Free threat intelligence feeds for your firewall

Blocked addresses

Addresses that earned a block on our own infrastructure, merged from three places: hosts that generated a burst of error responses across our web edge, hosts banned by our intrusion detection rules, and hosts permanently banned by the SSH gateway after repeated authentication failures.

Each row carries the country, the network operator, when we first and last saw it, how many events it generated, and which subsystem banned it. Entries are ordered worst offender first, so truncating the file to fit a platform limit keeps the addresses that matter most.

Probed paths

The URLs scanners ask for when they are looking for something to exploit. Environment files, exposed git directories, forgotten admin panels, backup archives, and credentials left in config files.

This dataset is the more useful of the two for prevention, because it does not depend on recognizing the sender. A host you have never seen before still asks for the same handful of files, and you can drop that request on the first try.

Palo Alto Networks

Create an External Dynamic List of type IP, point it at the plain list URL, set the repeat interval to hourly, then reference the list in a security policy that denies the traffic.

Objects > External Dynamic Lists > Add
Type: IP List
Source: https://api.carpathian.ai/public/threat-intel/blocklist.txt
Repeat: Hourly

Cloudflare

Upload the Cloudflare CSV as a custom IP list, then write a WAF custom rule that blocks when the source address is in that list. Free plans cap lists at 10,000 entries, and the file is ordered worst offenders first so a truncated import still covers the heaviest scanners.

Manage Account > Configurations > Lists > Create new list
Type: IP Address
Upload CSV: carpathian-blocklist-cloudflare.csv

WAF rule: (ip.src in $carpathian_threat) -> Block

FortiGate

Add the plain list as an external threat feed of type IP Address, set the refresh rate to 60 minutes, then use the feed as a source address in a deny policy.

Security Fabric > External Connectors > Threat Feeds > IP Address
URI: https://api.carpathian.ai/public/threat-intel/blocklist.txt
Refresh Rate: 60

AWS WAF

Import the IPSet JSON for each address family, then add a rule to your web ACL that blocks requests originating from either set.

aws wafv2 create-ip-set \
  --name CarpathianThreatIntelIPv4 \
  --scope REGIONAL \
  --ip-address-version IPV4 \
  --addresses file://addresses.json

nftables

Drop the include file on the host and load it from your ruleset. The file defines both address families and an input chain that discards matching traffic.

curl -o /etc/nftables.d/carpathian.conf \
  https://api.carpathian.ai/public/threat-intel/blocklist-nftables.conf
nft -f /etc/nftables.d/carpathian.conf

MikroTik RouterOS

Fetch the script to the router and import it. Every entry lands in a single address list you can reference from a firewall filter rule.

/tool fetch url="https://api.carpathian.ai/public/threat-intel/blocklist-mikrotik.rsc"
/import file=blocklist-mikrotik.rsc

nginx

Include the map file in your http block and return 444 on a match, which closes the connection without sending a response. This one uses the path dataset rather than the IP list, so it catches scanners you have never seen before.

http {
    include /etc/nginx/carpathian-paths.conf;
}

server {
    if ($carpathian_threat_path) { return 444; }
}