Start free

The platform

Investigate observed activity. Block listed sources at the edge.

Use one sensor network in two ways: inspect scanner and botnet records, or connect continuously updated industry feeds to your firewall.

Live sensor records Four intelligence products 14 industry feeds
Threat intelligence Industry blocklists
One sensor network

Two ways to use what we observe

A connection recorded by our sensors can become a source record to investigate and an IP to evaluate for blocking. Choose the workflow that matches the job in front of you.

Investigate

Threat intelligence

Search observations, follow related records, and examine the evidence behind scanner and botnet activity.

See the intelligence products Block

Industry blocklists

Connect a feed to your firewall so listed sources are stopped before they reach the services you expose.

See how the feeds work
Threat intelligence

Move from an IP to the record behind it

Start with a source, timestamp, protocol, or botnet record. Search current observations, review related activity, and export the results you need for an investigation.

Heartbeat

Review categorized IP activity, its location, and how a source has appeared over time.

Scanner Recon

Open individual sensor observations with the source IP, time, protocol, transport, and port.

Botnet & C2

Track command and control infrastructure and open the malware samples attached to research records.

OpenData

Search and download survey data by service, protocol, or file hash for your own analysis.

Search across products Filter and export results Map observed activity Receive email alerts

Investigate observed activity

Observed connections become source records you can inspect in Scanner Recon.

Explore threat intelligence Compare access
Industry blocklists

Choose an industry feed for your firewall

Choose the industries you operate in, include the threat categories you need, and connect one continuously updated feed to the controls already protecting your network.

14 industriesActive coverage available now
11 formatsFor firewalls, DNS controls, and security tools
All categoriesIncluded in every paid feed
Optional /24Aggregate addresses when your control needs it
Edge enforcement

Defend your edge

The feed loads matching rules into your firewall. Listed sources are intercepted before crossing the edge; traffic with no match continues to your services.

View blocklist plans Open setup guides
Delivery

Use the output your tools already accept

Query investigation data through the API, or connect a feed URL to a firewall, DNS control, SIEM, or scheduled job.

Threat intelligence API

Request the product, time range, filters, and response format your workflow needs.

Blocklist feed URL

Let the receiving control pull the latest list on its own refresh schedule.

Firewall setup guides

Follow product specific instructions for the controls we already support.

Threat intelligence API
$ curl "https://whatoblock.com/apiv3/heartbeat?\
  apiKey=$API_KEY&time=24h&format=json"

{
  "success": true,
  "records": 2,
  "tokens_charged": 0.2
}
Blocklist formats: TXT, plain, CSV, JSON, MikroTik, Check Point, Wazuh, F5, Zeek, CIDR, and RPZ.
Start free

See how Whatoblock fits your workflow

Search observed activity and test a sample blocklist with the tools your team already runs.

Threat intelligence Blocklists