Name: ELLIO rDNS Dataset
Brand: ELLIO
Availability: InStock

Intelligence Package

Standard

Enrich & Automate via API

EUR36,000USD42,200GBP31,600 a year

Excluding VAT

ELLIO threat intelligence database - 1M+ IPs a month involved in reconnaissance and mass exploitation
5B+ threat and behavioural data points, covering reconnaissance, exploitation activity and CVEs
Real-time IP and network profiles - up-to-date threat intelligence and network context for observed IPs
IP behavioural profiles and security tags, mapped to MITRE ATT&CK
Network Watch - IP, IP range and ASN monitoring
Advanced network fingerprinting - in-depth analysis of IP-associated network fingerprints
IP Activity Forecast - up to 14 days ahead
IP activity history - 45 days
IP Blocking Package - 15-minute
Advanced multi-parameter search for researchers
10 users

Intelligence Package

Advanced

Automate & Integrate at Scale

EUR48,000USD56,300GBP42,100 a year

Excluding VAT

Everything in Standard, plus:

Full integration access
MCP server - support for agentic workflows
Agent Automation Flows - ready-made workflows from triage to blocking
ELLIO KEV - intelligence on actively exploited vulnerabilities
IP Intent Engine
rDNS Intelligence
IP Activity Forecast - up to 30 days ahead
IP activity history - 60 days
25 users

Intelligence Package

Custom

Tailored to Your Organisation

from EUR76,000USD89,000GBP66,600 a year

Excluding VAT

Everything in Advanced, plus:

New integrations on request
Historical access to all datasets
IP activity history - 90 days
IP Blocking Package - 5-minute
Unlimited users

Every package includes

Business-service check
IP reports
Single sign-on (SAML)

Can’t find the right package? Get in touch and tell us about your use case and specific requirements. We’ll help you find the right solution.

Full comparison

Full comparison
Every package
Threat Intelligence	Standard	Advanced	Custom
The deception network ELLIO operates. We adapt it as attacks emerge and ahead of them, so everything you see comes from first-hand observation.	Included	Included	Included
Web searches and IP profiles Search everything ELLIO observes with ELQ: find IPs by tag, CVE, ASN, fingerprint, HTTP path, user agent and more, then open any result’s IP profile.	Unlimited	Unlimited	Unlimited
Complete IP profiles Everything ELLIO has observed about an IP, on one page. Verdict: malicious, promiscuous, benign or unknownBehaviour profile and tagsFirst seen, last seen and how oftenWho it is, when known: scanner, botnet or research projectPorts targeted, with new ones flaggedHTTP paths, user agents and payload snippetsSSH usernames and passwords triedNetwork fingerprints: MuonFP, JA3 and JA4Network, hosting and the countries it targetedReverse DNS nameActivity timeline and Chronicle	Included	Included	Included
Behaviour profiles What an IP has been doing, by category, and what it targets. Behaviour by categoryCVEs with CVSSKEV and ransomware flagsMITRE ATT&CK techniquesObservation summary	Included	Included	Included
Behaviour tags Hundreds of tags name the tool, the exploit, the CVE and the targeted cloud, and new exploits are tagged as they appear. For each tag: the IPs seen, a daily trend and its MITRE ATT&CK mapping.	Included	Included	Included
Whether an IP belongs to a known business service, such as a cloud provider, CDN, crawler or Microsoft 365, before you block it.	Included	Included	Included
IP reports Export an IP’s activity timeline as PNG, JPEG, PDF or SVG, for tickets, briefings and reports.	Included	Included	Included
Advanced network fingerprinting In-depth analysis of the network fingerprints an IP presents: TCP (MuonFP) and TLS (JA3 and JA4).	Included	Included	Included
Monitor the IPs, ranges and ASNs you choose, and see when they show up in ELLIO’s data.	Included	Included	Included
The complete Threat Intelligence API, for SIEM, SOAR, scripts and pipelines.	Included	Included	Included
Users, history and outlook
Users	10	25	Unlimited
How far back you can look at an IP’s activity, in IP profiles, web searches and the API.	45 days	60 days	90 days
IP Activity Forecast The likelihood that an IP shows malicious activity in the days ahead, from ELLIO’s own prediction models.	Up to 14 days	Up to 30 days	Up to 30 days
Automation
MCP server Connects your agents and AI clients to ELLIO for agentic workflows. While they work on a task, they can triage an IP, search ELLIO data, look up tags and act on your blocklists, with the access you grant. Works with ChatGPTClaudeClaude CodeCodexCursorVS CodeAny MCP client	Not included	Included	Included
Your own agents, connected through the MCP server, follow ready-made flows: investigate an IP or triage a list of indicators, then add an IP to your blocklists, extend it or let it expire, with the access you grant.	Not included	Included	Included
The vulnerabilities ELLIO’s sensors see exploited right now: how many IPs exploit each one, the trend, and CISA KEV flags. For deciding what to patch first.	Not included	Included	Included
What an IP appears to be trying to achieve, stated only as strongly as the evidence allows: what it did, what it looked for, or which services it touched.	Not included	Included	Included
Integrations and datasets
Feeds and connectors that bring ELLIO data into your SIEM, SOAR and threat intelligence platforms.	Not included	All	AllNew ones on request
Datasets ELLIO data delivered as files, for your own systems. Historical access adds every past file, not only the latest. Datasets Threat intelligence: every IP ELLIO observes, with every field, as daily filesrDNS: IPv4 PTR records, as daily and weekly files	Not included	All	All + historical access
IP Blocking
An IP Blocking Package included in the price: ELLIO lists on your firewalls, rebuilt automatically with the latest attacking IPs.	Included	Included	Included
How often ELLIO rebuilds your lists with the latest attacking IPs.	Every 15 minutes	Every 15 minutes	Every 5 minutes
End devices licensed to use your lists, such as firewalls, WAFs or routers. Each physical or virtual device counts, so an HA pair counts as two.	10	10	10+
Licence
For your organisation’s own security work.	Included	Included	Included
Managed service (MSSP) licence	Not included	Not included	Not included
Price
Annual price Excluding VAT	EUR36,000USD42,200GBP31,600	EUR48,000USD56,300GBP42,100	from EUR76,000USD89,000GBP66,600

