Heartbeat
Review categorized IP activity, its location, and how a source has appeared over time.
The platform
Investigate observed activity. Block listed sources at the edge.
Use one sensor network in two ways: inspect scanner and botnet records, or connect continuously updated industry feeds to your firewall.
One sensor network
Two ways to use what we observe
A connection recorded by our sensors can become a source record to investigate and an IP to evaluate for blocking. Choose the workflow that matches the job in front of you.
Investigate
Threat intelligence
Search observations, follow related records, and examine the evidence behind scanner and botnet activity.
See the intelligence products BlockIndustry blocklists
Connect a feed to your firewall so listed sources are stopped before they reach the services you expose.
See how the feeds work
Threat intelligence
Move from an IP to the record behind it
Start with a source, timestamp, protocol, or botnet record. Search current observations, review related activity, and export the results you need for an investigation.
Scanner Recon
Open individual sensor observations with the source IP, time, protocol, transport, and port.
Botnet & C2
Track command and control infrastructure and open the malware samples attached to research records.
OpenData
Search and download survey data by service, protocol, or file hash for your own analysis.
Search across products
Filter and export results
Map observed activity
Receive email alerts
Investigate observed activity
Observed connections become source records you can inspect in Scanner Recon.
Industry blocklists
Choose an industry feed for your firewall
Choose the industries you operate in, include the threat categories you need, and connect one continuously updated feed to the controls already protecting your network.
14 industriesActive coverage available now
11 formatsFor firewalls, DNS controls, and security tools
All categoriesIncluded in every paid feed
Optional /24Aggregate addresses when your control needs it
Edge enforcement
Defend your edge
The feed loads matching rules into your firewall. Listed sources are intercepted before they cross the edge, and traffic with no match continues to your services.
Delivery
Use the output your tools already accept
Connect a blocklist feed URL to a firewall, DNS control, SIEM, or scheduled job and request the latest list with your API key.
Blocklist request and response
Use the feed URL from your dashboard. The response uses the format saved for that feed.
Blocklist feed URL
Let the receiving control pull the latest list on its own refresh schedule.
Firewall setup guides
Follow product specific instructions for the controls we already support.
Feed preview
TXT response
GET Connection details
https://api.whatoblock.com/v1/blocklists/bl-0123456789ab/feed
X-API-Key
demo_0123456789abcdef
# WhatoBlock | New list2
# Source IP feed for the coverage selected in your WhatoBlock account.
# Selected threat categories: Datacenter Proxies
# Observed by WhatoBlock sensors during the 31 days ending 2026-10-10 23:00 UTC.
# Entries: 897.550 unique source IPs
# Apply this feed at your edge to block listed sources before they reach your services.
# Explore WhatoBlock: https://whatoblock.com/platform
1.13.177.16
1.160.1.153
1.160.100.32
Start free
See how Whatoblock fits your workflow
Search observed activity and test a sample blocklist with the tools your team already runs.