Real-World Threat Intelligence
From Active Attack Data

Live IOC feeds sourced from real attacks on the CompromiseLens platform — enriched with AbuseIPDB, GeoIP, and ASN data. Updated hourly.

—

Active IOCs

—

Auto-Blocked

—

Countries

—

New Today

◈ COMPROMISELENS // GLOBAL THREAT MATRIX IOC — BLOCKED — COUNTRIES — CVEs 1817

LIVE

▸ TOP ORIGINS

CHINA

USA

NETHERLANDS

ROMANIA

RUSSIA

▸ THREAT LEVEL

CRITICAL

▸ ARCS IN FLIGHT

0

ACTIVE ATTACKS

▸ ATTACK TYPES

BRUTE FORCE68%

PORT SCAN18%

EXPLOIT9%

▸ LAST BLOCKED

92.118.39.62

BRUTE FORCE · RO

▸ ENRICHMENT

ABUSEIPDB● LIVE

VIRUSTOTAL● LIVE

GEOIP● LIVE

CISA KEV● SYNCED

FEED

—

Total IOCs

—

High Confidence

—

Blocked

—

New Today

Live Threat Feed

Updated hourly

IP Address	Risk Score	Country	Network / ISP	Threat Type	First Seen	Times Seen	Status
Loading threat feed...

API Access

Integrate CompromiseLens threat intelligence directly into your SIEM, firewall, or security tools.

🆓

Free

100 IOCs/day, 24h delayed feed, JSON export

$0/month

⚡

Pro

Full real-time feed, 10,000 IOCs/day, STIX/TAXII, webhooks

$29/month

🏢

Enterprise

Unlimited IOCs, bulk download, SIEM push, custom feeds, SLA

$199/month

Quick Start

# Get threat indicators

curl -H "X-API-Key: YOUR_KEY" \

https://api.compromiselens.com/threat-intel/indicators

# Check a specific IP

curl -H "X-API-Key: YOUR_KEY" \

https://api.compromiselens.com/threat-intel/indicators/1.2.3.4

# Get summary stats

curl -H "X-API-Key: YOUR_KEY" \

https://api.compromiselens.com/threat-intel/summary

Docs & Integrations

Step-by-step guides for integrating CompromiseLens Threat Intelligence into your security stack

Select Integration:

FortiGate Integration

Block malicious IPs automatically using FortiGate External Block Lists

1Get your API Key — Sign in and generate a key from the API Access tab.

2Create External Block List

Go to Security Profiles → External Block List → Create New

Name: CompromiseLens-IOCs
Type: IP Address
URL: https://api.compromiselens.com/threat-intel/indicators/export?format=txt&min_score=80&api_key=YOUR_API_KEY
Refresh Rate: 60 minutes

3Apply to Firewall Policy

Go to Policy & Objects → Firewall Policy and add the block list as a source address in the relevant deny rule.

4Tag your device — Add this header to track usage per FortiGate:

X-Instance-ID: fortigate-office-main

Tip: Use min_score=80 for high-confidence blocks. Lower to 50 for broader coverage at higher false-positive risk.

pfSense / pfBlockerNG

Auto-update pfBlockerNG with CompromiseLens IP blocklist

1Install pfBlockerNG — Go to System → Package Manager and install pfBlockerNG-devel.

2Add IP Feed

Go to Firewall → pfBlockerNG → IP → IPv4 and add:

List Name: CompromiseLens
URL: https://api.compromiselens.com/threat-intel/indicators/export?format=txt&min_score=80&api_key=YOUR_API_KEY
Action: Deny Both
Update Frequency: Every 1 hour

3Force Update — Click Force → Reload → All to apply immediately.

4Verify — Check Firewall → pfBlockerNG → Alerts to confirm IPs are being blocked.

