TI Hubthreat-intel hub
Getting started: API, block lists and RBL ↓

Get started with TI Hub

Threat intelligence for the whole company in one place: known-bad IPs, networks and domains from 6 categories of curated feeds, ready for your SIEM, firewalls and mail servers.

1Get an API key

Ask the security team for a read key. Send it as the X-API-Key header, or as ?key= for devices that only take a URL.

2Check or pull indicators

Look up anything in real time, or pull ready-made block lists for firewalls, proxies and DNS filters.

3Plug in your mail servers

Use the built-in RBL (DNS blocklist) zones in Postfix, rspamd, SpamAssassin or any mail gateway.

Is an IP, network, domain or URL known-bad? URLs are reduced to their host, and subdomains match their parents.

export TIHUB_KEY=tih_your_key_here

# One indicator
curl -s -H "X-API-Key: $TIHUB_KEY" https://intelligence.resolver1.net/api/v1/lookup/185.220.101.1

# With geo, ASN and ipinfo.io / ip.sb enrichment
curl -s -H "X-API-Key: $TIHUB_KEY" "https://intelligence.resolver1.net/api/v1/lookup/185.220.101.1?enrich=1"

# Bulk: up to 10,000 items per call
curl -s -H "X-API-Key: $TIHUB_KEY" -H "Content-Type: application/json" \
  -d '{"items": ["185.220.101.1", "evil.example", "https://bad.example/login"]}' \
  https://intelligence.resolver1.net/api/v1/lookup

The answer tells you whether it's listed, why, and which feeds reported it:

{
  "query": "185.220.101.1", "type": "ip", "listed": true,
  "categories": ["tor"], "feeds": ["tor_exits"],
  "allowlisted": null, "matches": [ { "value": "185.220.101.1", "country": "DE", "asn": 60729, ... } ]
}

In a script (Python):

import requests

KEY = "tih_your_key_here"
r = requests.get("https://intelligence.resolver1.net/api/v1/lookup/evil.example",
                 headers={"X-API-Key": KEY}, timeout=10)
if r.json()["listed"]:
    print("block it:", r.json()["categories"])

Pick what you want and copy a link your firewall, proxy or script can pull on a schedule. Leave a group empty to include everything.

Format
Indicator types
Seen by at least
Countries (optional, e.g. RU,KP)
Categories
Feeds (pick one or more, or leave empty for all)
Your API key (optional: only goes into the link below, never sent anywhere)

Your link

How to use it

Plain-text lists that firewalls fetch on a schedule (every 15 to 60 minutes is plenty). They work with Palo Alto EDL, FortiGate external threat feeds, pfSense/OPNsense URL tables, Check Point and similar.

# Bad IPs and CIDRs reported by at least 2 feeds (fewer false positives)
https://intelligence.resolver1.net/api/v1/export/txt?type=ip,cidr&min_sources=2&key=$TIHUB_KEY

# Only command-and-control servers
https://intelligence.resolver1.net/api/v1/export/txt?type=ip&category=c2&key=$TIHUB_KEY

# Everything from selected countries
https://intelligence.resolver1.net/api/v1/export/txt?type=ip,cidr&country=RU,KP&key=$TIHUB_KEY

# Bad domains for DNS filters / proxies
https://intelligence.resolver1.net/api/v1/export/hosts?type=domain&key=$TIHUB_KEY

Swap txt for another format: txt csv json hosts ipset firewalld firewalld6 mikrotik nginx rbldnsd

firewalld (RHEL, Rocky, Alma, Fedora, CentOS): the firewalld format is a ready-made ipset file.

