Terms of use and disclaimer

Last updated 2026-10-09

Short version: WatchmanHQ is free, best-effort help. We work hard to get it right, and we will still make mistakes. Check everything against your own environment before you act on it, and you are responsible for what you choose to block. If that doesn't work for you, please don't use the lists.

The longer version follows. By using this website or downloading anything from it, including fetching the feed automatically, you agree to these terms.

Who we are

WatchmanHQ is a non-commercial project run by Vincent Morris, a volunteer in Virginia, USA, who is responsible for it. "We", "us" and "our" mean WatchmanHQ and Vincent Morris. Contact: hello@watchmanhq.com.

What we provide

We publish, free of charge:

lists of indicators (domain names, host names, IP addresses, URLs and file hashes) that third-party security researchers have publicly reported as connected with malicious activity, with our assessment of how much evidence supports each one;
the same lists in formats for common security tools; and
articles and guides about security.

All of this is general information. It is not professional advice for your situation, and using it does not create any consulting, advisory, contractual, fiduciary or other professional relationship between you and us. We do not monitor your network, and we have no knowledge of your systems, your traffic or your business.

How to read an entry on our lists

An entry on our lists means that one or more published third-party reports described that indicator as connected with malicious activity at a particular time, and that it passed the checks described in our Methodology. It is a summary of what others reported. It is not a statement of fact by us about any person, business or website owner, and not an accusation of wrongdoing. Domains change hands, websites get hacked and then cleaned up, IP addresses are reassigned, and researchers can be wrong. Each entry expires, and we remove entries when we are shown they are wrong.

Your responsibilities

Before you block anything from our lists, you agree to:

check it against your own DNS, proxy, firewall and other logs;
start in a monitoring, alert-only or audit mode where your tools allow it;
keep a way to quickly undo any block; and
stop using a list once it has expired (every release states a "valid until" time).

You decide what to block in your environment, and you are responsible for the results.

No warranty

THE WEBSITE, THE LISTS, THE DOWNLOADS AND ALL OTHER CONTENT ARE PROVIDED "AS IS" AND "AS AVAILABLE", WITH ALL FAULTS, AND WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING ANY WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, COMPLETENESS, TIMELINESS, AVAILABILITY OR NON-INFRINGEMENT. WE DO NOT WARRANT THAT ANY LIST IS FREE OF ERRORS OR FALSE POSITIVES, THAT IT INCLUDES ANY PARTICULAR THREAT, THAT USING IT WILL PREVENT ANY ATTACK OR LOSS, OR THAT THE SITE OR FEED WILL BE AVAILABLE OR UPDATED ON ANY SCHEDULE. WE MAY CHANGE, PAUSE OR STOP THE PROJECT AT ANY TIME.

Limitation of liability

TO THE FULLEST EXTENT PERMITTED BY LAW, WE WILL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, BUSINESS, GOODWILL OR SERVICE AVAILABILITY, ARISING FROM OR RELATED TO YOUR USE OF, OR INABILITY TO USE, THE WEBSITE, THE LISTS OR ANY CONTENT, INCLUDING ANY BLOCK, OUTAGE OR MISSED THREAT, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF WE WERE TOLD SUCH DAMAGES WERE POSSIBLE. BECAUSE THE SERVICE IS FREE, IF ANY LIABILITY IS FOUND DESPITE THESE TERMS, OUR TOTAL LIABILITY TO YOU IS LIMITED TO ZERO U.S. DOLLARS ($0), OR THE SMALLEST AMOUNT THE LAW ALLOWS. Some places do not allow some of these limits, so some may not apply to you.

Indemnity

If you use our lists or content in a way that breaks these terms or the law, and someone brings a claim against us because of it, you agree to cover our reasonable costs of dealing with that claim.

Third-party content and links

The research behind our lists belongs to the teams who published it. We link to their reports and credit them on Sources. We are not responsible for their content, their websites or their accuracy, and listing a source does not mean that source endorses us or has reviewed our lists. Article titles, names and trademarks belong to their owners.

Using our lists and content

The lists (everything under /feed/) are licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You may use, share and adapt them, including commercially (for example, as an IT provider protecting your clients), as long as you credit "WatchmanHQ (https://watchmanhq.com)" and do not suggest we endorse you. The license includes its own disclaimer of warranties, in addition to the one above.
Automated access. Fetching files under /feed/ on a schedule is welcome. Please fetch each file no more than once an hour; the lists change once a day. Do not try to break, overload or get around the security of the site, and do not scrape web pages at high volume.

Support and donations

If we offer a way to support the project financially, any payment is a voluntary gift to help cover costs. It is not tax-deductible, we are not a registered charity, and it buys no service, priority or guarantee. Refunds are only for payments made by mistake; email us.

Corrections and removals

See Report a false positive. If you believe something we published is wrong, unfair or infringes your rights, email hello@watchmanhq.com. We would much rather fix it than argue about it.

Changes to these terms

We may update these terms. The date at the top shows when they last changed. Continuing to use the site or the feed after a change means you accept the new terms.

Governing law

These terms are governed by the laws of the Commonwealth of Virginia, USA, without regard to its conflict-of-law rules. If any part of these terms is found unenforceable, the rest still applies.