Tip: Tag your pfSense: add ?instance_id=pfsense-office to the URL to track it separately.

nginx

Block malicious IPs at web server level with auto-updating blocklist

1Create update script at /etc/nginx/update-blocklist.sh:

#!/bin/bash
API_KEY="YOUR_API_KEY"
INSTANCE="nginx-$(hostname)"
curl -s "https://api.compromiselens.com/threat-intel/indicators/export?format=nginx&min_score=80&api_key=$API_KEY&instance_id=$INSTANCE" \
  -o /etc/nginx/conf.d/compromiselens-block.conf
nginx -s reload

2Schedule hourly updates:

chmod +x /etc/nginx/update-blocklist.sh
echo "0 * * * * root /etc/nginx/update-blocklist.sh" | tee /etc/cron.d/compromiselens

3Include in nginx.conf:

http {
    include /etc/nginx/conf.d/compromiselens-block.conf;
}

Tip: The nginx format returns ready-to-use deny IP; lines. Run the script once manually first to test.

Windows Defender Firewall

Block malicious IPs via PowerShell and Windows Firewall

1Create PowerShell script at C:\Scripts\update-cl-blocklist.ps1:

$apiKey = "YOUR_API_KEY"
$instance = "windows-$env:COMPUTERNAME"
$url = "https://api.compromiselens.com/threat-intel/indicators/export?format=txt&min_score=80&api_key=$apiKey&instance_id=$instance"
$ips = (Invoke-WebRequest -Uri $url).Content -split "`r`n" | Where-Object { $_ -match "^\d" }
Remove-NetFirewallRule -DisplayName "CompromiseLens-Block" -ErrorAction SilentlyContinue
New-NetFirewallRule -DisplayName "CompromiseLens-Block" -Direction Inbound -Action Block -RemoteAddress $ips

2Schedule via Task Scheduler:

$action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\update-cl-blocklist.ps1"
$trigger = New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Hours 1) -Once -At (Get-Date)
Register-ScheduledTask -TaskName "CompromiseLens-Update" -Action $action -Trigger $trigger -RunLevel Highest

Tip: Run the script as Administrator. The instance ID is set automatically using your computer name.

Cisco ASA / Firepower

Feed threat intelligence into Cisco using dynamic network group feeds

1For Cisco Firepower (FMC)

Go to Objects → Object Management → Security Intelligence → Network Lists and Feeds

Name: CompromiseLens-IOC-Feed
Type: URL
Feed URL: https://api.compromiselens.com/threat-intel/indicators/export?format=txt&min_score=80&api_key=YOUR_KEY
Update Interval: 1 hour

2Apply to Access Control Policy

Add the feed to your Security Intelligence block list in your Access Control Policy and deploy.

3For Cisco ASA (CLI):

object-group network CompromiseLens-Block
 description CompromiseLens Threat Intel
access-list OUTSIDE_IN deny ip object-group CompromiseLens-Block any

Tip: Firepower's Security Intelligence updates happen automatically once the feed URL is configured — no scripting needed.

API Reference

Method	Endpoint	Description	Auth
GET	/threat-intel/summary	Summary stats	Public
GET	/threat-intel/indicators	Full IOC feed with filters	API Key
GET	/threat-intel/indicators/{ip}	Lookup specific IP	API Key
GET	/threat-intel/indicators/export	Export: txt, csv, nginx, json, stix	API Key
GET	/threat-intel/top-attackers	Top IPs by frequency	API Key
GET	/threat-intel/by-country	Attack stats by country	API Key
GET	/threat-intel/keys/{id}/instances	List key instances/devices	JWT

Query Parameters

Parameter	Values	Description
format	txt, csv, json, nginx, stix	Output format for export
min_score	0-100	Minimum abuse confidence score
country	CN, US, RU...	Filter by country code
limit	1-1000	Number of results
instance_id	any string	Device identifier for tracking
api_key	clti_xxx	API key (alternative to header)

Headers

Header	Description
X-API-Key	Your API key — preferred authentication method
X-Instance-ID	Device identifier for per-device usage tracking
Authorization	Bearer {JWT} — alternative to API key

Palo Alto NGFW

Block IPs using Palo Alto External Dynamic Lists

1Create External Dynamic List

Go to Objects → External Dynamic Lists → Add

Name: CompromiseLens-IOCs
Type: IP List
Source: https://api.compromiselens.com/threat-intel/indicators/export?format=txt&min_score=80&api_key=YOUR_KEY
Repeat: Every hour

2Create Security Policy — Go to Policies → Security → Add. Set Source Address to the EDL and Action to Deny.

3Commit — Click Commit. Verify in Monitor → Logs → Traffic.

