Skip to content
Bulwark BlackBulwark Black LLC
Latest
Wasmtime Sandbox Escape: Patch the Engine Behind Your Wasm WorkloadsQuest Quanum Incident: Protect Patient Data While Keeping Orders MovingPulsar Token Bypass: Check Anonymous Fallback and Patch BrokersCisco Expressway Root RCE: Patch the Cluster and Check Service ReachabilityPulsar Manager Is Retired: Remove the Console and Recover Cluster CredentialsArista VCO Exploitation: Patch the Orchestrator, Review Every Portal RoleSafePay Warning: Prove Your Backups Can Survive an Administrator CompromiseTeamUpdraft Compromise: Check Every Connected WordPress Site for PersistenceRailway Secrets Incident: Rotate Credentials, Then Check What They Could ReachLiteLLM 1.107.0 Compromise: Rebuild the Environment, Recover the CredentialsGitLab Regex RCE: Patch the Server, Verify the Delivery ChaineMudhra CA Key Compromise: Check the Trust Stores Beyond Your BrowserPHP2Shell: Patch the Runtime Behind Your WebsitesTrusted Notifications, Untrusted Instructions: Close the Email Content Gap

Threat Intelligence

Threat Feeds

Free, machine-readable indicators enriched from our threat reporting. Only values that meet the current exact, fresh malicious-evidence policy enter these feeds; clean, unknown, pending, and unsupported values stay out.

231 live indicators·64 reports·checking live guard

Values are live and functional. Provider matches are evidence rather than universal ground truth, and fast-moving network indicators expire automatically. Stage the feeds in monitoring and review impact before enforcement.

Blocklists (plain text)

One indicator per line. Import into a review or monitoring workflow before enforcing blocks.

Domains17

Domains admitted by fresh exact-match malicious evidence for DNS and web-proxy monitoring.

https://bulwarkblack.com/feeds/domains.txt
IP addresses0

IPv4 addresses admitted by fresh exact-match malicious evidence for firewall monitoring.

https://bulwarkblack.com/feeds/ips.txt
URLs8

Exact URLs admitted by fresh malicious-list evidence for web proxies and gateways.

https://bulwarkblack.com/feeds/urls.txt
File hashes206

MD5, SHA-1, and SHA-256 hashes admitted by fresh exact-match malicious evidence for endpoint hunting.

https://bulwarkblack.com/feeds/hashes.txt

Structured exports

indicators.csv

Every verified feed indicator with its type, report count, first and last seen dates, and an example report.

https://bulwarkblack.com/feeds/indicators.csv
indicators.json

The same verified data as JSON, including the reports each indicator came from.

https://bulwarkblack.com/feeds/indicators.json
rules.yar

YARA rules grouped by report and generated only from verified feed indicators. Tune before deployment.

https://bulwarkblack.com/feeds/rules.yar

Look up a single indicator

Paste a domain, IP, URL, or supported file hash to check whether it is in the current verified feed and which reports it came from. Context-only observables remain available in the Indicator Database.

Prefer the API? Same data, one indicator at a time:

curl "https://bulwarkblack.com/api/ioc/lookup?value=1.2.3.4"

How to use them

Pull a feed

curl https://bulwarkblack.com/feeds/domains.txt

Refresh hourly (cron)

0 * * * * curl -s \
  https://bulwarkblack.com/feeds/ips.txt \
  -o /etc/blocklists/bulwark-ips.txt

Pi-hole / DNS sink

Add https://bulwarkblack.com/feeds/domains.txt as an adlist, then update gravity.
Get daily alerts →Browse the Indicator Database →Research IOC Archive →Extract IOCs from your own text →Read the reports →

Newsletter

The House-Of-L Brief.

Two short reads a day on markets, cyber threats, AI, and geopolitics. A "why it matters" line on every story.

Double opt-in. One-click unsubscribe on every issue. We never share your address.