New unified intelligence framework ends the era of static indicator lists, delivering 57M+ scored IPs, 400M+ domains, and deep adversary context in a single machine-ready stream
LAKE MARY, Fla. — Team Cymru today announced Total Insights Feeds (TIF), a unified threat intelligence framework that redefines what a threat feed is, what it covers, and what security teams can do with it. This is not an incremental update to Team Cymru’s existing feed portfolio. It is a structural departure from the category those feeds helped define.
For more than two decades, threat intelligence feeds have operated on a shared assumption: compile lists of known-bad infrastructure, distribute them, and enable defenders to act. That model no longer reflects reality. Adversaries now rotate infrastructure at machine speed, operate across tens of millions of IPs, and weaponize domains at a scale legacy reputation feeds were never designed to track. The indicator list alone is no longer sufficient, creating an urgent need for a fundamentally new approach.
Total Insights Feed is that new model. The platform evaluates more than 57 million IPs and CIDRs daily with weighted 0–100 risk scoring, analyzes over 400 million domains including phishing, DGA infrastructure, and malicious hosting, and enriches each indicator with more than 2,000 contextual attributes spanning malware families, C2 frameworks, botnet membership, attribution, and kill-chain stage. This intelligence is delivered in a structured format that enables security operations centers to act automatically, eliminating reliance on manual triage.
“The era of the indicator list is over,” said Josh Picolet, VP of Detection & Analysis, Team Cymru. “Coverage without context is noise, and context without coverage creates blind spots. Total Insights Feed delivers both across the full surface of the internet in a single integration that security teams can act on at machine speed.”
The need for this shift is driven by a fundamental breakdown in both coverage and context. Modern adversaries build and abandon infrastructure within hours, while command-and-control networks span millions of IPs and phishing campaigns operate across hundreds of millions of domains. Even highly accurate feeds that track hundreds of thousands of indicators leave most of the active threat surface unaddressed. At the same time, binary malicious classifications fail to provide the context needed to determine response. At today’s scale and velocity, human-driven analysis cannot keep pace, creating a widening gap between detection and action. Total Insights Feed is designed to close both gaps simultaneously.
The following core capabilities are powered by Team Cymru’s global network visibility across more than 700 ISPs and operators:
- Surface Coverage: 57M+ IPs and CIDRs evaluated and risk-scored daily, covering the full routable internet, not a curated sample
- Machine-Actionable Scoring: Weighted 0–100 risk scores with decay modeling, enabling automated block policies at configurable thresholds without analyst review
- Domain Intelligence: 400M+ domains assessed daily, with 3.5M+ tagged malicious, including phishing infrastructure, algorithmically generated domains, and malicious hosting
- Deep Contextual Tagging: 2,000+ contextual tags per indicator spanning malware families, botnets, C2 frameworks, scanners, anonymization infrastructure, and hosting classification
- Live Analysis and Actor Attribution: Named actor and campaign associations where available, MITRE ATT&CK mapping, kill-chain stage, first and last observation, and external intelligence references
- Unified Integration Architecture: A single JSON schema compatible with SIEM, SOAR, XDR, and TIP platforms, one integration, operational on day one, no custom parsing required
Total Insights Feed is built on three interconnected intelligence layers that converge into a single data stream, enabling a level of telemetry and coverage not accessible through traditional collection methods. Organizations migrating from legacy feeds gain broader coverage, richer context, and real-time analysis while maintaining the high-fidelity data their operations depend on. Total Insights Feed is offered in tiered configurations, including a risk-scoring tier for IP and domain reputation, a tags and analysis tier for deep contextual intelligence, and a complete tier that unifies all capabilities into a single stream, replacing fragmented feed architectures with a single, machine-ready data source.
Availability
Total Insights Feed is available immediately. Existing customers of Team Cymru’s Controller Feed, Reputation Feed, and BARS architectures are fully supported within Total Insights Feed, with current intelligence preserved and expanded and can contact their Team Cymru account representative to discuss migration. New customers and media inquiries should contact sales@cymru.com or visit team-cymru.com.
About Team Cymru
Team Cymru is the trusted intelligence partner to the world’s most targeted organizations, transforming unmatched global visibility into actionable insights that protect nations, businesses, and communities. Powered by the largest source of context-rich telemetry beyond the network edge, Team Cymru empowers defenders by reducing noise, accelerating decision-making, and driving real-world outcomes. From threat hunting and CTI to third-party risk and national defense, Team Cymru solutions provide instant clarity and unmatched visibility. Through our Community Services, Team Cymru delivers no-cost threat detection, DDoS mitigation, and intelligence to over 177 CSIRTs across 85+ countries. Learn more at team-cymru.com.
