Malicious Domains

Free bad domain list: phishing, scam and malware-delivery domains from Twitter/X researchers


Malicious Domains

Phishing, scam and malware-delivery domains from Twitter/X

Related Threat Intelligence feeds: URLs · malicious IP list · SHA-256 · MD5 · All IOC types

Domains by window

Today

-

malicious domains

Week

-

malicious domains

Month

-

malicious domains

Year

-

malicious domains

Currently tracking 2,688 malicious domains reported in the last 30 days. Data generated 2026-11-11 07:45 UTC.

What this list contains

  • Source: ~95 Twitter/X researchers, every 15 min.
  • Phishing, scam, malware and C2 hosts.
  • Often includes new typo-squats of banks and brands.
  • Excludes allowlisted domains (Google, Microsoft, GitHub).

Recent samples

Latest Domains from the past 7 days. Live from api.tweetfeed.live/v1/week/domain.

Loading samples

Top tags for malicious domains

Filter the Domain feed by malware family or category. Each tag has its own landing page with recent samples and context.

See all tags on the Dashboard or browse all IOC feeds.

Formats and how to use

The malicious domains are available in four formats:

FormatWhereBest for
JSON APIapi.tweetfeed.live/v1/<window>/domainSOAR / SIEM enrichment, scripts
CSVtoday / week / month / year .csvbulk import, spreadsheets, blocklists
RSSrss.xmlwatch new IOCs in a reader
MCPmcp.tweetfeed.livelive lookups from AI agents / Claude
  • Load into your DNS firewall, gateway or Pi-hole.
  • Ready-made domains.txt, hosts.txt and adguard.txt lists.
  • Check VirusTotal first: OSINT has false positives.

Frequently asked questions

What is a malicious domain feed?

A live list of domains used for phishing, scams, malware and C2. Ours comes from ~95 researchers on Twitter/X.

Where can I download a bad domains list?

On the Feeds page: CSV, JSON and RSS. No key or sign-up.

Should I block the domain or the full URL?

Block the domain when the whole host is attacker-owned, the URL on shared or hacked hosts. Most SOCs do both.

Are these domains verified malicious?

No. It is OSINT, so false positives happen, especially on hacked legitimate sites. Check VirusTotal or urlscan.io before blocking.

Is the malicious domains list free?

Yes. CC0 1.0, no key or sign-up, commercial use allowed.

License

IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.