Free threat intelligence samples

What is threat intelligence data?

Threat intelligence data is structured information about known threats to digital systems. In the context of web security, it includes lists of IP addresses associated with VPNs, proxies, Tor nodes, and datacenters, as well as domains used by disposable email services and reputation scores for internet service providers. Businesses use this data to identify and block malicious or fraudulent traffic before it can cause harm.

Traditional threat intelligence is delivered as API services that charge per query and require sending user data to third-party servers. AntiProxies takes a different approach: we deliver curated, production-ready databases as downloadable files in standard formats (CSV and JSON). This means lookups happen locally on your own infrastructure - no API latency, no per-query costs, and no user data leaving your servers.

Common use cases for threat intelligence

Threat intelligence databases are used across virtually every industry that operates online. Here are the most common applications:

• E-commerce fraud prevention: Block orders from VPNs, proxies, and datacenter IPs that are frequently associated with payment fraud, coupon abuse, and fake reviews.
• Account security: Flag login attempts from Tor exit nodes or high-risk ISPs and trigger additional authentication steps like 2FA challenges.
• Registration quality: Reject signups using disposable email addresses to prevent fake accounts, trial abuse, and spam.
• Bot mitigation: Identify and block automated traffic from datacenter IPs that power scrapers, credential stuffing tools, and inventory hoarding bots.
• Content licensing: Enforce geographic restrictions by detecting VPN and proxy connections that attempt to bypass region locks.
• Ad fraud detection: Filter out non-human clicks and impressions originating from datacenter IPs and known proxy services.
• Gaming anti-cheat: Detect players using VPNs to evade bans, exploit regional pricing, or gain unfair latency advantages.

Self-hosted vs. API-based threat intelligence

The two primary delivery models for threat intelligence are API services and downloadable databases. API services are convenient but come with significant trade-offs: they add latency to every request, charge per query (which can become expensive at scale), and require sending user IP addresses and email addresses to a third-party server - raising GDPR and privacy concerns.

Self-hosted databases remove the external lookup from your request path. Performance then depends on your datastore and indexing, while the license cost stays fixed regardless of query volume. The trade-off is operational: your team imports each release and decides when to deploy it.

The trade-off is update frequency: API services can update in near real-time, while downloadable AntiProxies databases follow a monthly release cycle. Tor nodes and other fast-changing categories can move between releases, so treat a match as a risk signal, deploy new snapshots promptly, and combine the data with controls that observe current behavior.