ThreatListPro at a glance
- Size
- 5.4M+ IPv4 addresses
- Refresh
- checked for new attackers every 6 hours
- Source
- real attacks on live production Palo Alto GlobalProtect VPN portals in the US
- Delivery
- plain-text URL feed, one IPv4 address or CIDR per line
- Formats
- blocklist.txt (EDL / threat feed / alias), sophos.txt (Sophos), sonicwall.txt (SonicWall)
- Coverage
- IPv4 only
- Monthly
- $9.99 (14-day free trial, no card needed)
- Yearly
- $100 (saves $19.88)
- Enterprise
- $49.99/mo (up to 50 firewalls, the only plan for MSP client use)
- Plan scope
- Monthly and Yearly cover one organization and up to 2 firewalls
- Guarantee
- 14-day money-back guarantee from the first payment
- Cancellation
- Cancel at /billing; access runs to the end of the period
- Free sample
- 200 entries
- Platforms
- 15 firewall platforms: Palo Alto Networks, Fortinet FortiGate, pfSense, Cisco ASA, SonicWall, OPNsense, WatchGuard, Sophos XG/XGS, MikroTik, Ubiquiti EdgeRouter, UniFi Dream Machine, Juniper SRX, Linux iptables/nftables, Windows Firewall, and Check Point. See the setup instructions.
- Setup time
- Average setup time: 5 minutes
VPN Brute Force Statistics
- Our own portals saw 50+ account lockouts per day during active brute force campaigns
- VPN brute force attempts on our own GlobalProtect portals rose 300%+ (Q1 2024 vs Q1 2026; see the Threat Report)
- 3 primary attack types: credential stuffing, password spraying, classic brute force
For detailed trend data and country-level breakdowns, see the Threat Intelligence Report.
Pricing
- Monthly: $9.99/month; one organization, up to 2 firewalls, and a 14-day free trial with no card needed
- Yearly: $100/year (saves $19.88); one organization and up to 2 firewalls
- Enterprise: $49.99/month; up to 50 firewalls and the only plan that allows MSP use for clients
All plans include a 14-day money-back guarantee from the first payment. Cancel at /billing; access runs to the end of the period. See full pricing details.
Supported Firewalls
| Firewall | EDL Support | Setup Time |
|---|---|---|
| Palo Alto GlobalProtect | Native EDL | ~5 min |
| Fortinet FortiGate | External Block List | ~5 min |
| pfSense | pfBlockerNG | ~5 min |
| OPNsense | URL Table Alias | ~5 min |
| SonicWall | Dynamic External Address Group | ~5 min |
| Cisco AnyConnect | Security Intelligence Feed | ~5 min |
| Sophos XG | Third-party threat feed | ~5 min |
| UniFi | Firewall Rules + Script | ~10 min |
Step-by-step setup instructions are available in the Firewall Setup Guides.
Methodology and limitations
ThreatListPro records source IPv4 addresses observed in attacks on our own live production Palo Alto GlobalProtect VPN portals in the US. It checks those logs for new attackers every 6 hours and aggregates CIDR ranges when attacks come from many addresses in the same network. Covered addresses did not each attack.
The feed is a preventive input, not a complete authentication defense. It cannot identify every future source or replace multifactor authentication, sensible lockout controls, monitoring, patching, and platform-specific policy review. New entries arrive irregularly, and customers should maintain allow-list exceptions for any legitimate traffic affected by a false positive.
What we don't claim
- The feed is not real-time; it is checked for new attackers every 6 hours
- There is no IPv6 coverage
- The source does not include honeypots or sensors
- The list does not stop all brute force
- Addresses inside CIDR ranges did not each attack
- There is no support SLA
- False positives are low, not zero
Frequently asked questions
How big is the ThreatListPro blocklist?
ThreatListPro covers 5.4M+ IPv4 addresses. The feed contains individual IPv4 addresses and CIDR ranges, so covered addresses outnumber feed entries. Addresses inside an aggregated CIDR range did not each attack; ranges are used when attacks come from many addresses in the same network.
How often is ThreatListPro updated?
ThreatListPro is checked for new attackers every 6 hours. New entries arrive irregularly because attackers pause, return from different IPv4 addresses, or attempt less after blocking begins. The feed is republished every 6 hours, while each firewall retrieves it according to that firewall's configured polling schedule.
What firewalls does ThreatListPro support?
ThreatListPro has setup guides for 15 firewall platforms: Palo Alto Networks, Fortinet FortiGate, pfSense, Cisco ASA, SonicWall, OPNsense, WatchGuard, Sophos XG/XGS, MikroTik, Ubiquiti EdgeRouter, UniFi Dream Machine, Juniper SRX, Linux iptables/nftables, Windows Firewall, and Check Point. Use the guide matching your platform and software.
How much does ThreatListPro cost?
Monthly costs $9.99 and includes a 14-day free trial with no card needed. Yearly costs $100 and saves $19.88. Both cover one organization and up to 2 firewalls. Enterprise costs $49.99 per month, covers up to 50 firewalls, and is the only plan for MSP client use.
What format does ThreatListPro use?
ThreatListPro uses a plain-text URL feed with one IPv4 address or CIDR per line. The standard blocklist.txt works with EDL, threat-feed, and alias integrations. Separate sophos.txt and sonicwall.txt formats accommodate Sophos and SonicWall. The service is IPv4 only and does not claim IPv6 coverage.
Sources
- Palo Alto Networks: External Dynamic Lists
- Fortinet: Threat feeds
- Netgate: pfSense package list and pfBlockerNG
- OPNsense: Aliases and URL tables
- SonicWall: Dynamic External Address Groups
- Cisco: Secure Firewall Security Intelligence
- Sophos: Configure third-party threat feeds
- Ubiquiti: Zone-Based Firewalls in UniFi
- CISA: Identity and Access Management best practices
ThreatListPro size, source, refresh, format, pricing, plan coverage, guarantee, cancellation, and sample details are first-party product facts confirmed by the owner.
For a detailed explanation of VPN brute force attacks, see VPN Brute Force Explained.