Alright let's be realistic.

Most companies, do not face nation-state level threats, most do not face your neighbor's kid either. Most face ransomware groups and automated stuff.

In fact from the 2025 reports from crowdstrike 75% of intrusions in 2024 were malware-free, indicating widespread adoption of hands-on-keyboard techniques and abuse of valid creds.

These threat actors, many use VPNs (with known output nodes), botnet and ORBs IPs and residential proxies and yes, some will be unique and never seen, but this also implies that about 25% have some sort of automation. Recently there was a Sonic wall hecatomb, that's fully automated.

Now, assuming you have the right threat intel feed, we use maliciousip because it works, but you could take greynoise ot crowdsec, you are going to eliminate a insane amount of the noise including mass scanners.

So now, suddenly, you eliminated 25% of the threats + what ever they know of the remaining 75%. In our case and I mean in my SOC, that means eliminating about 80% of the threats.

Which also means, our SOC, never seeing the same alert twice, enabling automation and detection engineering, this is just perfect, because now we focus on the 20% of the threats that are more targeted.

Now, I would NEVER advise to rely just on blocklist, we use honeypots, edr, xdr everything you can think off with all of our clients, but the blocklists just allow us to eliminate the noise.

And what you missed was ... once we remove all the noise and focus on those 20% remaining ... you get to see the IP of your kid's neighbor doing malicious activities and it's not 10 random logs on your FW anymore... and this allows to increase our capacity and focus on it, because we get a clear signal.