security consulting organizations and threat intelligence platforms, a deeper understanding of the threat landscape. Access to the threat data gives them better visibility into the latest cyber threats that pose the highest risk to their infrastructure. Bitdefender Threat Intelligence Feeds and Services are continuous streams of actionable information on IoCs such as anomalous activity and malicious domains and IP addresses, collected from a wide variety of sources.

Feeds and Services that are really helping you understand the risks icon

Bitdefender Threat Intelligence Reputation Feeds

Advanced Persistent Threats IPs icon


Collection of IPs associated with highly targeted cyber-attacks (Advanced Persistent Threats)

Advanced Persistent Threats hashes icon

APT file hashes

Collection of file hashes associated with Advanced Persistent Threats

Advanced Persistent Threats domains icon

APT domains

Collection of domains hosting Advanced Persistent Threats

Command and Control icon


Feed containing IPs associated with command-and-control servers

 phishing domains icon

Phishing domains

Collection of domain addresses associated with phishing attacks.

malware domains icon

Malware domains

Feed of domain addresses associated with malicious threats.

reputation domains icon

Reputation domains

Collection of domains known to spread malware, phishing and other threats

reputation URL icon

Reputation URLs

Feed of URLs known to spread malware, phishing and other threats

Bitdefender Threat Intelligence ReputationServices

file hashes reputation icon

File Hashes Reputation

Collection of files known to be part of threats or attacks

IP reputation icon

IP Reputation

Collection of IPs known to contain some sort of threat, such as botnet C&Cs or DDoS attacks

C&C reputation icon

C&Certificate Reputation

Known to be used in malicious activities

domain reputation icon

Domain Reputation

Collection of domains known to spread malware, phishing and other threats

Still have questions?

Do you need help deciding which solution is right for you? The Bitdefender Sales Team is happy to be of service.

Contact us