All Posts
ThreatStream
1
min read

New in ThreatStream: Certego Threat Intelligence Feeds

Published on
March 13, 2025
Table of Contents

Certego’s threat intelligence modules are the latest addition to ThreatStream’s massive repository of relevant IoCs and IoAs. ThreatStream offers four distinct feeds from Certego: malware, phishing, sinkhole, and hash detection.

Founded in 2013 and headquartered in Modena, Italy, Certego’s team has extensive experience in security intelligence, incident response, and malware analysis. In addition to Certego’s threat intelligence offerings, the company provides Managed Detection and Response (MDR) services and a Unified Security Operations platform, PanOptikon®.

Activating Certego Intelligence in ThreatStream

As a premium feed, activating Certego’s data feeds in ThreatStream requires a subscription to Certego’s threat intelligence modules. Setting up these feeds in ThreatStream is quick and easy: users simply activate the Certego Data Feeds tile within the ThreatStream APP store and provide their Certego Token.

Four feeds from Certego with actionable, tactical intelligence are now available in ThreatStream:

  1. Malware: Provides domain records and IP addresses associated with malware
  2. Phishing: Provides domain records and IP addresses associated with phishing attacks
  3. Sinkhole: Tracks malicious sites used in DNS sinkhole redirection
  4. Hash: Allows security analysts to quickly identify malicious files by comparing MD5 hash values
A screenshot of Certego data feeds in the ThreatStream APP Store
A screenshot of Certego data feeds in the ThreatStream APP Store

Get Started with Certego and ThreatStream

Visit the Certego website to learn more about its threat intelligence modules, or schedule a demo with Anomali to see how ThreatStream provides access to the industry's largest curated global repository of threat intelligence, including new premium intelligence feeds from Certego.

FEATURED RESOURCES

August 18, 2026
Anomali Cyber Watch

Anomali Cyber Watch: AmnesiaStealer - Credential Theft Meets Live Browser Hijacking on macOS, Akira Ransomware Deploys Safe Mode to Evade Detection, but Encryption Fails, and more

AmnesiaStealer: Credential Theft Meets Live Browser Hijacking on macOS, Akira Ransomware Deploys Safe Mode to Evade Detection, but Encryption Fails, DeadLock Ransomware Uses Decentralized Infrastructure to Evade Takedown Efforts, ShieldBreak: Researcher Publishes Patch Bypass Claim for Microsoft Defender Zero-Day CVE-2026-50656, Zoom Patches High-Severity Annotation Vulnerabilities Enabling Remote Code Execution Across Multiple Product Lines, Autonomous Multi-Agent AI Framework Achieves Confirmed Compromises Against Taiwanese Government Networks
Read More
August 11, 2026
Operationalized Threat Intelligence
Agentic SOC

OCSF, Explained: Why a Common Schema Changes How Security Teams Work

How a vendor-neutral schema turns fragmented telemetry into data your analysts, detections, and AI agents can all read.
Read More
August 11, 2026
Anomali Cyber Watch

Anomali Cyber Watch: Your AI Clicked Something, Your Dev Tools Have Worms, and the Hotel Wi-Fi Was Literally a Spy

Midnight Blizzard's CaptiveCrunch Campaign Turns Hotel Wi-Fi Into an Espionage Tool. AI Cyber Testing Incidents Multiply as Frontier Models Reach Real Systems and People. ChainDrop Worm Turns Developer Tools Into a Self-Spreading Supply Chain Threat. N-able N-central Authentication Bypass Under Active Exploitation. DOUBLECUP ClickFix Loader-as-a-Service Delivers CountLoader and DeviceManager RATs. Zero-Click Indirect Prompt Injection Attacks Target AI Agentic Browsers, Enabling Account Takeover and Unauthorized Actions.
Read More
Explore All