Threat Intelligence Platform
Disrupt cyber attacks at reconnaissance and mass exploitation stages. Advanced fingerprinting, automated blocklists, and real-time threat feeds.
Latest product updates & research
Analyze everything or move straight to network-level blocking?
One IP. Four days. Nearly 900 user agents. Over 3,000 probes. Sometimes a single IP address tells you everything you need to know about how industrialized internet scanning has become.
.png)
Coordinated Credential-Stuffing Campaign Targets Palo Alto GlobalProtect Portals
A coordinated credential-stuffing campaign hit GlobalProtect VPN portals with 8,575 IPs in 48 hours. Three attack waves, 78 targeted usernames, one password. Our team breaks down the timeline, infrastructure, fingerprints, and what defenders can do.
"n8n" is the new "admin."
On February 10, 2026, our deception network recorded "n8n" overtaking "admin" as the #2 most brute-forced SSH username. The campaign scaled from a handful of probing IPs to hundreds of unique sources in under a week, with attackers rapidly iterating through password variants.
Stories from ELLIO
ELLIO Founder Vlad Iliushin Hands AMTSO Leadership to Stefan Dumitrascu
ELLIO today announced that its founder, Vlad Iliushin, has completed his term as President of AMTSO (Anti-Malware Testing Standards Organization) and handed over the role to Stefan Dumitrascu, Founder and CEO of Artifact Security.
BSides 2025: Our Top Picks and Insights
In 2025, the ELLIO team traveled across the US and Europe to attend BSides events. Here’s a look at our favorite BSides moments of the year.
ELLIO Debuts New Open-Source Recon Shield
At Black Hat 2025, ELLIO is launching a new open-source tool: the TCP Fingerprint Firewall. This Recon Shield, built on high-performance eBPF technology, uses advanced MuonFP-based fingerprints to detect and block malicious scanners in real time.
What We Build
Learn more about each product on ellio.tech
ELLIO Threat Intelligence
Access clean, high-fidelity threat data focused on mass exploitation and reconnaissance, turning raw signals into context-rich insights your security stack can act on instantly - from SIEM, SOAR, TIP to firewalls.
ELLIO Blocklist Automation
Manage all your blocklists and IP rules from a central place. Define what’s allowed and what’s blocked – broadly or with fine granularity. Apply rules automatically across all your firewalls.
ELLIO IP Blocklists
Dynamic, context-driven threat lists. Updated automatically every 5 minutes or as needed.
ELLIO Recon IP Lists
Continuously updated lists of scanner IPs. Define exactly which scanners to block or always allow.
ELLIO rDNS Dataset
Complete IPv4 reverse DNS. ~1.25 billion clean PTR records, updated daily.
ELLIO Fingerprint Firewall
Unifies network fingerprints, user-provided signatures, and traditional IP blocklists into a single, actionable defense layer.