Free threat intelligence samples

What is threat intelligence data?

Threat intelligence data is structured information about known threats to digital systems. In the context of web security, it includes lists of IP addresses associated with VPNs, proxies, Tor nodes, and datacenters, as well as domains used by disposable email services and reputation scores for internet service providers. Businesses use this data to identify and block malicious or fraudulent traffic before it can cause harm.

Traditional threat intelligence is delivered as API services that charge per query and require sending user data to third-party servers. AntiProxies takes a different approach: we deliver curated, production-ready databases as downloadable files in standard formats (CSV and JSON). This means lookups happen locally on your own infrastructure - no API latency, no per-query costs, and no user data leaving your servers.

Common use cases for threat intelligence

Threat intelligence databases are used across virtually every industry that operates online. Here are the most common applications:

• E-commerce fraud prevention: Block orders from VPNs, proxies, and datacenter IPs that are frequently associated with payment fraud, coupon abuse, and fake reviews.
• Account security: Flag login attempts from Tor exit nodes or high-risk ISPs and trigger additional authentication steps like 2FA challenges.
• Registration quality: Reject signups using disposable email addresses to prevent fake accounts, trial abuse, and spam.
• Bot mitigation: Identify and block automated traffic from datacenter IPs that power scrapers, credential stuffing tools, and inventory hoarding bots.
• Content licensing: Enforce geographic restrictions by detecting VPN and proxy connections that attempt to bypass region locks.
• Ad fraud detection: Filter out non-human clicks and impressions originating from datacenter IPs and known proxy services.
• Gaming anti-cheat: Detect players using VPNs to evade bans, exploit regional pricing, or gain unfair latency advantages.

Self-hosted vs. API-based threat intelligence

The two primary delivery models for threat intelligence are API services and downloadable databases. API services are convenient but come with significant trade-offs: they add latency to every request, charge per query (which can become expensive at scale), and require sending user IP addresses and email addresses to a third-party server - raising GDPR and privacy concerns.

Self-hosted databases eliminate all three issues. The data lives on your infrastructure, lookups are instant (a local hash table or CIDR trie), and costs are fixed regardless of traffic volume. For businesses processing millions of requests per month, the cost difference alone is substantial - a single €99/year license replaces API bills that can run into thousands of euros per month.

The trade-off is update frequency: API services can update in near real-time, while downloadable databases are updated on a monthly cycle. For most threat categories - VPN provider ranges, disposable email domains, ISP reputation, and datacenter allocations - this cadence is more than sufficient because the underlying data changes relatively slowly. Tor exit nodes are the most volatile category, which is why our Tor database receives more frequent updates.