In this Article
A threat intelligence feed looks like a list of bad domains, IPs and hashes. What you are actually buying is a collection pipeline: a set of vantage points, a refresh cadence and a set of rules for deciding when an observation becomes an indicator.
This guide covers the five layers feeds are built from, why analysts keep research traffic off corporate addresses, the overlap problem that inflates confidence, and how to judge a feed before signing for it.
Key Facts
- A feed is a collection pipeline, not a list. Its value comes from where the observations are made, not from the number of indicators it ships.
- Investigating from a corporate IP tips off the target and can put your netblock into someone else’s blocklist. Analysts route research traffic elsewhere for both reasons.
- Feeds overlap heavily. Several commercial feeds resell the same open sources, so three matching hits are often one observation counted three times.
- Indicators expire. An IP that hosted a command server last month may be a shared host today, which is how stale feeds create outages.
- Collection is passive by definition. Reading public infrastructure is research; touching a target system is not, and the line matters legally as much as ethically.
How are threat intelligence feeds built?
From five distinct layers, each with a different cost and a different failure mode. We call it the 5-layer intelligence stack.
| Layer | What it observes | Typical failure |
|---|---|---|
| 1. Open sources | Public blocklists, CERT advisories, vendor write-ups | Everyone has it, so it confers no advantage |
| 2. Telemetry | Detections from a vendor’s own installed base | Biased toward that vendor’s customer geography |
| 3. Sensors | Honeypots, sinkholes, spam traps, passive DNS | Sees opportunistic attacks, misses targeted ones |
| 4. Internet scanning | Exposed services, certificates, infrastructure reuse | Snapshot age; a host changes role between scans |
| 5. Analyst research | Campaign tracking, infrastructure pivots, forums | Slow and expensive, and the layer that actually differentiates |
The first layer is free and the fifth is what you pay for. When a vendor cannot describe its mix, the safe assumption is that most of the feed is layer one with a logo on it.
Why do analysts avoid researching from corporate IPs?
Two reasons, and both are practical rather than theoretical.
It reveals who is looking. Operators watch their own logs. A visit from a bank’s netblock to a phishing kit hosted for that bank tells the operator their campaign has been noticed, and the usual response is to rotate infrastructure within hours, which destroys the trail you were following.
It contaminates your own reputation. Repeatedly fetching known-malicious content from a corporate range gets that range flagged by other people’s automated systems. The cost lands later, on an unrelated team, when mail starts getting refused.
The standard answer is a separate research egress with no connection to production: a dedicated network, isolated hosts, and exits that can be discarded. Which exit type depends on what you are studying, which is the next section.
Which exits fit which research task?
| Task | Use | Avoid when |
|---|---|---|
| Fetching a suspected phishing page as a normal visitor would see it | Residential, matching the campaign’s target country | You have not isolated the host doing the fetch |
| Checking whether a page is geo-targeted | Residential pinned to several countries | The content is identical everywhere, where one exit suffices |
| Pulling open feeds, passive DNS, certificate logs | No proxy: these are APIs meant for you | Never over-engineer a documented API |
| Interacting with a live attacker system | Do not | Always: passive observation is the boundary |
Geo-targeted delivery is the reason the residential row exists. Phishing and malware distribution frequently serve the payload only to visitors in the target country and show a benign page to everyone else, so a US-only analyst looking at a campaign aimed at Poland sees nothing and reports a false negative.
DataImpulse residential is $1 per GB across 195 countries with country targeting included, which makes the multi-country check cheap enough to run as a default rather than an escalation.
Why does feed overlap inflate confidence?
Because commercial feeds license from each other and from the same open sources. When an indicator appears in three feeds, the intuitive reading is three independent confirmations; the accurate reading is often one observation resold three times.
Two habits fix it. Track provenance per indicator rather than per feed, so you can tell a telemetry observation from a redistributed list entry. And measure each feed’s unique contribution during evaluation: run a month of data, strip everything available for free, and see what is left. Vendors rarely volunteer that number, and it is the one that decides renewal.
The same discipline applies to expiry. Infrastructure changes hands, so an indicator without a last-seen date is a liability. Feeds that ship confidence and expiry per indicator can be automated against; feeds that ship a flat list have to be reviewed by a human, which is a hidden cost most evaluations miss.
What does responsible collection look like?
Stay passive. Reading public infrastructure, resolving names, fetching pages that are served to anyone: research. Probing for vulnerabilities, brute-forcing, or logging into someone else’s system: not research, regardless of who owns the system or how obviously criminal it looks. Computer misuse laws do not carve out good intentions.
Isolate everything. Research hosts separate from production, no shared credentials, no shared egress, and a clear rule that collected samples never execute outside a controlled environment.
Handle personal data carefully. Breach dumps and forum content contain personal information, and possessing them creates obligations even when the purpose is defensive. Keep what your lawful basis covers and no more.
General information rather than legal advice. Related reading: is web scraping legal, what is geo-blocking.
Frequently Asked Questions
What is a threat intelligence feed?
A continuously updated set of indicators such as domains, IPs, URLs and file hashes, produced by a collection pipeline. The pipeline is the product: open sources, vendor telemetry, sensors like honeypots and passive DNS, internet scanning, and analyst research, blended in proportions that decide how much of the feed is unique.
Why do security teams use proxies for research?
To keep investigation traffic off corporate addresses. Visiting an attacker’s infrastructure from your own netblock tells the operator they have been noticed and triggers infrastructure rotation, and repeatedly fetching malicious content from a corporate range damages that range’s reputation with third-party filters.
Why does the same campaign look harmless from some countries?
Because delivery is often geo-targeted: the payload is served to visitors in the target country and a benign page to everyone else. An analyst with exits in only one country will record a false negative, which is why multi-country verification is standard for campaign analysis.
How do I evaluate a feed before buying?
Measure its unique contribution. Take a month of indicators, remove everything available from free open sources and from feeds you already have, and see what remains. Then check whether each indicator carries provenance, confidence and an expiry date, because a flat list without those cannot be automated safely.
Is collecting threat intelligence legal?
Passive collection of publicly available information is generally accepted practice, while interacting with systems you do not own is not, and computer misuse laws do not exempt defensive intent. Breach data and forum content also carry personal data obligations. This is general information, not legal advice.
Research exits that do not point back at you
Campaign analysis needs exits in the country the campaign targets, and none of them should trace back to your corporate range. DataImpulse residential proxies cover 195 countries at $1 per GB with country, city and ZIP targeting. Create an account and test one geo-targeted page from two countries.
Related: what is geo-blocking · is web scraping legal · web scraping use case.
Last updated: September 17, 2026.
State/City/Zip/ASN Targeting 