# 1. Download the block list as a firewalld ipset named "tihub"
curl -sf "https://intelligence.resolver1.net/api/v1/export/firewalld?type=ip,cidr&min_sources=2&key=$TIHUB_KEY" \
     -o /etc/firewalld/ipsets/tihub.xml
firewall-cmd --reload

# 2. Drop all traffic from those addresses (one time)
firewall-cmd --permanent --zone=drop --add-source=ipset:tihub
firewall-cmd --reload

# 3. Check it
firewall-cmd --info-ipset=tihub | head -5
firewall-cmd --ipset=tihub --query-entry=185.220.101.1

# 4. Keep it fresh every 30 minutes: /etc/cron.d/tihub (one line)
*/30 * * * * root curl -sf "https://intelligence.resolver1.net/api/v1/export/firewalld?type=ip,cidr&min_sources=2&key=YOUR_KEY" -o /etc/firewalld/ipsets/tihub.new && mv /etc/firewalld/ipsets/tihub.new /etc/firewalld/ipsets/tihub.xml && firewall-cmd --reload >/dev/null

Want only some feeds? Use Build a feed link and pick the firewalld format. Use firewalld6 for an IPv6 set (tihub6.xml).

# Linux iptables: load into ipset (creates the set on first run), then reference it
curl -s "https://intelligence.resolver1.net/api/v1/export/ipset?type=ip,cidr&key=$TIHUB_KEY" | ipset restore -exist
iptables -I INPUT -m set --match-set tihub src -j DROP

# MikroTik: /import the generated script
/tool fetch url="https://intelligence.resolver1.net/api/v1/export/mikrotik?type=ip,cidr&key=KEY" dst-path=tihub.rsc
/import tihub.rsc

Filters: type (ip, cidr, domain), category, country, feed, min_sources. Allowlisted entries are always left out.

TI Hub also answers as a DNS blocklist. Reverse the IP's octets and add the zone. An answer means listed, NXDOMAIN means clean.

IP zone
bl.tihub.local
Domain zone
dbl.tihub.local
Server
intelligence.resolver1.net port 5353
# Test point: always answers 127.0.0.2
dig @intelligence.resolver1.net -p 5353 2.0.0.127.bl.tihub.local +short

# Is 185.220.101.1 listed? (octets reversed)
dig @intelligence.resolver1.net -p 5353 1.101.220.185.bl.tihub.local +short

# Why? TXT names the feeds
dig @intelligence.resolver1.net -p 5353 1.101.220.185.bl.tihub.local TXT +short

# Domains
dig @intelligence.resolver1.net -p 5353 evil.example.dbl.tihub.local +short

# Windows
nslookup -port=5353 2.0.0.127.bl.tihub.local intelligence.resolver1.net

Return codes tell you what kind of threat it is:

AnswerCategory
127.0.0.10local
127.0.0.2attacker
127.0.0.3c2
127.0.0.4tor
127.0.0.5phishing
127.0.0.6badnet

Mail servers only query DNS on port 53, so point the zones at TI Hub from your internal DNS resolver:

# unbound.conf
forward-zone:
    name: "bl.tihub.local"
    forward-addr: 91.107.178.235@5353
forward-zone:
    name: "dbl.tihub.local"
    forward-addr: 91.107.178.235@5353

# BIND named.conf
zone "bl.tihub.local" { type forward; forward only; forwarders { 91.107.178.235 port 5353; }; };

Postfix (main.cf):

smtpd_client_restrictions =
    permit_mynetworks,
    reject_rbl_client bl.tihub.local=127.0.0.[2..20],
    reject_rhsbl_sender dbl.tihub.local=127.0.0.[2..20]

rspamd (local.d/rbl.conf):

rbls {
  tihub {
    rbl = "bl.tihub.local";
    ipv6 = false;
    returncodes {
      TIHUB_LOCAL = "127.0.0.10";
      TIHUB_ATTACKER = "127.0.0.2";
      TIHUB_C2 = "127.0.0.3";
      TIHUB_TOR = "127.0.0.4";
      TIHUB_PHISHING = "127.0.0.5";
      TIHUB_BADNET = "127.0.0.6";
    }
  }
}

SpamAssassin (local.cf):

header   RCVD_IN_TIHUB  eval:check_rbl('tihub', 'bl.tihub.local.')
describe RCVD_IN_TIHUB  Relay listed by TI Hub
tflags   RCVD_IN_TIHUB  net
score    RCVD_IN_TIHUB  3.0

Exchange, Proofpoint, FortiMail and other gateways: add a custom DNSBL with the zone bl.tihub.local; any 127.0.0.x answer means listed.

Full API reference (OpenAPI) → · Every request is logged per endpoint and key. Report false positives to the security team; they go on the allowlist.