Threat intelligence blocklist
A blocklist you can set a threshold on
Most free IP lists are membership lists: an address is on them or it is not, and you have no way to say "block the bad ones, log the rest". The CTIF blocklist carries a hostility score with every address, so you choose the line. Set it high and you block only what has attacked repeatedly and recently. Set it low and you get a wide net for logging. The same URL serves both.
One URL, three formats
# plain text, one address per line — for EDLs and external resources
https://ctif.orvteam.com/api/blocklist?format=txt&min_score=60&key=YOUR_KEY
# CSV with the score and context — for SIEM lookups
https://ctif.orvteam.com/api/blocklist?format=csv&min_score=40&key=YOUR_KEY
# JSON — for anything that speaks it
https://ctif.orvteam.com/api/blocklist?format=json&min_score=60&key=YOUR_KEYmin_score is the threshold, limit caps the number of rows, and first_party_only=true drops everything that came from the public lists we import, so you pay us only for what our own sensors saw. Devices that cannot set a header pass the key in the URL; treat that URL as a secret.
Why it will not block your own customers
The expensive failure with a blocklist is not missing an attacker, it is blocking a CDN edge and taking down your own site. CTIF caps CDN edges and known research scanners at a score of 20, below any threshold you would sensibly enforce, however much noise they generate. Tor exit nodes are scored as infrastructure rather than as an act, so they sit under the default line unless they actually attacked something. And every score decays with a 30-day half-life, so an address that stopped being seen leaves your enforcement on its own rather than sitting in a list nobody prunes.
Do not enforce on day one
Pull the list, join it against a week of your own firewall or authentication logs, and look at what it would have dropped. If you run the Linux agent, MODE=list-only maintains the nftables set without dropping a packet, which is exactly this test. Switch to enforce when the evidence convinces you and not before.
Where it plugs in
Palo Alto NGFW
Point an External Dynamic List at the feed and block scored attacker IPs at the edge, with no agent and no scripting.
FortiGate
Register the feed as an external threat feed connector and use it as a source address in a firewall policy.
Linux host agent
Run the CTIF agent on a Linux server to sync the scored feed into nftables, with a list-only mode for evaluation.
What you need
The blocklist URL authenticates with a personal key, so it is part of the SMB and SOC plans, or the 7-day trial. A Base account can read the same list in the dashboard but cannot pull it into a device. Feed pulls count against the plan's daily request cap, which a daily schedule never comes close to.