Free threat intelligence feeds and IP blocklists
A malicious IP blocklist of every address that earned a block on Carpathian infrastructure, and a list of the URL paths those scanners probe. Both are rebuilt hourly at fixed URLs, formatted for Palo Alto, FortiGate, pfBlockerNG, Cloudflare, AWS WAF, MikroTik, nftables, and nginx, and free to use commercially under CC BY 4.0, with no account and no API key.
What is in the threat intelligence feed
Everything here comes from traffic aimed at Carpathian infrastructure. We do not buy, scrape, or resell anyone else's data, and nothing in these files describes our customers or their traffic.
Because the hardware is ours, keeping a record of every probe costs us nothing beyond the disk it sits on, which is why the dataset goes back as far as it does.
Malicious IP blocklist
Hosts that earned a block on our own infrastructure: error-response bursts across the web edge, intrusion detection bans, and permanent SSH gateway bans.
Probed path list
The URLs scanners ask for when hunting an exposed admin panel, a forgotten backup, or a known vulnerable endpoint. Catches scanners from addresses you have never seen.
How the feed is built
The blocklist is assembled from what our own detection systems decided, then cleaned so it is safe to drop into a production firewall.
- Detection on our own edgeAn address is listed for what it did to Carpathian infrastructure: a burst of error responses across the web edge, a ban from the intrusion detection system, or a permanent ban at the SSH gateway. Nothing is copied from another list.
- One row per addressEach address appears once. When several systems flagged it, the strongest ban wins, and the row keeps every system that saw it along with its country, network, first and last seen times, and event count.
- Known-good addresses removedAllowlisted addresses are dropped before anything is published, along with private, reserved, and shared ranges, carrier-grade NAT included, so the list never asks you to block a source we know is legitimate or your own network. SSH gateway bans earned against a customer's own keys stay with that customer and are not published.
- Worst offenders firstBoth lists are sorted by event count, highest first. A platform with an entry cap, such as a Cloudflare free list, keeps the heaviest scanners when you cut from the top.
- Safe to load into a live rulesetFormats that get pasted into firewall config drop any address that does not parse and any path that would need escaping. The nftables and MikroTik files clear and rebuild their own list, so a scheduled reload never doubles up.
- Rebuilt every hourEvery file is regenerated hourly at the same URL, with the license and source in its header, so a scheduled pull keeps your firewall current with nothing to upload.
Download the IP blocklist and path list
Every file is regenerated hourly at the same URL, so a scheduled pull keeps itself current.
Add the feed to your firewall, WAF, or web server
Every setup below is a scheduled pull from a URL, so the list keeps itself current with nothing to upload. The two platforms that cannot fetch a list on their own get the API call that pushes it for them.
Any tool that reads a URL
Every file is a plain HTTP GET with no key, no account and no sign-up, rebuilt hourly at the same address. Ask the manifest what is on offer, then fetch the file you want. Nothing here needs uploading anywhere: point your firewall at the URL and it stays current on its own.
curl -s https://api.carpathian.ai/public/threat-intel/manifest curl -s https://api.carpathian.ai/public/threat-intel/blocklist.txt
nginx
The path list ships as an nginx map. Drop it in conf.d, where nginx already includes it into the http block, and add one line to the server block that closes the connection on a match. This uses the path dataset rather than the address list, so it stops scanners you have never seen before. To block addresses on the same host, use the nftables file as well.
curl -fsSL -o /etc/nginx/conf.d/carpathian-paths.conf \
https://api.carpathian.ai/public/threat-intel/paths-nginx.conf
nginx -t && systemctl reload nginx
# In the server block:
# if ($carpathian_threat_path) { return 444; }
# Hourly refresh:
echo '17 * * * * root curl -fsSL -o /etc/nginx/conf.d/carpathian-paths.conf https://api.carpathian.ai/public/threat-intel/paths-nginx.conf && nginx -t && systemctl reload nginx' \
> /etc/cron.d/carpathian-threatnftables
One file defines both address families and an input chain that drops matching traffic. It rebuilds its own table each time it loads, so the refresh is the same command as the first install.
mkdir -p /etc/nftables.d curl -fsSL -o /etc/nftables.d/carpathian.conf \ https://api.carpathian.ai/public/threat-intel/blocklist-nftables.conf nft -f /etc/nftables.d/carpathian.conf # Hourly refresh: echo '7 * * * * root curl -fsSL -o /etc/nftables.d/carpathian.conf https://api.carpathian.ai/public/threat-intel/blocklist-nftables.conf && nft -f /etc/nftables.d/carpathian.conf' \ > /etc/cron.d/carpathian-threat
Palo Alto Networks
Nothing to download. Create an External Dynamic List of type IP, give it the plain list URL, set it to repeat hourly, and reference the list in a security policy that denies the traffic. The firewall fetches it from then on.