IP Blocking Package

60-minute

Threat intelligence covering 250K to 1M IPs to strengthen NGFW protection against live attacker reconnaissance and exploitation.

EUR6,600USD7,800GBP5,800 a year

Excluding VAT

Protection

Hourly updates - 24 blocklist generations a day
Multi-vendor firewall support - all major firewall formats

Customization & automation

Custom blocklists and allowlists - 4 lists across 4 firewalls
Custom IP rulesets - 2 rulesets, with up to 10,000 rules each
External IP feed management - maintain up to 3 non-ELLIO IP feeds
Customizable policies for business services, scanners, cloud, DNS and SaaS
Download statistics and access logs
Up to 5 users

IP Blocking Package

15-minute

Threat intelligence covering 250K to 1M IPs to strengthen NGFW protection against live attacker reconnaissance and exploitation.

EUR9,900USD11,600GBP8,700 a year

Excluding VAT

Protection

15-minute updates - 96 blocklist generations a day
Multi-vendor firewall support - all major firewall formats

Customization & automation

Custom blocklists and allowlists - 4 lists across 4 firewalls
Custom IP rulesets - 4 rulesets, with up to 10,000 rules each
External IP feed management - maintain up to 5 non-ELLIO IP feeds
Customizable policies for business services, scanners, cloud, DNS and SaaS
Download statistics and access logs
Up to 5 users

IP Blocking Package

5-minute

Threat intelligence covering 250K to 1M IPs to strengthen NGFW protection against live attacker reconnaissance and exploitation.

EUR12,900USD15,200GBP11,400 a year

Excluding VAT

Protection

5-minute updates - 288 blocklist generations a day
Multi-vendor firewall support - all major firewall formats
API access and single sign-on (SAML)

Customization & automation

Custom blocklists and allowlists - 4 lists across 4 firewalls
Custom IP rulesets - 8 rulesets, with up to 10,000 rules each
External IP feed management - maintain up to 5 non-ELLIO IP feeds
Customizable policies for business services, scanners, cloud, DNS and SaaS
Download statistics and access logs
Up to 5 users

IP Checker Package

ELLIO IP Atlas Access

Unlimited access to the real-time ELLIO IP Atlas, featuring behaviour context and predictive intelligence on IPs associated with active attacker reconnaissance and exploitation activity.

