Threat Intel Blocklist API.

Real-time IP reputation data sourced from live, internet-exposed honeypot sensors — not third-party feeds.

Free right now

Full subscription feed — not open yet

The full feed (real-time JSON, complete attack metadata, the confirmed-c2 high-signal tier from our malware triage pipeline, no rate limits) is built and working, but subscriptions aren't turned on.

We're gauging real demand before flipping billing on. If you'd use this — send an email. Enough interest and we'll open it up.

[email protected]