Objects > External Dynamic Lists > Add Type: IP List Source: https://api.carpathian.ai/public/threat-intel/blocklist.txt Repeat: Hourly
FortiGate
Nothing to download. Add the plain list as an external threat feed of type IP Address, set the refresh rate to 60 minutes, then use the feed as a source address in a deny policy.
Security Fabric > External Connectors > Threat Feeds > IP Address URI: https://api.carpathian.ai/public/threat-intel/blocklist.txt Refresh Rate: 60
MikroTik RouterOS
The router fetches the script and imports it. Every entry lands in one address list you reference from a firewall filter rule, and the script clears that list before rebuilding it, so a scheduled re-import never doubles up.
/tool fetch url="https://api.carpathian.ai/public/threat-intel/blocklist-mikrotik.rsc" /import file=blocklist-mikrotik.rsc # Hourly refresh: /system scheduler add name=carpathian-threat interval=1h \ on-event="/tool fetch url=\"https://api.carpathian.ai/public/threat-intel/blocklist-mikrotik.rsc\"; /import file=blocklist-mikrotik.rsc"
Cloudflare
Cloudflare does not fetch lists itself, so push it with their API rather than uploading a file by hand. Create an IP list once, then run this on a schedule to replace its contents. Free plans cap a list at 10,000 entries and the feed is ordered worst offenders first, so the cut below keeps the heaviest scanners.
curl -fsSL https://api.carpathian.ai/public/threat-intel/blocklist.json \
| jq '[.entries[] | {ip: .ip_address, comment: "carpathian"}][0:10000]' \
| curl -X PUT \
"https://api.cloudflare.com/client/v4/accounts/$CF_ACCOUNT/rules/lists/$CF_LIST/items" \
-H "Authorization: Bearer $CF_TOKEN" \
-H "Content-Type: application/json" --data @-
# WAF rule: (ip.src in $carpathian_threat) -> BlockAWS WAF
AWS does not fetch lists either, so the CLI pulls the IPSet file and pushes it. Create the set once per address family, then run the update on a schedule. IPv6 works the same way with the ipv6 file.
curl -fsSL -o /tmp/carpathian-ipv4.json \
https://api.carpathian.ai/public/threat-intel/blocklist-aws-waf-ipv4.json
aws wafv2 create-ip-set --scope REGIONAL \
--cli-input-json file:///tmp/carpathian-ipv4.json
# Refresh, with the id returned above:
aws wafv2 update-ip-set --scope REGIONAL --name CarpathianThreatIntelIPv4 \
--id "$IPSET_ID" \
--lock-token "$(aws wafv2 get-ip-set --scope REGIONAL \
--name CarpathianThreatIntelIPv4 --id "$IPSET_ID" \
--query LockToken --output text)" \
--addresses $(jq -r '.Addresses | join(" ")' /tmp/carpathian-ipv4.json)Threat intelligence feed questions
What is a threat intelligence feed?
Is this threat intelligence feed free for commercial use?
How often is the IP blocklist updated?
Which firewalls and services can use the feed?
What is the difference between an IP blocklist and a threat intelligence feed?
Will blocking these addresses break legitimate traffic?
Why publish probed paths as well as IP addresses?
Does the feed include detection signatures?
How do I get an address removed from the list?
License and attribution
Published under Creative Commons Attribution 4.0. You can use these files commercially, build products on them, and redistribute them, including in modified form. The one condition is credit: name Carpathian and link back to this page. Every file carries the license and source URL in its header, so a copy that has traveled a few hops still says where it came from.
The data is published as is. Verify it against your own environment before you block anything in production, because an address that scanned us may belong to a network you depend on.
Request a removal or a category change
Addresses get compromised, and shared or reassigned addresses can end up on a list because of what a previous tenant did. If an entry is wrong, or is filed under the wrong category, tell us and a person will look at it. We ask for contact details so we can follow up when a case needs more information, and we use them for nothing else.
Detection signatures and full exports
A Carpathian account with Threat Intelligence turned on downloads every dataset as CSV from the dashboard, including the detection signatures this public feed leaves out.