A free blacklist of malicious IPs, with reputation scores

Built from attack reports by people who run servers and from threat feeds: password guessing, exploit attempts, spam and floods. All you need is a free API key, and it takes one email to get one.

Get your free API key

Free of charge. No password, no credit card.

2,524malicious addresses on the list

5with a score of 90 or more

0IPv6 addresses

9ready-made download formats

Three steps, about a minute

Enter your email. We send a sign-in link. There is no password to remember.
Create your API key. Answer two quick questions and it is yours, free of charge.

Download the list with one command, or point your firewall at the URL:

curl -s "https://isipsafe.com/api/v1/blocklist?key=YOUR_API_KEY&format=txt"

More than a list of IPs

A plain list tells you nothing about how sure anyone is. Here every address comes with a confidence score from 0 to 100, so you choose how strict to be: block the worst outright, and add a captcha or a rate limit for the rest.

What you get for each IP

Reputation score, number of reports and reporters, attack categories, country, owning network and when it was last reported.

Always current

Addresses join when independent sources agree and drop off when the reports stop, so the list follows what is attacking servers now. Refresh it hourly.

Ready for your tools

Plain text, CSV, JSON, STIX 2.1, ipset, nftables, nginx, Apache and MikroTik, with filters for score, IP version and country.

Works where you need it

iptables and nftables, pfSense, OPNsense, MikroTik, Cloudflare, Splunk and many more.

A sample of today's list

The highest-scoring addresses right now. The full list comes with your free key.

Address	Score	Reports	Attack types	Network	Last seen
🇨🇱190.171.189.85	92	42	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	CTC. CORP S.A. (TELEFONICA E…	1 h
🇳🇱2.57.122.238	91	42	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control Database Attack HTTP Flood	UNMANAGED LTD	1 h
🇨🇭179.43.153.10	91	30	FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control Database Attack HTTP Flood	Private Layer INC	7 h
🇵🇰165.99.207.153	90	28	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Remote Code Execution Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	HEC	4 h
🇭🇰45.138.12.16	90	25	DNS Poisoning FTP Brute-Force Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Path Traversal / LFI Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	TC DATACENTER LIMITED	6 h
🇩🇪167.94.146.54	89	29	FTP Brute-Force Phishing Open Proxy Web Spam Email Spam Port Scan Hacking Spoofing Brute-Force Bad Web Bot Web App Attack SSH Mail Server Attack Vulnerability Scan Malware Distribution Command & Control HTTP Flood	Censys, Inc.	1 h
🇧🇩103.159.2.113	89	33	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control Database Attack HTTP Flood	Bangladesh Research and Educ…	1 h
🇰🇷14.34.249.175	89	42	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	Korea Telecom	3 h
🇮🇩103.46.186.148	89	74	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	PT Air Lintas Komunikasi	4 h
🇳🇱45.156.128.63	88	32	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	NSEC - Sistemas Informaticos…	1 h

Start blocking known attackers today

Get your free API key

Need thresholds, formats and filters in detail? See the blacklist reference.

Questions

Is the blacklist really free?

Yes. A free account costs nothing, needs no credit card, and lets you download the full list up to 10 times per 24 hours to protect your own systems or those you manage for your employer or clients.

How do I get a free API key?

Enter your email address on the sign-in page, click the link we send you and answer two quick questions. There is no password. Your key is created straight away and stays on your account page.

Where can I get a list of malicious IP addresses?

Right here. Sign in for a free API key, then download the list as plain text, CSV, JSON, STIX, or ready-made rules for ipset, nftables, nginx, Apache and MikroTik.

What is an IP reputation score?

A number from 0 to 100 that says how confident we are that an address is abusive right now, based on recent reports and threat feeds. The default list holds addresses scoring 75 or more.

How often is the list updated?

Continuously, as reports come in and older ones fade. Downloading it hourly is plenty.

Can I use the list in my own product or resell it?

Not on a free account. Building it into a product, resale and redistribution need an Enterprise licence; see the Pricing page.