Skip to Navigation Skip to Content

Active Threat Intelligence and Protective DNS

Stopping 100 million+ threats daily: Phishing, Ransomware, Malware, Bots, Scanners + More

Cost-effective security, compliance & operational reliability from the industry's most comprehensive protective DNS (PDNS) and real-time threat intelligence solution. 

Speak to an Analyst

(and find out how we complement your existing defenses)

Threats blocked today
Updated every 15 minutes

Free Trial

See what your other security products have been missing. Start Stopping Threats today at the DNS layer. Quick, easy setup.

Speak to an Analyst

Get started today


Protective DNS Security

Protect clients, remote users and servers from phishing, ransomware, malware and more.

Learn more

noun_IP camera system_1907489-1

Protect Web and Server Infrastructure

Cut credit card fraud by 50%, stop bots and unwanted traffic from impacting operations.

Learn more

How It Works

Stop threats before they start, at the DNS layer, with the most comprehensive, advanced and up-to-date real-time DNS Security solution. Blocks malicious DNS resolution requests and IP connection attempts across 600+ categories. Easily integrates with DNS, DDI, Firewalls, Routers and Cloud Native infrastructure.

Comprehensive Threat Intelligence

Over 900+ qualified data sources that are human & machine curated, delivering the most comprehensive and accurate coverage in the industry of IP addresses and domains.

CheckIOC Overview UI

Custom Security Policies

Fine grained control with 600+ fully customizable policies in 60+ categories. Tailor your own custom block & allowlists.

Policy Management UI

Network Device Integrations

Automated policy updates for virtually any NGFW, DNS server, Router, Switch, IDP, WAF, SIEM and more.

Screen Shot 2021-06-15 at 1.48.59 PM

Forensics & Reporting

View & analyze blocked threats. Identify affected client devices. Custom email reports & alerts.

ThreatSTOP reporting

ThreatSTOP has eliminated manual blacklisting and remediation, and reduced help desk tickets related to malware by 90%, to only 1-2 per month.

Mike Connors, Information Security Analyst

ThreatSTOP Platform

The ThreatSTOP platform is a SaaS security platform with modular product offerings for Protective DNS (PDNS), firewall automation, and other Threat Intel use cases. It integrates with physical, virtual, and hosted security stack components including firewalls, DNS servers, IDPS, SIEM and more. The platform automates threat intelligence acquisition, curation, and timely application for threat mitigation and visibility. Modules include:

Learn More

DNS Defense

Using continuous updates from 900+ Threat Intelligence sources, DNS Defense stops dangerous and unwanted DNS traffic before damage is done.

IP Defense

IP Defense sends automated policy updates to existing firewalls, routers and switches, and stops inbound attacks at network edges, before  damage is done.


DNS Security for endpoints, whether they're inside the corporate network or roaming.

Check IoC Subscription

In-depth threat intelligence about domains and IPs from the most comprehensive threat intel operations spanning over a decade.


The ThreatSTOP Community Account is our way of saying thank you to the security community for everything they do. A Community Account entitles you to run ThreatSTOP on one IP device (firewall, router, etc.) and one DNS device. Community accounts are limited to pre-built policies that include core protections such as the DShield Blocklist and Emergency Handler Blocks.

Learn More

  • DNS Defense CE
  • IP Defense CE
  • MyDNS CE
  • Check IoC Tool