How to Evaluate a Threat Intelligence Feed: 8 Questions to Ask

Introduction

A threat intelligence feed is a regularly updated list of known-bad indicators, such as domains, IP addresses, or URLs, that your security tools can block or alert on. The idea is simple, but the products behind it vary a lot. One provider's "feed" is a raw blocklist. Another's is a scored dataset with history and context attached.

The pressure to get this right keeps growing. The Anti-Phishing Working Group (APWG) counted 1,069,681 phishing attacks in Q2 2026, up 10.1% from the previous quarter, according to its Phishing Activity Trends Report.

A poorly chosen feed costs you twice. You pay once in subscription fees, and again in analyst hours spent clearing false alarms. The eight questions below give you a vendor-neutral way to judge any feed, free or commercial.

Feed, platform, or service?

Three different things get sold under the "threat intelligence" label:

Feeds are the data itself. You load them into DNS filters, firewalls, mail gateways, or a SIEM.
Platforms, such as MISP or OpenCTI, are software that collects, correlates, and manages many feeds.

Services are research teams that study threats and send you reports.

Most small and mid-sized teams get the fastest value from feeds, because feeds plug into tools they already run. If you're still choosing those tools, TechnologyCounter's cyber security software category is a useful starting point.

8 questions to ask before choosing a feed

1. What will we block or alert on?

Start from your enforcement points, not a vendor's catalog. Domain indicators fit DNS filters and mail gateways. IP indicators fit firewalls, WAFs, and login or signup checks. URL indicators fit web proxies and email link scanning. Feeds split by indicator and threat type let you take only what your tools can use. One large mixed list that you can't separate is a warning sign.

2. Where does the data come from?

Ask how an indicator enters the feed and who checks it. Some providers simply repackage public blocklists. Others start from confirmed malicious domains and expand outward using WHOIS and DNS records. They link new domains that share a registrant, name servers, or mail servers with known attack infrastructure. This pivoting approach, used by domain data providers such as WhoisFreaks, ties each new entry to evidence you can inspect. Look for a clearly described method and a review step before each release. "Proprietary sources" with no further detail is a red flag.

3. Is every record scored?

A confidence score tells you how strong the evidence is behind each entry. With scores, you can block high-confidence entries automatically and send lower-confidence ones to alert-only mode. Without scores, you inherit the provider's threshold, whether or not it suits your network.

4. How fresh is it, and how is it delivered?

Phishing infrastructure is often short-lived, so daily updates are a reasonable minimum for domain and IP feeds. Delivery matters just as much. A documented API that serves CSV, JSON, or STIX 2.1 over TAXII 2.1 can be fully automated. Weekly updates, or files someone has to download by hand, will always fall behind.

5. What context comes with each indicator?

A bare domain tells you what to block but not why. Look for the threat type, first-seen and last-seen dates, and the evidence that linked the indicator to an attack, such as a shared registrant or name server. Dates matter most. Without them, you can't tell an active threat from a stale entry, and you can't explain a block to a colleague.

6. Will it load into our existing tools?

The most useful feed is one your stack can use on day one. Ask the provider to show it working in your SIEM, in your DNS filter (for example, as a Response Policy Zone in BIND or Unbound), or in a platform such as MISP. A custom format that needs engineering work before it does anything adds hidden cost.

7. What does the license allow?

Licensing trips up many teams that rely on free feeds. Some community lists allow only non-commercial use, and others require attribution wherever the data appears. Managed service providers should also confirm they can use the data across client environments. Vague terms, or no license at all, put your business at risk.

8. Can we test it on our own data?

Ask for a sample file or a trial, then run it against a week of your DNS or proxy logs. Count the matches, how many you already block, and how many look like false positives. These numbers tell you more than any product sheet, and a provider that offers free samples makes this step easy.

Free lists vs. commercial feeds

Free community lists such as abuse.ch URLhaus and Spamhaus DROP are excellent for learning and for extra coverage. Their trade-offs appear in production. Most are listed-or-not-listed, with no scores. Context is often limited to the indicator itself, and you have to merge and clean several lists on your own. Commercial feeds usually add per-record scoring, richer context, and a commercial license in exchange for a subscription. Score both types against the same eight questions so you compare like with like.

Where threat intelligence feeds fall short

Even a strong feed is only one layer of defense. Plan for these gaps:

• Brand-new threats: A domain registered this morning may not be in any feed yet. Pair feeds with checks such as domain registration age, which you can pull from WHOIS records, on high-risk paths like email links.

• Targeted attacks: Infrastructure built to hit a single organization may never reach a shared feed.

  False positives: Every feed gets some entries wrong. Keep an allowlist, start in alert-only mode, and review blocks regularly.

• Bypassed controls: DNS filtering protects only devices that use your resolver. Browsers using DNS over HTTPS, or devices with a hard-coded resolver, can skip it.

• History: Some feeds replace yesterday's file every day, so store your own copies if you need an audit trail.

Your next step

Pick one enforcement point, such as your DNS filter, and score two or three feeds against these eight questions. Then test a sample from each against your own logs. The results will settle the decision faster than any sales presentation.