--- sourceDocument: Australia Security Management sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # View Text Feeds # View Text Feeds {#ariaid-title1} * Release version: Australia * * Updated March 12, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Access and review all text feeds configured in your ServiceNow instance to monitor their status and settings. ## Before you begin Role required: sn_sec_tisc.admin ## Procedure 1. Navigate to WorkspacesThreat Intelligence Security Center. 2. Select the Integrations icon. 3. Select the Text tab. The following table lists the configured text feeds within the base system.{#view-oob-text-format-feeds__table_vgh_jq3_pzb__entry__3} | Threat Feed | Description | URL | |-|-|-| | Haley's Brute Force IPs | Provides a list of attacking machine IP addresses during the last 2 years sorted by IP address | | | Blockrules Emergingthreats | Emerging Threat (ET) Intelligence provides actionable threat intel feeds to identify IPs involved in suspicious and malicious activity. | | | Nuug Pop3 Groper Web | List of hosts that have tried and failed to log in to the pop3 service at bsdly.net. | [https://home.nuug.no/%7Epeter/pop3gropers.txt](https://home.nuug.no/~peter/pop3gropers.txt) | | Tor Exit Nodes | Tor Exit Nodes can be used to detect traffic coming from the TOR network. | | | Talos Intelligence IP Denylist | Talos was formed by combining SourceFire's Vulnerability Research Team, the Cisco Threat Research and Communications group, and the Cisco Secure Applications Group. The combined expertise is backed by sophisticated infrastructure and Cisco's telemetry spanning networks, endpoints, cloud environments, virtual systems, and daily web and email traffic. | | | SANS | ISC provides a free analysis and warning service to thousands of internet users and organizations. | | | Snort | Snort is the foremost Open Source Intrusion Prevention System (IPS) in the world. Snort IPS uses a series of rules that help define malicious network activity. | | | CI army | The CINS Army list is a subset of the CINS Active Threat Intelligence ruleset. It consists of IP addresses that meet one of two criteria: The IP's recent Rogue Packet score factor is very poor, or the IP has tripped a designated number of 'trusted' alerts across their Sentinels deployed globally. | | | Proofpoint | Raw IPs for the firewall block lists. These come from: Spam nets identified by Spamhaus (www.spamhaus.org), Top Attackers listed by DShield (www.dshield.org) and Abuse.ch | | | Blocklist Greensnow | GreenSnow is a team of computer security specialists that harvests IPs from computers worldwide. GreenSnow is comparable with SpamHaus.org for attacks of any kind except spam. | | | CI army | The CINS Army list is a subset of the CINS Active Threat Intelligence ruleset, and consists of IP addresses that meet one of two basic criteria: The IP's recent Rogue Packet score factor is very poor, or the IP has tripped a designated number of 'trusted' alerts across a given number of their Sentinels deployed around the world. | | | Blocklist | www.blocklist.de is a free and voluntary service provided by a Fraud/Abuse-specialist, whose servers are often attacked via SSH-, Mail-Login-, FTP-, Webserver- and other services. | | | Tor Exit Nodes | Tor Exit Nodes can be used to detect traffic coming from the TOR network. | | | Botscout BOT IPs | BotScout helps prevent automated web scripts, known as "bots", from registering on forums, polluting databases, spreading spam, and abusing forms on web sites. | | | Dataplane VNC RFB | IP addresses identified as initiating VNC remote frame buffer sessions. | | | Dataplane TELNET login | IP addresses identified as attempting login via TELNET password authentication. | | | Dataplane SSH password authentication | IP addresses identified as attempting login via SSH password authentication. | | | Dataplane SSH client connection | IP addresses identified as performing SSH client protocol negotiations. | | | Blockrules Emergingthreats | Emerging Threat (ET) Intelligence provides actionable threat intel feeds to identify IPs involved in suspicious and malicious activity. | | | Dataplane SMTP greeting | IP addresses identified as SMTP clients issuing unsolicited HELO or EHLO commands. | | | Dataplane SIP query | IP addresses identified as sending SIP OPTIONS queries. | | | Dataplane IP protocol 41 | IP addresses identified as open IPv4 protocol 41 relay (i.e. IPv6 over IPv4). | | | Dataplane SIP invitation | IP addresses identified as sending SIP INVITE operations. | | | Dataplane DNS CH TXT version.bind | IP addresses identified as sending DNS CH TXT VERSION.BIND queries. | | | Dataplane DNS TCP | IP addresses identified as sending DNS over TCP port 53 queries. | | | Dataplane DNS recursion desired IN ANY | IP addresses identified as sending recursive DNS IN ANY queries. | | | Dataplane DNS recursion desired | IP addresses identified as sending recursive DNS queries. | | | Phishing Database from GitHub Active Phishing Links | Data source for fetching Active Phishing Links from Phishing Database available on Github. | | | Phishing Database from GitHub Active Domains | Data source for fetching Active Domains from Phishing Database available on Github. | | | Phishing Database from GitHub Active IPs | Data source for fetching Active IPs from Phishing Database available on Github. | | | Blocklist Bots | All IP addresses which have been reported within the last 48 hours as having run attacks attacks on the RFI-Attacks, REG-Bots, IRC-Bots or BadBots. | | | Blocklist Apache Attacks | All IP addresses which have been reported within the last 48 hours as having run attacks on the service Apache, Apache-DDOS, RFI-Attacks. | | | Voip Denylist By Scopserv | Retrieve list of denylisted ips from the Voip deny list. | | | Threatview Domain Blocklist | Malicious Domains identified for phishing/serving malware/command and control. | | | Threatview MD5 Hash Blocklist | MD5 hashes of malicious files or associated with - malware, ransomware, hack tools, bots etc. | | | Threatview URL Blocklist | Malicious URL's serving malware, phishing, botnets and C2. | | | Threatview SHA File Hash Blocklist | SHA hashes of files known or linked with malware execution. | | | Threatview IP Blocklist | Malicious IP Blocklist for known Bad IP addresses. | | | Threatview C2 Hunt Feed | Infrastructure hosting Command and Control Servers found during Proactive Hunt by Threatview.io | | | Threatview OSINT Threat Feed | Malicious indicators of compromise gathered from OSINT Source - Twitter and Pastebin. | | [ ] {#view-oob-text-format-feeds__table_vgh_jq3_pzb} 4. Select Edit to modify the feed. 5. Select Save to apply the changes. {#view-oob-text-format-feeds__steps_r22_w3q_bjc} *[\>]: and then