CyberCure provides a threat intelligence feed of IP addresses identified as malicious through their network of real-time infection monitoring sensors.

The feed is delivered via a JSON API and includes IPs detected performing various malicious activities. CyberCure's sensors monitor for attacks, exploits, and other hostile network behavior across the Internet.

The feed is updated every 6 hours and typically contains a large number of IPs, providing broad coverage of currently active threats.