Paste a single blocklist URL into your firewall's External Dynamic List. 5.4M+ IPv4 addresses blocked automatically, and the list is checked for new attackers every 6 hours. Works with Palo Alto, FortiGate, pfSense, OPNsense, SonicWall, Cisco, Sophos, UniFi, and more.
Start 30-Day Free Trial — No Card See Supported FirewallsThreatListPro is a VPN brute force IP blocklist that blocks 5.4M+ IPv4 addresses from reaching your VPN portals. It works as an External Dynamic List (EDL) — paste one URL into your firewall and malicious IPs are blocked automatically, and the list is checked for new attackers every 6 hours. Compatible with Palo Alto, FortiGate, pfSense, OPNsense, SonicWall, Cisco, Sophos, UniFi, WatchGuard, Check Point, and MikroTik firewalls. Priced at $9.99/month with a 30-day free trial, ThreatListPro is built for IT teams that need focused VPN protection without enterprise threat intelligence costs ($500+/month). Unlike generic scraped feeds, the list is curated from IPs observed attacking VPN portals. See how it stacks up in our best IP blocklist guide for 2026.
Sourced from real attacks on live production Palo Alto GlobalProtect VPN portals in the US · Checked for new attackers every 6 hours · 5.4M+ IPv4 addresses: single attacker IPs plus CIDR ranges where attacks come from many addresses
ThreatListPro is a curated IP blocklist service purpose-built for VPN brute force protection. It covers 5.4M+ IPv4 addresses, built from real attacks on production Palo Alto GlobalProtect VPN portals in the US and checked for new attackers every 6 hours. Network administrators paste a single URL into their firewall's External Dynamic List (EDL) configuration. The curated list keeps false positives near zero and fits every firewall model, including entry-level devices. ThreatListPro works with Palo Alto GlobalProtect, FortiGate, pfSense, OPNsense, SonicWall, Cisco AnyConnect, Sophos XG, and UniFi. Plans start at $9.99/month with a 30-day free trial.
Published by ThreatListPro Security Team at CalMax Systems · Last updated: September 11, 2026
Works with any firewall that supports external blocklists
+ any firewall with External Dynamic List (EDL) support
VPN brute force attacks cause real damage to IT teams and organizations every day.
Users locked out 50+ per day when bots target your VPN portal. Account lockout policies cannot distinguish attackers from legitimate users, flooding the helpdesk with tickets.
Hours spent manually blocking IPs, only to see attacks from new addresses the next day. It is an endless, unwinnable cycle that drains your team.
Enterprise threat intelligence feeds cost $500+/month and include millions of irrelevant IPs. You need VPN attackers blocked, not a firehose of unrelated data.
ThreatListPro is a purpose-built IP blocklist focused exclusively on VPN brute force attacks.
Curated specifically for VPN brute force attacks. Not generic threat intelligence -- targeted protection for your portal.
Copy your unique URL. Paste into your firewall's EDL or external blocklist config. Done. Start blocking attacks immediately.
Each customer receives a unique, secure API key. Cancel anytime; access runs to the end of the billing period. No shared lists.
Curated from real attacks on live production Palo Alto GlobalProtect VPN portals in the US. Every entry on the list comes from observed attacks.
Email support from network security professionals who understand your firewall.
Get protected in under 5 minutes. No agents, no software, no complexity.
Choose your plan and subscribe. Instantly receive your unique API key and blocklist URL via email.
Follow our step-by-step guide. Paste your unique URL into your firewall's external blocklist or EDL configuration.
Your firewall pulls fresh threat data on its own schedule; the list is checked for new attackers every 6 hours. No maintenance required. Set it and forget it.
2 of 2,019
On October 5, 2026 we checked our list against 10 free blocklists, including Spamhaus DROP, FireHOL, blocklist.de, CINS Army and IPsum. Even with all 10 combined, only 2 of the 2,019 individual attacker IPs on our list were on any of them. None of those free lists is built from VPN login attempts.
See the full comparison →Simple, transparent pricing. Start protecting your network today.
Want to test it first? Grab a free 200-IP sample (no signup) and paste it into your firewall: api.threatlistpro.com/v1/sample/blocklist.txt
Try ThreatListPro risk-free. Not satisfied within 14 days of your first payment? Email [email protected] for a full refund. No questions asked.
We went from 50+ locked accounts per day to zero. Setup took 10 minutes on our Palo Alto firewall. The helpdesk tickets disappeared overnight. Best $9.99 we've spent all year.
An IP blocklist for VPN protection is a curated list of IP addresses known to launch brute force, credential stuffing, and password spraying attacks against VPN portals. ThreatListPro maintains a blocklist covering 5.4M+ IPv4 addresses, specifically targeting VPN login pages such as GlobalProtect, FortiGate SSL-VPN, and pfSense. Your firewall imports this list and blocks these IPs before they can attempt any login attacks.
After subscribing, you receive a unique API URL that serves as an External Dynamic List (EDL). You paste this URL into your firewall's external blocklist configuration. Your firewall periodically fetches the latest list of malicious IPs from this URL and automatically blocks them. The list is checked for new attackers every 6 hours against real VPN attack data.
ThreatListPro has setup guides for 15 firewall platforms, including Palo Alto GlobalProtect (EDL), FortiGate SSL-VPN (External Threat Feed), pfSense with pfBlockerNG, OPNsense, SonicWall, Cisco ASA/AnyConnect, Sophos XG/XGS, and UniFi Gateway. Any firewall that supports importing external IP blocklists or dynamic address lists is compatible.
Most customers complete setup in under 5 minutes and see immediate results. Subscribe, copy your unique blocklist URL, paste it into your firewall's external blocklist configuration, and attacks are blocked right away. We provide step-by-step guides for every supported firewall platform.
Yes. The Monthly plan includes a 30-day free trial, and no card is needed to start. You can test ThreatListPro with your firewall completely risk-free. Nothing is charged unless you add a card to keep the list after 30 days: go to threatlistpro.com/billing and sign in with your email. We also offer a 14-day money-back guarantee on all paid plans.
The ThreatListPro blocklist is checked for new attackers every 6 hours against real VPN attack data. Your firewall automatically pulls the latest version on its configured schedule, so you always have up-to-date protection without any manual intervention.
Enterprise threat feeds cost $500+/month and contain millions of IPs across all threat categories, most of which are irrelevant to VPN protection. ThreatListPro is a focused IP blocklist curated specifically for VPN brute force attacks. Its entries come only from attacks on VPN portals, making it more effective and far more affordable for this specific use case.