Team Cymru has launched Total Insights Feed, a unified threat intelligence platform designed to replace traditional indicator list-based feeds. The new system provides machine-actionable, scored intelligence across the entire internet.
The platform evaluates over 57 million IP addresses and routing blocks daily, applying weighted risk scores on a 0-to-100 scale with decay modeling. This enables security operations centers to automate block policies without requiring analyst review.
It also assesses more than 400 million domains daily, identifying 3.5 million as malicious, encompassing phishing infrastructure, algorithmically generated domains, and malicious hosting.
Each indicator is enriched with over 2,000 contextual tags, including malware families, command-and-control frameworks, actor attribution, and MITRE ATT&CK mapping. The intelligence is delivered as a single JSON stream compatible with major security platforms.
Team Cymru states that legacy feeds struggle with modern adversaries who rapidly rotate infrastructure and operate across vast numbers of IPs and domains. "The era of the indicator list is over," said Josh Picolet, team leader of the S2 Threat Research Team at Team Cymru. "Coverage without context is noise, and context without coverage creates blind spots."
The platform leverages Team Cymru’s network visibility across over 700 global internet service providers. It is offered in three tiers: risk-scoring for IP and domain reputation, tags and analysis for deeper context, and a complete tier unifying all capabilities.