Bad and malicious IP filtering list

Proactively Block Attacks

A key part of the attack kill chain on an organization is when the threat communicates with a command & control server – either to download additional threats or to exfiltrate stolen data. IP and domain address reputation block this communication, neutralizing threats.

We aggregate malicious source IP data from more than 40 sources, like our distributed network of threat sensors, CERTs, MITRE, cooperative competitors, and other global sources that collaborate to provide up-to-date threat intelligence about hostile sources.

Our lists help organizations stay safer and proactively block attacks.

This solution is designed to work perfectly with pfSense and OPNsense sotware.

The bad IPs filtering service

Prevents botnet

Prevents botnets and other threats from communicating with command & control servers to exfiltrate data or download malware.

Protects against phishing

Protects against malicious sources associated with web attacks, phishing activity, web scanning, scraping, and more.

Blocks DDOS

Blocks large-scale DDoS attacks from known infected sources.

Economical

Lowers management and operational costs with “set and forget” functionality.

How it works?

We collect bad and malicious IP addresses from over 40 different sources every day.

We analyze and cross-reference these 40+ sources to determine the frequency of occurrence of each detected IP address.

The more an IP address is referenced by different sources, the more it confirms that it is indeed used by hackers. The probability of encountering a false positive and blocking legitimate traffic is then very low.

We publish three lists:

• strict : this list contains the IP addresses that we have detected in at least two different collection sources. The probability of encountering a false positive is low.
• main : this list contains the IP addresses that we have detected in at least three different collection sources. The probability of encountering a false positive is extremely low. This is the list we recommend to use.
• soft : this list contains the IP addresses that we have detected in at least four different collection sources. The probability of encountering a false positive is theoretically zero.

What security does our list provide?

Many companies, especially small and medium-sized businesses, do not filter the traffic passing through their Internet connection.

Any traffic can be sent to any IP address. No mechanism is implemented to prevent data leakage.

And often, when they host services such as OpenVPN access or a web server, no filtering by public IP addresses is performed.

This represents a significant security risk.

Our lists are updated at least daily (every night between 04h and 05h).

Our lists are therefore very effective in combating these threats.

It is not the ultimate solution, but it is an extremely effective solution to minimize the risk of piracy.

How to implement the list on pfSense or OPNsense?

We have written a complete guide on the subject [pfSense/OPNsense] Blocking bad / risky IP addresses.

If necessary, we are at your disposal by e-mail (contact@provya.com) to give you all the necessary assistance for the configuration.