Recorded Future Threat Intelligence Feeds (Risk Lists)
Operator: Recorded Future, Inc., United States
Commercial threat intelligence feeds for importing risk lists into security software.
Technical Infrastructure
Product
Recorded Future Risk Lists, threat intelligence feeds for your own security software. This profile describes the feed features, not the entire platform.
Availability and source date
Active
As of: 16 October 2026.
No functionality test has been performed.
Use in OSINT research
Imports threat information and risk scores into your own security tools. The feeds are lists organised by risk rules, not a publicly accessible people search.
Queries
Not applicable
Features
- Provides risk lists for import into SIEM, SOAR and firewalls.
- Filters IP lists by documented risk rules.
- Provides risk scores from 0 to 99 with explanations and time information.
- Exports lists as CSV/Splunk or STIX.
- Allows a HEAD request to check whether lists have changed without downloading the entire file.
Categories
- Technical Infrastructure
- Threat intelligence
Coverage
Dataset
Threat intelligence and risk rules compiled by the provider. The IP feeds contain collections of varying sizes and source references for each rule, not a complete overview of all dangerous IP addresses.
Access
Requirements
A paid contract is required. Included feeds and API rights depend on the agreed scope. No freely usable feed version is described on the product pages reviewed.
Export
IP risk lists as CSV/Splunk or STIX 1.1.1, 1.2 and 2.1, optionally gzip-compressed. Entire files are downloaded rather than paginated JSON results.
Provider
Recorded Future, Inc.
Country of establishment
United States
Interfaces
API
Available. Risk list download through an HTTP API, for example /v2/ip/risklist. Feed coverage and access rights depend on the contract.
MCP
Not documented. A platform MCP for AI agents is available. Downloading these feed files through it is not described in the announcement reviewed.
AI agents
Not documented. A platform MCP for AI agents is available. Downloading these feed files through it is not described in the announcement reviewed.
Usage note
The terms generally restrict use to your own internal security purposes; other uses require an appropriate agreement.
Legal note
Limitations
- Risk scores are the provider's assessments, not proof of a crime or of who is responsible.
- Feed queries select a risk rule and download entire lists; they do not search for an individual email address or IP address.
- Feed coverage and interface rights depend on the contract.
Guides and practical reports
Official · Recorded Future: retrieve IP risk lists
Recorded Future · EN
Explains risk rules, file formats, result fields and checking for changes using HEAD.