Tiered IP Blocklists: How to Block Commodity Traffic Without Breaking Your Business

Your firewall logs 2.3 million events today. Your SIEM correlates them into 3,000 alerts. Your SOC team investigates maybe 200. Somewhere in the 2,800 they didn't get to, there's a real threat. But they'll never know — because it's buried under a mountain of Shodan scans, Censys crawls, and commodity botnet probes that shouldn't have been alerts in the first place.

IP blocklists are supposed to fix this. Subscribe to a threat feed, import it into your firewall, and block the bad IPs before they reach your network. Simple in theory. In practice, most organizations either block too aggressively — disrupting legitimate traffic, breaking business partner connectivity, and generating a different kind of noise — or too conservatively, letting commodity threats flood their SIEM with low-value alerts that consume analyst time without producing security outcomes.

The problem isn't blocklists themselves. It's how they're built, maintained, and deployed. A flat list of hundreds of thousands of IPs, updated daily, with no confidence scoring, no behavioral context, and no tiered enforcement model is a blunt instrument in a world that demands precision.

This post breaks down why most blocklists create as many problems as they solve, how tiered, noise-aware feeds change the equation, and how to deploy IP intelligence that actually reduces alert fatigue without introducing false positives.

---

The Blocklist Paradox

IP blocklists occupy a strange position in the security stack. Everyone uses them. Nobody trusts them completely. And the reasons are well-documented.

Volume without validation. Aggregated blocklists pull from dozens of community and commercial sources — DShield, Spamhaus, AbuseIPDB, Emerging Threats, OTX, FireHOL, CrowdSec, and others. The result can be lists containing hundreds of thousands or even millions of IPs. But aggregation without validation introduces noise: duplicate entries from overlapping sources, stale indicators from IPs reassigned weeks ago, and false positives from misattributed traffic. The well-known incident of Google's DNS servers appearing on community blocklists — caused by misinterpreting spoofable UDP traffic as evidence of actual TCP connections — remains a cautionary example of what happens when aggregation runs without verification.

Staleness kills value. Threat actors rotate infrastructure constantly. The typical lag between a new C2 IP appearing in open-source feeds and that IP being blocked at enterprise firewalls ranges from 12 to 48 hours. During that window, the IP is active and unblocked. After the actor moves on, the IP may be reassigned to a legitimate user — but it stays on the blocklist for days or weeks, creating false positives. An IP that was malicious yesterday might be a cloud customer's production server today. Static lists with daily updates can't track that lifecycle fast enough.

Flat lists force binary decisions. Traditional blocklists offer a single verdict: block or don't. But not every malicious IP deserves the same response. A confirmed C2 server that's actively exfiltrating data from a known threat campaign is fundamentally different from a residential proxy that appeared in a credential stuffing operation last week. Blocking both at the firewall with equal conviction treats them as equivalent threats when they're not — and creates equal false positive risk when they're not.

Scale creates performance problems. Loading a million-entry blocklist into a firewall External Dynamic List (EDL) can exceed device entry limits, degrade lookup performance, and slow packet processing. FireHOL Level 1 alone can contain tens of thousands of entries; Levels 3–4 can reach millions. At that scale, the blocklist itself becomes a performance bottleneck — defeating the purpose of edge-based filtering.

---

The Tiered Model: Right Action for Right Threat

The solution isn't fewer blocklists or more blocklists. It's smarter blocklists — specifically, a tiered model that matches enforcement action to threat confidence and category.

The concept is straightforward. Not every indicator deserves the same response. High-confidence, confirmed threats should be hard-blocked at the firewall. Medium-confidence indicators should trigger enhanced monitoring, rate limiting, or challenge-response mechanisms. Low-confidence or stale indicators should enrich SIEM correlations without triggering enforcement actions that could disrupt legitimate traffic.

Trusteed's Block Noise IP Lists operationalize this model with three distinct tiers, each designed for a specific layer of defense.

Tier 1 — Community: Baseline Filtering

The Community tier is an open, lightweight blocklist of IPs confirmed malicious by Trusteed and aggregated community sources. It's designed for broad protection with minimal false positive risk — the set of indicators that virtually any organization should block without hesitation.

This is your foundation layer. These are confirmed malicious actors: active C2 servers, known botnet infrastructure, verified exploit sources. The list is intentionally conservative — approximately 171,000 IPs after deduplication and noise suppression from an initial signal pool of over 55 million monthly observations. That 71% reduction from raw signal to effective blocklist is the difference between a curated feed and a firehose.

Deploy T1 at the firewall edge for immediate, broad-spectrum protection. False positive risk is minimal because every entry has been validated through multiple corroborating sources.

Tier 2 — Professional: SOC Enrichment

The Professional tier adds a curated set of suspicious IPs — mass scanners, VPN/proxy infrastructure, known bot networks — with Trusteed risk scoring. This tier is balanced for three use cases: firewall enforcement for medium-confidence threats, SIEM enrichment for alert triage, and SOAR playbook triggers for automated investigation.

