Live attacker feed

Real source IPs captured by one CTIF edge sensor. This is a limited free preview, a small filtered slice of the full feed, which carries every sensor, deeper enrichment and STIX delivery.

Check any IP address

Look up an address our sensors may have seen. No account needed.

Free preview: one slice (a single edge sensor) of a much larger feed. Up to 5 IP lookups per day.

5 free lookups available today

Sort

Most times blocked first

Loading live feed…

What each row shows

Every row is a real source IP one of our sensors blocked: the country it originated from, the countries it attacked, how many times we blocked it, and when it was last seen. Open a row for the sample log lines behind the detection.

How fresh this data is

This preview is a periodic snapshot of a single edge sensor, so its newest event can be hours or days old. Paid plans read the live feed across every sensor, with no snapshot delay and no per-day lookup cap.

Free access

A free account adds the dashboard and 25 lookups a day. No payment is required and the tier never expires.

API, STIX and blocklists

Paid tiers expose the same intelligence over a REST API, as STIX 2.1 bundles, and as a firewall blocklist. Compare plans.