Filter junk traffic and stop attacks with curated, tiered IP lists — real-time updates for firewall & SIEM.
Open and lightweight blocklist of IPs confirmed malicious by Trusteed and community sources — quick adoption, broad protection.
Curated set of suspicious IPs — scanners, VPNs, botnets — with Trusteed risk scoring. Balanced for enrichment, firewall rules, and triage.
Continuously updated dataset with context for nation-state actors, emerging campaigns, and targeted threats — built for scale and compliance.
Cut alert fatigue and stop commodity traffic at the edge. Trusteed streams tiered, noise-aware IP feeds — continuously.
Enrich in SIEM (risk score + tags) and auto-block on firewalls (tiered lists) from the same source, updated in real time.
Built-in business allowlist and behavioral context (scanner/VPN/proxy/residential) keep legit traffic visible while junk is muted.
Point your tools to …/blocklists/{t1|t2|t3}.json, start with T1+T2, and watch offenses drop and edge blocks rise.
Every day we process millions of internet-wide signals — so your team only sees real threats, not background noise.
Evidence
A blocklist recommendation needs a funnel (in → suppressed → published) and a start tier — not ‘cuts fatigue’ without a denominator.
ResultTrusteed publishes 2.3M signals/day, 17.2M/week, 55.3M/month ingested; −71% noise removed after suppressing scanners and commodity traffic; 171K IPs on the effective blocklist streamed to firewalls and SIEM.
MethodFirst-party pipeline counts shown on this page: ingest → suppress scanners/commodity → dedupe/merge/enrich → publish …/blocklists/{t1|t2|t3}.json. The −71% is the noise-removed step of that funnel, not a SOC’s ticket-volume study across named customers.
Scope · September 2026Trusteed’s internet-wide IP pipeline as of the date below. Your offense drop depends on where you apply T1 vs T2 and on your allowlist. T3 is hunting context, not a first deny rule.
ResultDocumented consumers include Splunk, QRadar, Sentinel, and Palo Alto-style tools via a JSON URL. Community is free with a 4-hour refresh and 1 node / 1 request per minute — enough to prove the pipe, not a hot-path SOC.
MethodIntegration is ‘point the tool at the URL.’ Measure your own before/after on scanner-tagged offenses for seven days in enrich-only mode before a hard deny.
Scope · September 2026IP indicators only. Not domain, URL, or file-hash intel. Not a TIP.
ResultMarketing pages elsewhere use qualitative quotes. The citeable number for lists is the funnel above. Your ticket delta is a pilot measurement, not something we invent as n=12 / −28%.
MethodSeparation of first-party pipeline metrics from unattributed testimonials.
Scope · September 2026This evidence block only.
Buying questions
The ten questions SOCs ask before they point a firewall or SIEM at a blocklist — tiers, false positives, price, and when a full threat-intel platform is the better buy.
It fits Splunk, QRadar, Sentinel, and Palo Alto-style tools that already ingest URL or JSON lists. You are not building a parser. Most teams are filtering junk the same afternoon they get a key.
ExampleA 4-analyst SOC pointed PAN-OS at T1+T2 after lunch and watched scanner offenses drop the same shift, with a business allowlist so a partner VPN did not disappear.
Start in enrich-only mode in the SIEM if a hard cutover is too risky. Do not expect the list to explain a targeted intrusion that used a clean residential IP for the first time.
Not a fitWrong buy as your only detection stack, for DNS/URL filtering, or for teams that need a research workspace per client — look at the CTI API and the MSSP workspace instead.
You can keep Spamhaus. Trusteed's job is fewer junk alerts and the same feed in the firewall and the SIEM — not another unranked dump of every noisy IP on the internet.
| Need | Typical public list | Trusteed |
|---|---|---|
| Confirmed malicious IPs | Yes, often huge | T1 — 171K effective, noise-aware |
| Scanner / VPN / botnet tags | Rare or DIY | T2 — risk-scored for SOC triage |
| Actor / campaign context | Usually a TIP | T3 — hunting, not just blocking |
| Firewall + SIEM, one URL | Varies | …/blocklists/{t1|t2|t3}.json |
TCO is the plan plus the analyst minutes you stop spending on Shodan and masscan. There is no per-log ingest fee from Trusteed. You still pay your SIEM and firewall vendors.
| Plan | Price | Best for | Limits that matter |
|---|---|---|---|
| Community | Free | PoC, labs | 1 node · 4h refresh · 1 rpm |
| Pro Feeds | $479 / month | Small–mid SOC, SIEM/WAF sync | 3 nodes · 120 rpm · 10 downloads/h |
| Enterprise | $1,999 / month | Scale, SLA, premium sources | 10 nodes · 15 min refresh · 200 rpm |
If you have no SIEM playbook and only a firewall, start with lists. If analysts already live in tickets and need context on IPs that are not on a deny list, start with the API.
| Job | Block Noise IP | CTI API |
|---|---|---|
| Auto-block scanners at the edge | Yes | Only if you script it |
| Explain the IP on this alert | Tags if it is on the list | Yes — live lookup |
| Consume as JSON URL | Yes | REST + scheduled export |
VPN and residential tags are why T2 is for triage, not a blind DROP. Partners on shared VPN egress should go on the allowlist before you enforce T2 at the edge.
ExampleA partner's office VPN was tagged VPN, not confirmed-malicious. The team allowlisted the egress, kept T2 for scanners, and did not take the partner offline.
Putting T3 on a perimeter deny from day one is how you create political incidents. Measure offenses and edge blocks after T1+T2, then decide.
The work is change control on the firewall, not software. If your change board takes two weeks, that — not Trusteed — is the timeline.
If leadership thinks 'we bought a blocklist, we are done,' reset expectations. The measurable outcome is fewer junk offenses and more time on activity that targets you.
The pipeline processes about 2.3M signals a day and publishes a much smaller effective list. Your job is to wire it and measure, not to curate 171K rows by hand.
ExampleA SOC captured seven days of scanner-heavy offenses, enabled T2 enrichment on Wednesday, and used Thursday's drop to justify edge deny for T1 on Friday.
Noise-aware IP risk automatically suppresses background scanning and low-value traffic in your SIEM/SOAR, surfacing activity that actually targets you.