EUR6,000USD7,100GBP5,300 a year

Excluding VAT

Access

Unlimited web searches and IP profiles
CSV export
Up to 5 users

Context

IP behaviour and threat profiles
IP activity Chronicle: week-by-week historical activity
IP Activity Forecast, up to 7 days ahead
Network fingerprints and context
MITRE ATT&CK threat mapping
Up to 30 days of historical data
Business-service IP check

Solution

ELLIO Recon Shield

An advanced pre-firewall defense layer that detects and neutralises attacker reconnaissance before it reaches your infrastructure.

Custom

Key capabilities

Fingerprint-Based Intelligence - identifies scanners, cloud instances and proxy-based reconnaissance from their initial connection patterns
Invisible Perimeter - silently drops recognised scans, preventing your hosts from appearing in search engines such as Shodan and Censys
Reduced Firewall Load - minimises unnecessary connections and traffic inspection overhead
SOC Noise Reduction - separates blocked reconnaissance events from regular security alerts, keeping SOC queues focused on real threats

Deployment options

In front of the firewall
Embedded within the firewall
On the WAF
In front of the reverse proxy
Across CDN nodes

Didn’t find a package tailored to your needs? Submit your requirements through our Request Pricing form, and our team will get back to you with a tailored package and pricing quote.

Compare IP Blocking Packages

Compare IP Blocking Packages
Speed and capacity
Perimeter Protection	60-minute	15-minute	5-minute
How often ELLIO rebuilds your lists with the latest attacking IPs.	Every hour	Every 15 minutes	Every 5 minutes
Updates a day	24	96	288
One deployment is one custom blocklist or allowlist, with its own URL for your firewalls to fetch.	4	4	4
End devices licensed to use your lists, such as firewalls, WAFs or routers. Each physical or virtual device counts, so an HA pair counts as two.	4	4	4
Your own IPs and ranges, kept in ELLIO, to add to or exclude from any list. Up to 10,000 rules each.	2	4	8
Users	Up to 5	Up to 5	Up to 5
More deployments, firewalls or rulesets	Optional	Optional	Optional
Lists and sources
ELLIO Threat Lists Blocklists of the IPs ELLIO currently sees attacking, updated continuously. Threat List MAX is the flagship ingress list. Use them as they are or inside your own lists. Lists Threat List MAXThreat List 250KThreat List 100K	Included	Included	Included
ELLIO Recon Lists 15 lists of internet scanners, such as Censys, Shodan, Rapid7 and Shadowserver, to block or allow.	Included	Included	Included
Common Business Services IP ranges of the services your business runs on, kept up to date by ELLIO, to include in or exclude from any list. Cloud providersCDNsInternet service providersSecurity servicesSaaSWeb crawlers and bots	Included	Included	Included
Every list in the format your firewall reads, plus a universal format for any other firewall or tool.	Included	Included	Included
For every list: downloads over time, and which firewall fetched it and when.	Included	Included	Included
Up to 150,000 rules each.	Optional	Optional	Optional
Bring in non-ELLIO feeds of up to 1 million entries each, fetched at your update speed.	3	5	5
Access and identity
Manage your IP rulesets from your own tools and scripts.	Optional	Optional	Included
Single sign-on (SAML)	Optional	Optional	Included
Users provisioned from your identity provider. Includes single sign-on (SAML) and 2FA/MFA enforcement.	Optional	Optional	Optional
ELLIO IP Atlas Access: investigate any IP on the web platform, alongside your lists.	Optional	Optional	Optional
Licence
Protect your own organisation’s networks.	Included	Included	Included
Protect your clients’ networks with the lists, under your own brand.	On request	On request	On request
Price
Annual price Excluding VAT	EUR6,600USD7,800GBP5,800	EUR9,900USD11,600GBP8,700	EUR12,900USD15,200GBP11,400

Optional available as an add-on.

Pricing

Threat Intelligence

Full comparison

Perimeter Protection

Compare IP Blocking Packages

Unique Datasets