T2 is where behavioral context starts to matter. Each IP is tagged with its classification — scanner, VPN, proxy, residential, Tor exit node, botnet — and scored for risk based on observed behavior, recency, and source corroboration. A Shodan scanner probing your network looks very different from a residential proxy being used for credential stuffing, and they should trigger very different responses.

Deploy T2 for enhanced monitoring and conditional enforcement. Hard-block the high-scored entries. Rate-limit or challenge the medium-scored ones. Use the low-scored entries for SIEM correlation that helps analysts triage faster without generating standalone alerts.

Tier 3 — Enterprise: Advanced Hunting

The Enterprise tier provides a continuously updated dataset with context for nation-state actors, emerging campaigns, and targeted threats. It's built for scale and compliance — organizations that need comprehensive coverage across advanced persistent threats, campaign infrastructure, and sector-specific targeting.

T3 is where threat intelligence becomes proactive. Instead of blocking known-bad IPs after the fact, enterprise-grade feeds track the infrastructure that sophisticated threat groups are building for future operations — newly provisioned servers, freshly registered domains, infrastructure patterns associated with specific APT groups. This intelligence powers threat hunting: querying historical logs against new indicators to discover activity that predated the indicator's publication.

Deploy T3 for advanced hunting, retroactive log analysis, and compliance requirements that demand comprehensive threat intelligence coverage. Integrate with your TIP (MISP, OpenCTI, or equivalent) for correlation across indicators, campaigns, and actor profiles.

---

The Signal Funnel: From 55 Million to 171K

Understanding how raw internet telemetry becomes an effective blocklist reveals why the tiered approach works.

Trusteed processes approximately 2.3 million signals per day — 17.2 million per week, 55.3 million per month. These signals include observations from honeypots, community feeds, scanner telemetry, abuse reports, and partner networks. The raw signal pool represents the entire observable spectrum of internet-wide malicious activity.

The first stage is scanner suppression. Mass internet scanners — Shodan, Censys, ZoomEye, BinaryEdge, and dozens of less-known research crawlers — generate an enormous volume of traffic that appears suspicious to automated detection systems but represents no targeted threat to any specific organization. These are the background radiation of the internet. Suppressing them removes the single largest category of alert noise without losing any security signal.

The second stage is deduplication and merge. The same IP frequently appears across multiple source feeds, often with conflicting metadata or confidence levels. Deduplication consolidates entries, resolves metadata conflicts using source reliability weighting, and produces a single, authoritative record for each IP.

The third stage is enrichment and scoring. Each surviving indicator is enriched with behavioral classification (what type of activity is this IP associated with), actor attribution (is this associated with a known threat group or campaign), recency (when was this IP last observed in malicious activity), and confidence scoring (how certain are we that this classification is accurate, based on source corroboration and behavioral validation).

The result: 171,000 effective blocklist entries from 55.3 million monthly signals. A 71% noise reduction that preserves all the security value while eliminating the commodity traffic that overwhelms SOC teams.

---

One Feed, Two Outcomes: SIEM + Firewall from a Single Source

One of the most common deployment mistakes is running separate intelligence pipelines for SIEM enrichment and firewall blocking. This creates synchronization problems — the SIEM sees indicators the firewall doesn't block, the firewall blocks IPs the SIEM doesn't understand — and doubles the operational burden of managing feed subscriptions, update schedules, and format conversions.

Trusteed's tiered feeds solve this by serving both use cases from a single source, updated in real time.

At the firewall, blocklist tiers map directly to enforcement policies. T1 entries get hard-blocked — drop the connection, no further processing. T2 entries get conditional enforcement — block high-scored IPs, rate-limit medium-scored ones, log low-scored ones for monitoring. T3 entries inform firewall policy but are primarily consumed by downstream analytics.

In the SIEM, the same feeds provide enrichment context for every alert involving an external IP. When an analyst investigates an alert, the enriched data tells them immediately: is this IP a known scanner, a confirmed botnet node, a VPN/proxy, or a nation-state actor? What's the confidence score? When was it last observed? What behavioral category does it fall into? This context transforms triage from a twenty-minute research exercise into a thirty-second decision.

The feeds are available at a simple endpoint — /blocklists/{t1|t2|t3}.json — making integration with any SIEM, SOAR, or firewall platform straightforward. Splunk, QRadar, Microsoft Sentinel, Palo Alto, and any tool that can consume JSON or syslog can ingest Trusteed feeds with minimal configuration.

---

Keeping Legitimate Traffic Visible

The most damaging failure mode of any blocklist is blocking legitimate traffic. A false positive that disrupts a business partner's VPN, blocks a customer's API calls, or prevents a CDN from serving content costs more than the scanner noise it was supposed to prevent.

