Introducing ThreatNet: A Free Shared Attacker Blocklist for Your Site
Every site on the internet gets probed. WordPress login attempts, scanner bots hunting for exposed .env files, credential-stuffing scripts hammering login forms — it's constant background noise, and until now every site has had to fight it alone.
Not anymore. ThreatNet is live: a free, shared attacker blocklist built into 1c3d.com. Drop one PHP snippet into your site, and it joins a network where an attack on one member becomes protection for everyone else.
How It Works
Every 1c3d.com account can generate a Personal API Key for free. Enable ThreatNet on that key with your site's URL, and you get a ready-to-paste PHP snippet. Drop it at the very top of your site's bootstrap file — before any other code runs — and you're in.
From there, the snippet does two things automatically:
- Blocks known-bad IPs. It checks incoming visitors against the shared network blocklist and instantly rejects anyone already flagged — either with a plain 403, or a redirect to a URL of your choice.
- Reports new attacks. If a visitor hits a common probe path (/wp-admin, /.env, /xmlrpc.php, etc.) or matches a known scanner signature, it reports that IP back to the network — protecting every other site running the agent.
No False Positives, By Design
An IP only gets added to the shared blocklist once 2 or more independent sites report it, or one site reports it 5 or more times within 24 hours. A single misconfigured site, or one weird request from a legitimate visitor, can never poison the list. It takes a real pattern of bad behavior before anyone gets banned network-wide.
1c3d.com Is Already Running It
This isn't a theoretical feature — 1c3d.com's own security system runs on ThreatNet right now. Every scanner user-agent, probe-path hit, brute-force login attempt, and early-stage scanning behavior we detect gets fed into the network automatically. As more sites join, everyone's data makes everyone else's defense sharper — the whole point is that this gets better with scale, not worse.
What You Get
- A free Personal API Key, usable for ThreatNet and the rest of the 1c3d.com API
- A copy-paste PHP snippet — no dependencies, no framework required
- Live stats on your own site's activity and the network's overall size
- Full control over what happens to blocked visitors: plain 403, or redirect to a URL you choose
- A key you can copy anytime — no re-issuing, no losing access if you misplace it
Get Started
Head to 1c3d.com/threatnet to see live network stats and get set up. If you already have an account, go to Settings → Personal API Keys, generate a key, and enable ThreatNet on it — the whole process takes about a minute.
The network is only as strong as its members. If you run a WordPress site, a small business site, a personal blog, or anything else that gets hit by the same tired scanner bots as everyone else — this is built for you.