IP blacklist download formats: JSON, CSV, STIX, ipset and more
The isipsafe blacklist comes in 9 formats, including plain text, CSV, JSON and STIX 2.1, plus ready-made rules for firewalls and web servers. Choose one by adding format= to the download URL.
curl -s "https://isipsafe.com/api/v1/blocklist?key=YOUR_KEY&format=json"format | Best for | Guide |
|---|---|---|
txt | One address per line, for scripts and most tools | curl |
csv | Spreadsheets and lookup tables, with extra columns | Splunk |
json | Your own code | Python |
stix | Threat intelligence platforms, as STIX 2.1 | OpenCTI |
ipset | Linux firewalls using ipset | Linux firewall |
nftables | Linux firewalls using nftables | Linux firewall |
nginx | Deny rules for nginx | nginx |
apache | Deny rules for Apache | Apache |
mikrotik | RouterOS address lists | MikroTik |
Filters
confidenceMinimum: the lowest score to include, from 1 to 100. The default is 75.ipVersion:4or6.onlyCountriesandexceptCountries: filter by two-letter country code.limit: the most addresses to return.
How often to refresh
A free account allows 10 downloads per 24 hours, so refreshing every three hours stays within the limit. Replace the old list on each refresh, because addresses also leave it as reports stop.
The blacklist reference has current sizes at each score.