Threat intelligence feeds

Security feeds your systems can act on.

sniche collects, validates and scores malicious infrastructure around the clock, then delivers it through a single documented REST API — so your firewalls, SIEM and detection pipelines always block on current data instead of last week's list.

Get API access Read the API docs
14-day evaluation on live data · No card required · Cancel any time
Built for the teams that block first
SOC & detection MSSP platforms Fraud & brand protection Email security Hosting & registrars
GET /v1/feeds/stream live
Illustrative sample — not live customer data 1,284 today
12
Production feeds
11.4M
Indicators refreshed daily
68ms
p95 API response time
99.98%
Uptime, trailing 12 months
Why teams pick sniche

Intelligence you can put straight into production

Feeds are only useful when an engineer can wire them up without a two-week evaluation project and a spreadsheet of exceptions.

Scored, not dumped

Each record carries a confidence score, a source class and first/last-seen times, so you decide what to block and what to alert on.

One schema everywhere

Adding a feed never means writing a new parser. Same envelope, same cursor, same error codes across the whole catalogue.

False positives handled

Report an indicator and we triage within four hours. Confirmed retractions land in an exclusions list your next poll picks up.

Engineers on support

Tickets are answered by the people who run the collectors, not a first-line script. One hour response on high severity.

How a sniche feed is assembled: threat intel, malware, DNS, vulnerability and OSINT sources feed one pipeline that emits a scored record — indicator 203.0.***.**, confidence 85 — sharing the same envelope, cursor and error codes across every feed, with false positives triaged within four hours and retractions landing in an exclusions list your next poll picks up.
Request 
# Pull everything added since your last cursor
curl -s https://api.sniche.com/v1/feeds/phish-urls \
  -H "Authorization: Bearer $SNICHE_API_KEY" \
  -G --data-urlencode "since=cur_8fb21c9d" \
     --data-urlencode "limit=500"
Response 
{
  "feed": "phish-urls",
  "cursor": "cur_9ad3f01e",
  "count": 500,
  "data": [
    {
      "value": "https://secure-login-m365.top/auth",
      "confidence": 92,
      "brand": "Microsoft 365",
      "first_seen": "2026-08-19T06:12:41Z",
      "source": "sensor"
    }
  ]
}
Integrate

A REST API your team already knows how to use

Bearer authentication, cursor pagination, ISO-8601 timestamps and predictable error codes. No SDK required — though we publish clients for Python, Node and Go.

  • Incremental polling with since cursors
  • NDJSON streaming on Pro and Enterprise
  • Bulk snapshots for cold starts and back-fills
  • JSON, CSV, STIX 2.1 and MMDB output
  • Rate-limit headers on every response
Open the API reference Talk to support
Plans

Straightforward pricing

Usage is counted by records returned, not requests made. Metadata and empty polls are free.

All plans include the 14-day evaluation. Annual billing saves 15%. Ask about volume pricing.

Get started

Put current intelligence in front of your controls

Request access and we will send a sandbox key — full schema, capped sample data — usually within one business day.

Get API access Contact sales