IP NOISE/Blocklist & CTI API

Sharpen defense with noise-aware IP risk

Filter noise, surface signal. Enriched IP risk flags scanners, botnets, and VPN/Tor/proxies — every alert labeled with actor, recency, and confidence, ready for SIEM/SOAR.

−71%
noise removed
171K
effective blocklist
real-time
SIEM/SOAR push
enriched_ip_risk.log ● Noise● Signal
SUPPRESSED — 71%
185.23.14.2ShodanNoisy
192.227.206.45CensysNoisy
198.51.100.17OpenAI BotNoisy
203.0.113.84Google BotNoisy
198.51.100.118UptimeRobotNoisy
192.0.2.50ZoomEyeNoisy
185.23.176.54BinaryEdgeNoisy
SIGNAL
192.0.2.195
Targeted
203.0.113.56
Escalate
198.51.100.9
Watch
EFFECTIVE BLOCKLIST
171K IPs
raw_ips 594,000 → ready for SIEM/SOAR ✓
Actor · Recency · Confidenceon every alert
Clean signal in, automated actions out — across SplunkPalo AltoCrowdStrikeFortinetQRadarCheckpoint
Highlights

Everything you need to make your SIEM noise-aware

From onboarding to enrichment, run IP intelligence in one console. No heavy rules, no busywork — just clean, contextual signal for your SOC.

Noise-Reduced Blocklists

Silence mass scanners and commodity traffic with dynamic, auto-refreshed blocklists — cut false positives while keeping legitimate services allow-listed.

Enriched IP Risk API

Attach actor type, behavior (scanner, botnet, VPN/Tor/proxy, mobile/residential), recency, and confidence to every alert — so you can suppress, downgrade, or escalate with precision.

Plug-and-Play for SIEM/SOAR & Firewalls

Stream enrichment via lightweight JSON/syslog/OTLP. Push clean feeds to SIEM/SOAR and firewall policies without disrupting workflows.

Features

Cut the noise. Catch the threats that count

End alert fatigue, keep P1/P2 signal on top, boost analyst efficiency by filtering noise, and accelerate IR with instant focus on what matters.

NOISE-REDUCED BLOCKLISTS

Silence mass scanners with one rule

High-noise suppression sets silence mass scanners with one rule, a business allowlist preserves legitimate services, and continuous updates refresh blocklists in real time.

Learn more →
FEED CATALOG
CINSactor · refreshed 5m325K
OTX Webscannerbehaviour · live58K
Emerging Threatsactor · hourly211K
NOISE REDUCTION
Raw IPs 594,000
−71% noise171K effective
NOISE SUPPRESSION RULES
Suppress scanners & probes ASN / Country allowlist Deduplicate & merge feeds Business allowlist preserved
GET /v1/ip/198.51.100.9
{
"ip": "198.51.100.9",
"actor": "botnet",
"behavior": ["scanner", "proxy"],
"recency": "2h ago",
"confidence": 0.94,
"score": 87,
"action": "escalate"
}
escalate downgrade suppress JSON · syslog · OTLP
IP RISK & ENRICHMENT API

Suppress, downgrade, or escalate with precision

Behavioral context enriches each IP, actionable scoring guides suppress/downgrade/escalate, and seamless integration streams lightweight JSON/REST or syslog/OTLP into SIEM/SOAR.

Learn more →
Signal Funnel

Numbers don't lie: cut noise, catch what counts

Every day we process millions of internet-wide signals — so your team only sees real threats, not background noise.

2.3M
signals / day
17.2M
signals / week
55.3M
signals / month
Internet-wide signals ingested55.3M
▼ suppress scanners & commodity
Noise & false-positives removed−71%
▼ dedupe · merge · enrich
Enriched & scored171K
▼ stream to your stack
Clean signal to SOC
P1/P2 ✓
Pricing Plans

Choose the perfect plan for your business

Pick the plan that works for you — upgrade anytime as your needs grow.

Community

Entry-level noise reduction for labs and pilots.

Free
Get Started For Free
Includes: Community sources
Refresh: every 4h
Best for: PoC, small test environments
Concurrent nodes: 1
Requests per minute: 1 (burst)
Downloads per hour: 1
POPULAR
Pro Feeds

Operational feeds with faster refresh and multi-node usage.

$479/month
Get Started For Free
Includes: Community + Pro sources
Best for: Small–mid SOCs, production SIEM/WAF sync
Concurrent nodes: 3
Requests per minute: 120 (burst 240)
Customizable fallback logic
Downloads per hour: 10
Enterprise

Tailored solutions for large organizations with complex needs.

$1,999/month
Talk to Sales
Includes: Community + Core + Premium sources
Refresh: every 15 min
Concurrent nodes: 10
SLA guarantees
Requests per minute: 200 (burst 400)
Downloads per hour: 100
Testimonials

Make security workdays smoother with Trusteed AI

From auto-discovery to change-triggered scans and clean-signal intel, Trusteed helps teams find, fix, and prove faster.

83%

of teams say Trusteed helps them find, fix, and prove faster.

Try Trusteed

"Trusteed cut our alert noise by over 70% in the first week. Our SOC finally spends time on real threats instead of chasing scanner traffic."

OJOliver JackSOC Lead

"The enrichment API gives us actor, recency, and confidence on every alert. Our playbooks now auto-escalate the right 2% and suppress the rest."

JLJamie LeeDetection Engineering

"Pushing clean feeds straight to our firewalls and SIEM took an afternoon. False positives dropped and analyst burnout went with them."

AMAlex MorganSecOps Manager

"Trusteed isn't just a blocklist — it's a smart, reliable teammate built to grow with your security program."

Alex Ross — CISO
Integrations

Seamless integrations that power your security stack

Plug Trusteed into SIEM/SOAR, cloud (AWS/Azure/GCP), IdP (Okta/Entra ID), ticketing (Jira/ServiceNow), and GRC — clean signal in, automated actions out.

Qradar Splunk CISCO Palo Alto Networks Checkpoint Jira · Atlassian Microsoft Azure Juniper Network Sophos AWS Fortinet Qradar Splunk CISCO Palo Alto Networks Checkpoint Jira · Atlassian Microsoft Azure Juniper Network Sophos AWS Fortinet
Blog

Security tips, playbooks, and Trusteed updates

View all posts →

Less noise.
More security.

One platform to find, fix, and prove — attack surface, vulns, cloud compliance, and IP intel in one flow.