Tip: Palo Alto EDLs refresh automatically once configured. No scripting required.

MikroTik RouterOS

Auto-populate MikroTik address lists from CompromiseLens feed

1Fetch blocklist

/tool fetch url="https://api.compromiselens.com/threat-intel/indicators/export?format=txt&min_score=80&api_key=YOUR_KEY" dst-path=cl-blocklist.txt

2Create firewall rule

/ip firewall filter add chain=forward src-address-list=CL-Blocklist action=drop comment="CompromiseLens"

3Schedule hourly updates

/system scheduler add name=CL-Update interval=1h \
  on-event="/tool fetch url=https://api.compromiselens.com/threat-intel/indicators/export?format=txt&min_score=80&api_key=YOUR_KEY dst-path=cl-blocklist.txt"

AWS WAF / Route 53

Block malicious IPs across AWS infrastructure using WAF IP sets

1Create Lambda function to sync CompromiseLens feed into AWS WAF IP set:

import boto3, urllib.request
def lambda_handler(event, context):
    api_key = "YOUR_API_KEY"
    url = f"https://api.compromiselens.com/threat-intel/indicators/export?format=txt&min_score=80&api_key={api_key}"
    response = urllib.request.urlopen(url)
    ips = [l for l in response.read().decode().splitlines() if l and not l.startswith('#')]
    wafv2 = boto3.client('wafv2', region_name='us-east-1')
    ip_set = wafv2.get_ip_set(Name='CompromiseLens', Scope='REGIONAL', Id='YOUR_IP_SET_ID')
    wafv2.update_ip_set(Name='CompromiseLens', Scope='REGIONAL',
        Id='YOUR_IP_SET_ID', LockToken=ip_set['LockToken'],
        Addresses=[f"{ip}/32" for ip in ips[:10000]])

2Schedule with EventBridge — Create a 1-hour EventBridge rule to trigger the Lambda.

3Attach to WAF Web ACL — Create a WAF rule referencing the IP set with Block action.

Tip: AWS WAF IP sets support up to 10,000 addresses. Use min_score=80 to stay within limits.

BIND 9 RPZ

Block malicious IPs at DNS resolver level using BIND 9 Response Policy Zones

1Create update script at /usr/local/bin/update-cl-rpz.sh:

#!/bin/bash
API_KEY="YOUR_API_KEY"
OUTPUT="/etc/bind/zones/compromiselens.rpz"
echo '$TTL 300' > $OUTPUT
echo "@ IN SOA localhost. root.localhost. $(date +%Y%m%d%H) 3600 900 86400 300" >> $OUTPUT
echo "  IN NS localhost." >> $OUTPUT
curl -s "https://api.compromiselens.com/threat-intel/indicators/export?format=txt&min_score=80&api_key=$API_KEY" \
  | grep -v "^#" | awk '{print $1".  CNAME ."}' >> $OUTPUT
rndc reload

2Add RPZ to named.conf:

response-policy { zone "compromiselens.rpz" policy NXDOMAIN; };

3Schedule hourly:

chmod +x /usr/local/bin/update-cl-rpz.sh
echo "0 * * * * root /usr/local/bin/update-cl-rpz.sh" > /etc/cron.d/cl-bind

MISP

Import CompromiseLens IOCs into MISP for correlation and sharing

1Fetch and import via MISP API:

import requests
CL_KEY = "YOUR_CL_API_KEY"
MISP_URL = "https://YOUR_MISP"
MISP_KEY = "YOUR_MISP_KEY"
data = requests.get("https://api.compromiselens.com/threat-intel/indicators?limit=1000",
    headers={"X-API-Key": CL_KEY}).json()
event = requests.post(f"{MISP_URL}/events",
    headers={"Authorization": MISP_KEY, "Content-Type": "application/json"},
    json={"Event": {"info": "CompromiseLens IOC Feed", "distribution": 0}},
    verify=False).json()
for ind in data["indicators"]:
    requests.post(f"{MISP_URL}/attributes/add/{event['Event']['id']}",
        headers={"Authorization": MISP_KEY, "Content-Type": "application/json"},
        json={"Attribute": {"type": "ip-src", "value": ind["ip"],
            "comment": f"Score:{ind['abuse_score']} ISP:{ind['isp']}"}}, verify=False)

2Or use CSV import — Download the CSV export and import via MISP web UI under Event Actions → Import.

