CTIF

FAQ

Questions worth asking before you pay

Answers here match the running service, including the parts that are limits rather than features. If something you need is missing, ask on the contact page and we will answer it here.

The data

Where does the data come from?
From our own internet-facing sensors, plus a small number of named public lists kept separate from them. The sensors are ordinary hosts running real services, so anything that attacks them is unsolicited by definition. Every indicator keeps the source that produced it, and the blocklist accepts first_party_only=true if you want only what we saw ourselves.
How fresh is it?
The collector pulls from every sensor every 6 hours, so an indicator's last-seen time can be up to 6 hours behind the event that produced it. We publish the real per-sensor freshness on the status page rather than claiming "real time".
What does the hostility score mean?
A 0 to 100 number that ranks what we observed above what an address merely is. An observed attack weighs most, then how often we saw it and what kind of attack it was. Tor exit membership adds a little. CDN edges and known research scanners are capped at 20 however noisy they get, because blocking them costs you more than it saves. The raw total then decays with a 30-day half-life, so stale evidence scores lower on its own.
Is IPv6 or are domains included?
No. The feed is IPv4 and IP-centric. There are no file hashes, malware families or passive DNS. An address missing from the feed is not evidence that it is safe, only that our sensors have not seen it.
What if an address is listed by mistake?
Write to support with the address and we will review it. Confirmed false positives are hidden from the feed, the blocklist and the API rather than deleted, so the mistake stays auditable. CDNs and research scanners are handled by the score cap instead of removal, because you should see them without blocking them.

Plans and quotas

What counts as a request?
Any call that returns feed data: an IP lookup, a domain lookup, a STIX export or one blocklist pull. It counts whether it came from your own dashboard or from the API with a key. Account, billing and support pages return no feed data and are never metered. The counter resets at 00:00 UTC.
Does the free plan include an API key?
No. Free is dashboard-only: 25 lookups a day against one sensor, with no API key and no STIX export. To judge the API, activate the 7-day trial, which gives every sensor, the REST API, STIX 2.1 and the blocklist at 1,000 requests a day with no payment.
Which plans include the API, STIX and the blocklist?
Base is the full feed through the dashboard, 800 requests a day, with no API key. SMB is the first tier with a key: the REST API, STIX 2.1 export and the blocklist URL your firewall or the CTIF agent pulls, at 2,000 a day. SOC is the same entitlements at 10,000 a day with a dedicated support channel. If you want a key to evaluate before paying, the trial has one.
Can I try it without an account?
Yes. The live preview shows real rows from one sensor and lets you look up 3 arbitrary addresses a day with no account at all. The integration guides are public too.
What happens when I hit the daily cap?
Requests return HTTP 429 with the limit and how much you used, and the counter resets at 00:00 UTC. Nothing is charged for going over and the account is not suspended. If you keep hitting it, move up a plan.

Payment

How do I pay?
In USDT on the TRON network (TRC20). Checkout reserves a wallet address and an exact amount for your order and shows both with a countdown. Send that amount on that network only. Nothing else is accepted, and funds sent on another network cannot be recovered.
What happens after I pay?
The order is watched on-chain. Once the deposit confirms, the plan is provisioned automatically and your API key is available in the dashboard. Keep the order reference shown at checkout: it is how support recovers the status of a payment.
Does the subscription renew by itself?
No. Nothing is pulled from your wallet. A plan runs for the period you paid for and then stops, so you renew deliberately or you do not.
What if the feed goes down?
If the API is unavailable for more than 24 consecutive hours we extend your subscription by the affected days, or refund the unused balance if you would rather leave. Component health and per-sensor freshness are public on the status page, and /api/status returns HTTP 503 when the service is down so you can alert on it.

Using it

How do I get the blocklist into my firewall?
Point the device at the blocklist URL with your key and a minimum score. Palo Alto reads it as an External Dynamic List, FortiGate as an external resource, and Linux hosts can run the CTIF agent, which maintains an nftables set from the same list. Each has a written guide. The blocklist URL needs a key, so it is an SMB, SOC or trial capability.
What score should I block at?
Start by not blocking at all. Pull the list, join it against your own logs for a week, and see what it would have caught. When you do enforce, 60 and above is a reasonable starting threshold; the CDN and scanner cap means those never reach it. The Linux agent has a list-only mode built for exactly this.
Do you have a Splunk app?
Not on Splunkbase. You do not need one: the scored CSV loads as a lookup and joins against your firewall, VPN and authentication events with a single lookup command. The Splunk guide has the cron entry, the transforms.conf stanza and a working search.
Is there a TAXII server?
No. STIX 2.1 is available as a bundle per indicator over the REST API, not over a TAXII collection. If TAXII is a hard requirement for you, say so in a message and we will tell you honestly where it sits rather than promise a date.

Still stuck

The methodology page goes deeper on collection and scoring, the status page shows live sensor freshness, and the integration guides cover specific tools. Anything else goes to support@orvteam.com.