NEW RESEARCH! From WordPress Patch to Mass Exploitation in 2 days. Read here.
Firewall Threat Lists

Gain extra protection against active threats and live scanning.

Enrich your firewall with live intelligence on IPs actively scanning, probing, and exploiting exposed systems. Block malicious traffic and unwanted reconnaissance at the edge, before it reaches your network.

Start Free Trial

Integrates with Major Firewalls

IP Blocklist for Palo Alto Networks
IP Blocklists for Fortinet Fortigate
IP Blocklist for Cisco Firewall
IP Blocklist for Microsoft Azure Firewall
IP Blocklist for F5 Firewall
IP Blocklist for Check Point Firewall
IP Blocklist for SOPHOS
IP Blocklist for pfSense
IP Blocklist for OPNsense
IP Blocklist for TraefikProxy

Block threats. Manage scanners.
Allow trusted services.

192.0.2.14Shodan:443blocked
198.51.100.73Censys:22blocked
203.0.113.41Xpanse:80allowed
203.0.113.22Driftnet:8443blocked
192.0.2.88BinaryEdge:443blocked
198.51.100.201Shodan:8080blocked
203.0.113.119Censys:22blocked
192.0.2.55Xpanse:443allowed
198.51.100.9Stretchoid:443blocked
203.0.113.87Shodan:22blocked
192.0.2.156Censys:8080blocked
198.51.100.44Xpanse:443allowed
192.0.2.14Shodan:443blocked
198.51.100.73Censys:22blocked
203.0.113.41Xpanse:80allowed
203.0.113.22Driftnet:8443blocked
192.0.2.88BinaryEdge:443blocked
198.51.100.201Shodan:8080blocked
203.0.113.119Censys:22blocked
192.0.2.55Xpanse:443allowed
198.51.100.9Stretchoid:443blocked
203.0.113.87Shodan:22blocked
192.0.2.156Censys:8080blocked
198.51.100.44Xpanse:443allowed

ELLIO Recon IP Lists

Control who can scan your exposed infrastructure with continuously updated ELLIO scanner lists. Block unwanted scanners while keeping authorized security and measurement services allowed.

Explore more

Compared to other security solutions, ELLIO doesn't require constant supervision and handles zero-day attacks better. Thus, we've partnered with ELLIO to bring their technology to the ntop user community.

Luca Deri, ntop fouder

Luca Derin

Founder

ntop

Powered by Next-Gen IP Intelligence and live evidence.

ELLIO Threat Lists are continuously updated with direct observations of live Internet activity from advanced ELLIO Deception Network. Each IP is verified and enriched with context on its behavior, infrastructure, relationships, and observed threat activity, helping your firewall block real threats with greater confidence and avoid unnecessary blocking of legitimate traffic.

About ELLIO IP Intelligence
ELLIO ELLIO Blocklist Automation

Malicious blocked, legitimate passed

CVE-2025-3127 exploit Blocked
Customer API call Allowed
Credential stuffing Blocked
Partner webhook Allowed
Mass exploitation wave Blocked
Monitoring health check Allowed

See how ELLIO works for your firewall.

Start Free Trial