Security feed services for your internet router or website host
Helping all NETizens of good standing!
Fortinet, Mikrotik, iptables (ipset) and others, feed thy firewall!
Current honeypot statistics: Read more
Charity organisations can subscribe for free. email security-desk@supportu.nz
Buy subscription for private or MSP use.
Honeypot basic blocklist subscription
For individuals, browse the GitHub repository
https://github.com/sky-poppy/fwfeed
-
Last 90 days & all-time blocklist;
-
Port abuse reports;
-
Free!!
Honeypot + predictive blocklist subscription
A cost effective fee in exchange for individuals or businesses to use this dataset for multiple routers.
Prevent zero-day attacks against your infrastructure, all the core block-lists plus:
- Predictive block-lists with 4 levels of aggression;
-
Full ASN blocking list, one IP found in abuse logs probing popular service ports, the entire ASN address range is blocked;
-
100 unique feed credentials for resale purpose.
There is a 14day free trial period available!
NZD$120+GST, Monthly.
Once your subscription has started you will be provided with credentials so can download the plain txt blocklist file/s.
We recommend the download schedule should be no more than every 4 hours or 240 mins.
Credential reuse and abuse detection will block your credential and a password reset will be required.
You might be hosting a small bunch of business or client services as a independent contractor or managing many routers and services on behalf of your clients as a MSP, the paid plan is for you.
The reasons for having a security blocklist are really quite simple
-
Your hosting websites or services like RDP and VPN that are internet accessible!
-
GeoIP blocking is too restrictive while hosting remote worker resources for your scenario.
-
You are security minded, just want the best security which is prevention!
This the cheapest option is just the basic blocklist.
This blocklist is a reactive list from honeypot logging.
The better option for MSP's and business use is the honeypot blocklist + pattern predictive blocklists found in the plus package which is effective against same day newly logged information (zero day attempts).
See the honeypot stats page, the block-list overlap with many publicly available block-lists is low and proof static honeypots are missing new information on a sizeable double digit % scale.
A high overlap count would imply were all seeing the same bad actor IP information but that is not the case.