Data from the live production Palo Alto firewalls in the US that ThreatListPro monitors: VPN brute force, SSH, and web attacks.
This report presents aggregated threat intelligence from the live production Palo Alto firewalls in the US that ThreatListPro monitors for VPN brute force, SSH brute force, web scanning, and RDP attacks. VPN brute force accounts for the largest share of observed attack activity, and the resulting blocklist covers 5.4M+ IPv4 addresses. The list is checked for new attackers every 6 hours, and this report reflects the most recent 90-day observation window.
Geographic distribution of malicious IPs observed attacking the VPN portals on our production firewalls in the past 90 days. Rankings are based on unique source IPs, not total attack volume.
| # | Country | Unique Attacker IPs | Share | Relative Volume |
|---|---|---|---|---|
| 01 | Russia | 387,420 | 18.0% | |
| 02 | China | 342,115 | 15.9% | |
| 03 | Brazil | 198,640 | 9.2% | |
| 04 | India | 176,290 | 8.2% | |
| 05 | Indonesia | 148,730 | 6.9% | |
| 06 | Vietnam | 125,480 | 5.8% | |
| 07 | Ukraine | 108,610 | 5.1% | |
| 08 | Netherlands | 94,350 | 4.4% | |
| 09 | United States | 87,920 | 4.1% | |
| 10 | Germany | 72,180 | 3.4% |
Note: The Netherlands and United States rank highly due to VPS and cloud hosting infrastructure used by attackers, not because the attacks originate from those countries domestically.
Breakdown of attack activity observed on our production firewalls by category. VPN brute force remains the dominant attack type, reflecting the primary use case for ThreatListPro customers.
ThreatListPro does not aggregate open-source lists or resell third-party data. Our blocklist is built from primary research using a four-stage pipeline:
Live production Palo Alto firewalls in the US, with public GlobalProtect VPN portals, receive real attacks every day.
Every connection is logged with source IP, timestamps, attempted credentials, user agents, and TLS fingerprints.
IPs are scored by volume, persistence, number of services targeted, and credential diversity. Only high-confidence threats pass.
Scored IPs are published as a clean, EDL-ready blocklist.
This pipeline ensures every entry on the blocklist comes from VPN attack activity observed on our own production portals. No aggregated third-party feeds.
Key shifts in the VPN threat landscape observed on our production firewalls over the past 12 months.
Brute force attempts against our own VPN portals have risen more than 300%.
Attackers increasingly rotate source IPs mid-campaign using residential proxy networks, making IP-based rate limiting less effective. A single campaign now uses 50 to 200 unique IPs compared to 10 to 30 a year ago. Blocklists that track the full botnet infrastructure are critical.
RDP brute force activity has declined as a share of total attacks, likely because more organizations have moved RDP behind VPNs or adopted cloud-based remote access. The attack volume has shifted to VPN portals themselves.
We collect attack data from live production Palo Alto firewalls in the US running public GlobalProtect VPN portals. These firewalls receive real brute force attacks every day. Every attacking IP is logged, analyzed, and scored based on attack volume, persistence, and the number of services targeted. High-confidence threats are added to the blocklist. IPs inactive for 30+ days are removed, keeping the list current and compact.
The statistics on this page are updated regularly based on data from our production firewalls. The curated blocklist that subscribers receive is checked for new attackers every 6 hours. Country rankings and trend data are recalculated monthly.
We primarily track VPN brute force attacks (credential stuffing, password spraying) against their public GlobalProtect VPN portals. The same firewalls also log SSH brute force, web scanning, and RDP attacks, giving us a comprehensive view of threats targeting authentication endpoints.
Join hundreds of organizations using ThreatListPro to block VPN attackers at the firewall. Setup takes 5 minutes, costs $9.99/month, and works on every major firewall.
See Pricing