Open Threat Intelligence

Block threats before they
reach your network

An IP blocklist built from open-source threat feeds and our own honeypots, refreshed every 15 minutes.

IPs on blocklist
201,300
IPs tracked
2,451,022
Refresh interval
15 min
Data sources
20+ OSINT feeds & 50+ honeypots
Cost to use
Free

About ThreatHive

ThreatHive pulls together 20+ open-source threat feeds and data from our own honeypots to build a blocklist, refreshed every 15 minutes. For unblock or false-positive requests, contact [email protected].

Blocklist URL

Point your firewall or security tool directly to the live feed.

https://threathive.net/hiveblocklist.txt
Download list
Major CDNs, public DNS resolvers, and uptime monitors are whitelisted to keep false positives down.

IP Lookup

Check any IP address against the current blocklist and historical records — including IPs that were listed before but aren't anymore.

Open lookup tool

Firewall Integrations

Step-by-step setup guides for major platforms.

ASN Distribution
ASN distribution chart showing top autonomous systems in the blocklist
All-time Top 50 Source Countries
World map showing geographic distribution of blocked IPs

Disclaimer: The ThreatHive blocklist is provided "as is" without warranty. It may be used for commercial purposes; however, it may not be sold, resold, bundled as part of a paid service, or otherwise used for direct monetary gain.