Free threat intelligence feeds for your firewall
Carpathian runs its own hardware in its own racks, so every request that hits our edge is logged and every address that scans us is recorded. We publish what that turns up: the addresses we block and the paths they probe, formatted to load straight into the firewall or CDN you already run. The data is free to download, use commercially, and redistribute, with no account, no API key, and no rate card.
What is in the data
Everything here comes from traffic aimed at Carpathian infrastructure. We do not buy, scrape, or resell anyone else's data, and nothing in these files describes our customers or their traffic.
Because the hardware is ours, keeping a record of every probe costs us nothing beyond the disk it sits on, which is why the dataset goes back as far as it does.
Blocked addresses
Hosts that earned a block on our own infrastructure: error-response bursts across the web edge, intrusion detection bans, and permanent SSH gateway bans.
Probed paths
The URLs scanners ask for when hunting an exposed admin panel, a forgotten backup, or a known vulnerable endpoint. Catches scanners from addresses you have never seen.
Loading the feed into your edge
Every setup below is a scheduled pull from a URL, so the list keeps itself current with nothing to upload. The two platforms that cannot fetch a list on their own get the API call that pushes it for them.
Any tool that reads a URL
Every file is a plain HTTP GET with no key, no account and no sign-up, rebuilt hourly at the same address. Ask the manifest what is on offer, then fetch the file you want. Nothing here needs uploading anywhere: point your firewall at the URL and it stays current on its own.
curl -s https://api.carpathian.ai/public/threat-intel/manifest curl -s https://api.carpathian.ai/public/threat-intel/blocklist.txt
nginx
The path list ships as an nginx map. Drop it in conf.d, where nginx already includes it into the http block, and add one line to the server block that closes the connection on a match. This uses the path dataset rather than the address list, so it stops scanners you have never seen before. To block addresses on the same host, use the nftables file as well.
curl -fsSL -o /etc/nginx/conf.d/carpathian-paths.conf \
https://api.carpathian.ai/public/threat-intel/paths-nginx.conf
nginx -t && systemctl reload nginx
# In the server block:
# if ($carpathian_threat_path) { return 444; }
# Hourly refresh:
echo '17 * * * * root curl -fsSL -o /etc/nginx/conf.d/carpathian-paths.conf https://api.carpathian.ai/public/threat-intel/paths-nginx.conf && nginx -t && systemctl reload nginx' \
> /etc/cron.d/carpathian-threatnftables
One file defines both address families and an input chain that drops matching traffic. It rebuilds its own table each time it loads, so the refresh is the same command as the first install.
mkdir -p /etc/nftables.d curl -fsSL -o /etc/nftables.d/carpathian.conf \ https://api.carpathian.ai/public/threat-intel/blocklist-nftables.conf nft -f /etc/nftables.d/carpathian.conf # Hourly refresh: echo '7 * * * * root curl -fsSL -o /etc/nftables.d/carpathian.conf https://api.carpathian.ai/public/threat-intel/blocklist-nftables.conf && nft -f /etc/nftables.d/carpathian.conf' \ > /etc/cron.d/carpathian-threat
Palo Alto Networks
Nothing to download. Create an External Dynamic List of type IP, give it the plain list URL, set it to repeat hourly, and reference the list in a security policy that denies the traffic. The firewall fetches it from then on.
Objects > External Dynamic Lists > Add Type: IP List Source: https://api.carpathian.ai/public/threat-intel/blocklist.txt Repeat: Hourly
FortiGate
Nothing to download. Add the plain list as an external threat feed of type IP Address, set the refresh rate to 60 minutes, then use the feed as a source address in a deny policy.
Security Fabric > External Connectors > Threat Feeds > IP Address URI: https://api.carpathian.ai/public/threat-intel/blocklist.txt Refresh Rate: 60
MikroTik RouterOS
The router fetches the script and imports it. Every entry lands in one address list you reference from a firewall filter rule, and the script clears that list before rebuilding it, so a scheduled re-import never doubles up.
/tool fetch url="https://api.carpathian.ai/public/threat-intel/blocklist-mikrotik.rsc" /import file=blocklist-mikrotik.rsc # Hourly refresh: /system scheduler add name=carpathian-threat interval=1h \ on-event="/tool fetch url=\"https://api.carpathian.ai/public/threat-intel/blocklist-mikrotik.rsc\"; /import file=blocklist-mikrotik.rsc"
Cloudflare
Cloudflare does not fetch lists itself, so push it with their API rather than uploading a file by hand. Create an IP list once, then run this on a schedule to replace its contents. Free plans cap a list at 10,000 entries and the feed is ordered worst offenders first, so the cut below keeps the heaviest scanners.
curl -fsSL https://api.carpathian.ai/public/threat-intel/blocklist.json \
| jq '[.entries[] | {ip: .ip_address, comment: "carpathian"}][0:10000]' \
| curl -X PUT \
"https://api.cloudflare.com/client/v4/accounts/$CF_ACCOUNT/rules/lists/$CF_LIST/items" \
-H "Authorization: Bearer $CF_TOKEN" \
-H "Content-Type: application/json" --data @-
# WAF rule: (ip.src in $carpathian_threat) -> BlockAWS WAF
AWS does not fetch lists either, so the CLI pulls the IPSet file and pushes it. Create the set once per address family, then run the update on a schedule. IPv6 works the same way with the ipv6 file.
curl -fsSL -o /tmp/carpathian-ipv4.json \
https://api.carpathian.ai/public/threat-intel/blocklist-aws-waf-ipv4.json
aws wafv2 create-ip-set --scope REGIONAL \
--cli-input-json file:///tmp/carpathian-ipv4.json
# Refresh, with the id returned above:
aws wafv2 update-ip-set --scope REGIONAL --name CarpathianThreatIntelIPv4 \
--id "$IPSET_ID" \
--lock-token "$(aws wafv2 get-ip-set --scope REGIONAL \
--name CarpathianThreatIntelIPv4 --id "$IPSET_ID" \
--query LockToken --output text)" \
--addresses $(jq -r '.Addresses | join(" ")' /tmp/carpathian-ipv4.json)License and attribution
Published under Creative Commons Attribution 4.0. You can use these files commercially, build products on them, and redistribute them, including in modified form. The one condition is credit: name Carpathian and link back to this page. Every file carries the license and source URL in its header, so a copy that has travelled a few hops still says where it came from.
The data is published as is. Verify it against your own environment before you block anything in production, because an address that scanned us may belong to a network you depend on.
Request a removal or a category change
Addresses get compromised, and shared or reassigned addresses can end up on a list because of what a previous tenant did. If an entry is wrong, or is filed under the wrong category, tell us and a person will look at it. We ask for contact details so we can follow up when a case needs more information, and we use them for nothing else.