Whatoblock

Whatoblock runs a network of honeypot sensors and records what connects to them: scanners probing ports, botnet command-and-control servers, DDoS sources, open and residential proxies, and Tor exit nodes. That data feeds two things. The Threat Intelligence side lets you search by IP address, ASN, port, service, country, protocol, file hash or botnet ID and follow an alert back to the activity and infrastructure behind it, then filter, pivot and export what you find. The blocklist side turns the same observations into a feed your firewall or security tools can pull on a schedule, scoped to one industry, up to three, or all of them.

Without an account you can browse a live threat map and public top-10 lists for scanners, C2 servers, DDoS sources, proxies and Tor exit nodes, which gives a quick sense of what the data looks like.

The site's main argument is that good threat intel usually sits behind a sales call, and it doesn't want to work that way. You sign up, pull data and start blocking, with no demo first. Both products have a free tier, and the pricing page lists paid plans in euros, from 69€ a month billed yearly up to 259€ a month for the larger tiers, with monthly billing and cancellation at any time.

It's pitched at SOC analysts, security researchers, enterprise security teams, and MSPs protecting client networks, plus developers who want observed threat data in their own tools. The privacy policy notes that a source IP linked to malicious activity can count as personal data and explains its legitimate-interest basis for processing it. As with any blocklist, check how a feed fits your traffic before blocking it outright.