Skip to main content

ELLIO Threat Lists

ELLIO Threat Lists are managed, continuously updated IP feeds you can include or exclude in any EDL Deployment. Browse them at platform.ellio.tech/dashboard/edl-blocklists.

There are two families of lists:

  • ELLIO Blocklists - the core threat-IP feeds curated from the ELLIO Deception Network.
  • RECON Blocklists - per-provider reconnaissance scanner IP lists.

Each list shows a live IP count, a "changed N minutes ago" timestamp, and a sparkline of recent size changes.

ELLIO Blocklists​

The flagship feeds. Pick one as the backbone of your EDL.

ListSize (typical)DescriptionWhen to use
ELLIO Threat List MAX~660,000 IPsFlagship ingress blocklist. Active malicious activity across the Deception Network, excluding the IPs that appear in RECON Blocklists.Default for production ingress blocking.
ELLIO Threat List RDP~60,000 IPsActive RDP/VNC threat and scanner IPs targeting remote-access services.Anywhere you expose RDP, VNC, or other remote-access ports to the internet.
ELLIO Threat List 250K250,000 IPsTop 250,000 threat IPs extracted from MAX.Use when 660K is too large for your firewall but you want broad coverage.
ELLIO Threat List 100K100,000 IPsTop 100,000 threat IPs.Use on resource-constrained firewalls (Sophos, ntopng, smaller pfSense).

The 100K and 250K lists are strict subsets of MAX, ranked by recency and risk. Pick the largest list your firewall comfortably handles.

RECON Blocklists​

Curated lists of scanner IPs from well-known providers. Use them by excluding to keep beneficial scanners reachable, or by including if you specifically don't want their traffic.

ListTypical sizeOperator
Censys Scanner IPs~600,000 IPscensys.io - internet-wide scanning.
Shodan Scanner IPs~400 IPsshodan.io.
Shadowserver Scanner IPs~1,200 IPsShadowserver Foundation research.
BinaryEdge Scanner IPs~2,300 IPsbinaryedge.io.
BufferOver Scanner IPs~50 IPsbufferover.run.
Cortex Xpanse~4,600 IPsPalo Alto Cortex Xpanse attack-surface scanning.
Driftnet Scanner IPs~800 IPsdriftnet.io.
InfraWatch Scanner IPs~1,400 IPsInfraWatch research.
Internet Census Scanner IPs~1,200 IPsInternet-wide measurement projects.
InternetTL Scanner IPs~250 IPsInternetTL.
LeakIX Scanner IPs~80 IPsleakix.net.
NetScout Scanner IPs~500 IPsNetScout ATLAS.
Nokia Deepfield Scanner IPs~300 IPsNokia Deepfield Internet Security.
Rapid7 Scanner IPs~600 IPsRapid7 Project Sonar.
Stretchoid Scanner IPs~2,000 IPsStretchoid.

Sizes shift as the operators rotate IPs and add or remove infrastructure.

Picking the right combination​

The most common production recipe:

  1. Include ELLIO Threat List MAX (or 250K / 100K based on firewall capacity).
  2. Exclude the RECON lists for scanners you trust (Shadowserver, Rapid7, your own attack-surface tooling) so they reach you.
  3. Include the RECON lists for scanners you don't (whichever ones don't add value for you).
  4. Exclude any Common Business Services your stack depends on (CDN, M365, Google Workspace).
  5. Include your own IP Rulesets for hand-curated additions.

Why MAX excludes RECON IPs​

MAX is designed for ingress blocking, where false positives matter. Most research scanners are technically "promiscuous" rather than malicious - blocking them by default would block legitimate scanning of your own attack surface, including by tools you may have paid for.

By keeping scanner IPs in dedicated RECON lists, MAX stays high-precision and you keep explicit control over each scanner's policy.

See also​

Last updated on