Step 1: Create an API key
- Log in to the Threat Intelligence Portal.
- Go to Manage API Keys from the dashboard.
- Select Create Free API Key and copy the token that appears. Keep it private: anyone with the key can pull your feeds.
Step 2: Build your feed URL
A feed URL points your device at one of our lists and includes your API key. It looks like this:
https://api.qfeeds.com/api?feed_type=malware_ip&api_token=YOUR_TOKEN&limit=130000
Replace YOUR_TOKEN with your own key and pick the feed you need:
feed_type=malware_ip: malicious IP addresses.feed_type=malware_domains: malicious domains.feed_type=malicious_urls: malicious URLs.
Malicious URLs need a Premium licence and a device that inspects HTTP, meaning a proxy or a web filter. A packet filter matching on IP addresses, or a DNS filter matching on domain names, cannot enforce a URL list, and on HTTPS you need TLS inspection or the device only sees the hostname. The former name phishing_urls stays accepted indefinitely and returns identical data, but responses always report the feed as malicious_urls.
Two optional settings help you fit the feed to your device:
limit=caps how many indicators are downloaded. Many firewalls have a maximum list size, so setting a limit avoids overloading them.type=csvreturns the list as CSV instead of plain text. Some tools, such as Exabeam, expect CSV.
Most integrations authenticate with HTTP Basic auth: use api_token as the username and your key as the password. If a device does not support that, you can add &api_token=YOUR_TOKEN to the URL instead.
How often feeds update
How fresh your feed is depends on your license: Community refreshes every 24 hours, Plus every 4 hours and Premium every 20 minutes. There is no benefit to polling more often than your license updates.
What next
With your key and feed URLs ready, follow the setup guide for your device.