Tip: Schedule the sync script hourly via cron to keep MISP updated with latest CompromiseLens indicators.

ClamAV

Combine ClamAV file scanning with CompromiseLens network-level IP blocking

1Create blocklist sync script:

#!/bin/bash
API_KEY="YOUR_API_KEY"
curl -s "https://api.compromiselens.com/threat-intel/indicators/export?format=txt&min_score=80&api_key=$API_KEY" \
  | grep -v "^#" > /etc/clamav/cl-blocklist.txt
while IFS= read -r ip; do
  iptables -A INPUT -s "$ip" -j DROP
  iptables -A OUTPUT -d "$ip" -j DROP
done < /etc/clamav/cl-blocklist.txt

2Run alongside ClamAV updates by adding to freshclam.conf:

OnUpdateExecute /usr/local/bin/update-cl-blocklist.sh

Tip: ClamAV handles file-level threats. CompromiseLens adds network-level blocking — together they provide layered defence.

CVE Intelligence Feed

CISA Known Exploited Vulnerabilities + NVD recent CVEs — updated every 12 hours

—

TOTAL CVEs

—

CISA KEV

—

CRITICAL

—

HIGH

—

NEW TODAY

KEV only

CVE Feed

Updated every 12h

CVE ID	Severity	CVSS	Vendor	Product	KEV	Published
Loading CVE feed...

CVE Intelligence Feed

CISA Known Exploited Vulnerabilities + NVD recent CVEs — updated every 12 hours

—

TOTAL CVEs

—

CISA KEV

—

CRITICAL

—

HIGH

—

NEW TODAY

KEV only

CVE Feed

Updated every 12h

CVE ID	Severity	CVSS	Vendor	Product	KEV	Published
Loading CVE feed...

STIX 2.1 / TAXII Export

Export CompromiseLens indicators and CVEs as a standards-compliant STIX 2.1 bundle for SIEM, SOAR, and threat intelligence platforms.

1Get your API key — Sign in and generate a key from the API Access tab.

2Preview bundle stats

curl "https://api.compromiselens.com/threat-intel/indicators/export/stix/summary"   -H "Authorization: Bearer YOUR_TOKEN"

3Download STIX 2.1 bundle

curl -o compromiselens.stix.json   "https://api.compromiselens.com/threat-intel/indicators/export/stix?min_score=80&include_cves=true"   -H "Authorization: Bearer YOUR_TOKEN"

4Import into MISP

from pymisp import PyMISP
from stix2 import parse
misp = PyMISP("https://YOUR_MISP", "YOUR_MISP_KEY")
bundle = parse(open("compromiselens.stix.json").read())
for obj in bundle.objects:
    if obj.type == "indicator":
        ip = obj.pattern.split("'")[1]
        misp.add_event({"info": obj.name,
            "Attribute": [{"type": "ip-src", "value": ip}]})

5Import into Splunk

# Splunk TAXII Threat Intelligence add-on
# Feed URL: https://api.compromiselens.com/threat-intel/indicators/export/stix
# Auth header: Authorization: Bearer YOUR_TOKEN
# Schedule: Every 1 hour

Bundle contents: Identity, TLP:WHITE marking, IPv4 Indicators, Observable objects, Relationships, and Vulnerability objects for CISA KEV + Critical CVEs.

122

IP INDICATORS

1639

CVE OBJECTS

2.1

STIX VERSION

Real-World Threat IntelligenceFrom Active Attack Data

API Access

Free

Pro

Enterprise

Quick Start

Docs & Integrations

FortiGate Integration

pfSense / pfBlockerNG

nginx

Windows Defender Firewall

Cisco ASA / Firepower

API Reference

Query Parameters

Headers

Palo Alto NGFW

MikroTik RouterOS

AWS WAF / Route 53

BIND 9 RPZ

MISP

ClamAV

CVE Intelligence Feed

CVE Intelligence Feed

STIX 2.1 / TAXII Export

Cyber News

Real-World Threat Intelligence
From Active Attack Data