Included with Windows Premium and Enterprise, and with every appliance licence.
PortWall servers are attacked all the time, and most attackers come back - to the same server on another day, and to other PortWall servers. Premium Threat Intelligence turns that into protection: PortWall scores every address it sees attacking PortWall servers, and sends your server a signed list of the ones that keep coming back, so they are stopped here before they reach your sites.
It is on by default on a Premium (or higher) server. You will find it at the top of the Threat-intel Feeds page.
How an address gets on the list
PortWall looks at the last 30 days of attacks on PortWall servers and weighs, for each address:
- How often it comes back - the number of different days it attacked. One busy afternoon counts as one day.
- How widely - how many independent PortWall customers it attacked. Several servers of one customer count once.
- What it tried - SQL injection, code execution and similar exploit attempts count most, then password guessing, then abusive automation and scanning.
- How recently - evidence fades with age, so an address that goes quiet drops off the list by itself.
It never lists:
- private and reserved addresses, including carrier-grade NAT (
100.64.0.0/10); - the addresses of PortWall servers themselves;
- the major CDNs (Cloudflare, Fastly, Akamai, Amazon CloudFront) and verified search-engine crawlers (Googlebot, Bingbot), which relay or index other people's traffic.
The list is rebuilt every 15 minutes. Your server fetches it every 15 minutes, checks PortWall's signature on it, and refuses it if the signature does not match - an unverified list is never used.
Categories and what happens to listed addresses
Each listed address is in one category:
| Category | What it covers | Default |
|---|---|---|
| Web exploits | SQL injection, cross-site scripting, code execution, file inclusion | Block |
| Brute force | Password guessing and credential stuffing | Block |
| Scanners | Vulnerability and content scanners | Block |
| Bots and floods | Abusive automation and request floods | Challenge |
| Other attacks | Anything else the WAF flagged | Monitor |
For each category you choose:
- Block - the strongest action the evidence supports. Addresses PortWall has marked for blocking - seen attacking several independent PortWall customers, or attacking one relentlessly day after day - are dropped at the firewall. Addresses with less evidence are sent to the browser check instead, or only monitored.
- Challenge - listed addresses get the browser check (a real visitor passes it once; most attack tools cannot). Nothing is dropped.
- Monitor - nothing is enforced. The address is still shown, and explained, when you look it up.
- Off - the category is ignored.
Your server never goes further than the evidence: an address PortWall only judged strong enough to challenge is never dropped, whatever the category's setting.
Your allowlist always wins. Any address on your allowlist - with either scope - is left out before anything is blocked or challenged.
Why is this address listed?
- On the Threat-intel Feeds page, enter an address under Why is this address listed?
- On the Blocked IPs page, use Is it on the Premium Threat Intelligence list? - and any blocked address that is also on the list shows what PortWall has seen it do.
The answer reads like: "Seen attacking 4 PortWall servers on 11 days, mostly SQL injection. Last seen 2026-10-26 09:14." together with what your server does with it under your current settings.
Status
The Premium Threat Intelligence card on Protection status and on the Feeds page says plainly what is happening:
- Active - the current list is in force; the card shows how many addresses are blocked, challenged and monitored.
- Active - update failing - the latest update could not be fetched or was refused. The last list received stays in force until it expires (it is valid for 24 hours), then nothing from it is enforced. Check the server's outbound HTTPS.
- Not enforcing - the list expired with no newer one, or could not be put in force. The card names the next step.
- Off or Not on this plan - nothing from the list is in force.
C:\portwall\control-plane\portwall-admin.exe diagnose reports the same under PREMIUM THREAT INTELLIGENCE.
If your plan changes
If the licence moves below Premium, or lapses, everything the list blocked or challenged is released within a minute. Moving back to Premium turns it on again automatically.
Data
Every licensed PortWall server reports, for each address that attacked it, counts per attack category and the days it was seen - never URLs, request contents, or the names of your sites. Reports are kept for 90 days.