Trusteed addresses this with built-in business allowlisting and behavioral context. The allowlist preserves known-legitimate infrastructure — cloud provider ranges, CDN endpoints, partner networks, and services that should never be blocked regardless of what a raw feed says. Behavioral classification distinguishes between scanner traffic (high-volume, indiscriminate probing), targeted reconnaissance (low-volume, focused on your specific infrastructure), and incidental overlap (legitimate services that share infrastructure with malicious actors).

This distinction is critical because IP reputation is inherently noisy. Cloud providers recycle IP addresses rapidly. A single IP can host dozens of customers, some legitimate and some malicious. Residential ISPs assign IPs dynamically, meaning the botnet node from last night is tomorrow's home office. Without behavioral context that goes beyond binary "block/allow" verdicts, every blocklist will eventually block something it shouldn't.

---

Deploying Tiered Blocklists: A Practical Playbook

If you're moving from flat, untiered blocklists to a structured noise-aware approach, here's how to roll it out.

Start with T1 and T2. Point your firewall and SIEM to Trusteed's T1 (community) and T2 (professional) feeds. T1 entries get hard-blocked at the edge immediately. T2 entries get ingested into your SIEM for enrichment, with high-scored T2 entries also configured for firewall blocking. This covers the vast majority of commodity threats and scanner noise from day one.

Measure the impact immediately. Track two metrics from the first day: firewall block count (how many connections are being dropped by the new feeds) and SIEM alert volume reduction (how many fewer alerts are reaching your analysts now that scanner noise is being suppressed at the edge). A well-tuned deployment should show measurable drops in alert volume within the first week.

Add T3 for advanced operations. If your organization runs a threat hunting program, operates a TIP, or has compliance requirements for comprehensive threat intelligence, add the Enterprise tier. Feed T3 indicators into your TIP for correlation and campaign tracking. Configure retroactive log queries that automatically search historical SIEM data when new T3 indicators appear — catching activity that predated the indicator's publication.

Tune continuously. Monitor false positive rates weekly. If legitimate traffic is being blocked, investigate whether the affected IPs need to be added to your business allowlist or whether the blocking threshold needs adjustment. Track which feed tiers are producing actionable versus informational results and adjust your enforcement policies accordingly.

Implement aging policies. IOCs go stale. An IP that was malicious six months ago may be legitimate today. Configure your tools to age out indicators that haven't been refreshed — Trusteed's real-time updates handle this automatically, but any locally cached or supplementary lists should have expiration policies to prevent stale entries from accumulating.

---

The Math That Matters

The return on investment for noise-aware blocklists isn't abstract. It's measurable in analyst hours recovered, alerts eliminated, and threats caught.

Consider a mid-size SOC processing 3,000 alerts per day. If 71% of those alerts are generated by scanner noise and commodity traffic that tiered blocklists suppress at the edge, that's 2,130 fewer alerts reaching your analysts daily. At an average of 15 minutes per alert triage, that's 532 analyst-hours per day recovered — the equivalent of roughly 66 full-time analysts doing nothing but triaging noise.

Even conservative estimates are compelling. If only 30% of those suppressed alerts represent genuine noise reduction (the rest would have been auto-closed anyway), you're still recovering 160 analyst-hours daily — enough to redirect significant capacity toward proactive threat hunting, incident response improvement, and security engineering.

Meanwhile, the alerts that do reach your analysts arrive enriched with behavioral context, confidence scores, and actor attribution — reducing mean time to triage from 15-20 minutes to under 2 minutes per alert. The combination of fewer alerts and faster triage transforms SOC capacity from a bottleneck into a strategic advantage.

---

Stop Feeding Your SOC Noise

The internet will never stop scanning your infrastructure. Shodan, Censys, and thousands of commodity crawlers will probe your attack surface every day, forever. The question is whether that background radiation reaches your analysts — consuming their time, degrading their attention, and burying real threats under mountains of false positives — or whether it gets filtered at the edge, before it ever becomes an alert.

Tiered, noise-aware blocklists are the filter. Community-tier feeds provide broad, high-confidence protection for everyone. Professional-tier feeds add behavioral context and risk scoring for SOC enrichment. Enterprise-tier feeds deliver campaign-level intelligence for advanced hunting and compliance.

One feed, three tiers, two outcomes: block at the firewall, enrich in the SIEM. No flat lists. No binary verdicts. No false positives disrupting your business.

Your analysts signed up to catch threats, not to chase scanners. Give them the signal.

---

Ready to cut the noise? Get your free IP feeds and start with T1+T2, or talk to an expert to see how Trusteed's tiered blocklists integrate with your firewall and SIEM stack.

---

This post was published on the Trusteed Blog. Trusteed delivers noise-aware, tiered IP blocklists that suppress scanner traffic at the edge, enrich SIEM alerts with behavioral context, and reduce SOC alert fatigue by 71% — from day one.