Integrations

Report the attacks your servers already see, and block the worst addresses everywhere you can. Pick your tool for a step-by-step page. Most take a few minutes and one line of configuration.

curl -s "https://isipsafe.com/api/v1/report?key=YOUR_KEY" -d ip=203.0.113.50 -d categories=ssh,brute-force -d comment="sshd: 40 failed root logins"

Report attacks

Send the addresses that attack you to the shared list, automatically.

F2B fail2banReport every address fail2ban bans, from any jail, with one action file. SSH SSH servers (OpenSSH)Report password-guessing bots hitting sshd, with or without fail2ban. nginxReport scanners and exploit attempts from access logs, and block listed addresses at the web server. Apache HTTP ServerReport probes and injection attempts from Apache logs, and deny listed addresses. CaddyReport scanners found in Caddy's JSON access logs. TraefikReport scanners found in Traefik's JSON access logs. WordPressReport login floods with a tiny must-use plugin, or straight from the web server log. Pf PostfixReport SMTP AUTH brute force against your mail server. DovecotReport IMAP and POP3 password guessing. RDP Windows RDPReport Remote Desktop brute force from the Windows Security log with PowerShell. UFWReport port scanners from the Ubuntu firewall log. CSV Honeypots and bulk uploadUpload thousands of addresses at once from a honeypot or log export.

Block with the list

Pull the blocklist into the firewall or edge you already run.

Linux firewall (ipset, nftables)Drop listed addresses in the kernel with ipset and iptables, or nftables sets. MikroTik RouterOSKeep a RouterOS address list in sync and drop it in the raw table. pfSenseUse the list as a URL Table alias and block it on WAN. OPNsenseUse the list as a URL Table alias and block it on WAN. CloudflarePush the list into a Cloudflare IP List and block it with a WAF rule, before traffic reaches you.

Threat intelligence and SIEM

Use scores and the list inside your security tooling.

MISP MISPAdd the list as a MISP feed and correlate it with your events. CTI OpenCTIImport the list as STIX 2.1 indicators. SplunkEnrich searches with a lookup table of listed addresses and their scores. ElasticLoad the list into Elasticsearch and enrich events at ingest. GraylogLook up live scores from pipeline rules with an HTTP JSONPath data adapter.

From your own code

Check or report an address from any language.

curl and shellReport and check from any script or cron job. PythonCheck addresses at sign-up or login, and report abuse, with requests. Node.jsCheck and report with the built-in fetch. GoCheck and report with net/http, including a small middleware. PHPCheck and report from any PHP application.

Not listed?

Anything that can make an HTTP request can report to isipsafe. Start from the curl page or the API reference, and if you build something reusable, send it to us and we will add it here with credit.

Product names and logos are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.