Free IP blacklist

A blocklist of IP addresses reported for attacks, scanning and spam by people who run servers. Updated continuously, free with an account, and ready to drop into your firewall, web server or SIEM.

1,961addresses on the default list (75+)

2with a score of 90 or more

0IPv6 addresses on the default list

1 minsince these figures were updated

Pick a threshold

Every address has a confidence score from 0 to 100, built from independent reports in the last 30 days. Choose how strict to be with confidenceMinimum:

Min. score	Addresses	Good for
100	0	The most certain attackers only; safe for anything, including mail and VPN logins
90	2	Firewalls and routers with limited room for entries
75 (default)	1,961	Blocking SSH, RDP, admin panels and APIs
50	34,244	Captchas, rate limits and extra checks rather than blocking
25	88,276	Enrichment and alerting in a SIEM

Download it

Download the list in the format your tool reads:

# one address per line
curl -s "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=txt"
# with scores, countries and categories
curl -s "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=csv&confidenceMinimum=90"
# ready-to-load firewall rules
curl -s "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=ipset" | sudo ipset restore

Refresh it hourly from cron, or point a firewall alias at the URL so it refreshes itself.

Formats: txt, csv, json, stix (2.1), ipset, nftables, nginx, apache and mikrotik. Filter with ipVersion, onlyCountries, exceptCountries and limit. The API reference has the details, and the same list is at /api/v2/blacklist in AbuseIPDB's format.

Use it with

iptables and nftables · pfSense · OPNsense · MikroTik · FortiGate · Palo Alto · Cloudflare · AWS WAF · nginx · CrowdSec · all integrations

Top of the list right now

The 50 highest-scoring addresses on today's list. The full list is in the download.

Address	Score	Reports	Attack types	Network	Last seen
🇨🇱190.171.189.85	92	31	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	CTC. CORP S.A. (TELEFONICA E…	3 min
🇳🇱2.57.122.238	91	32	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control Database Attack HTTP Flood	UNMANAGED LTD	3 min
🇦🇩45.148.10.121	88	75	DNS Poisoning Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	TECHOFF SRV LIMITED	3 min
🇪🇬62.193.91.121	88	21	DNS Poisoning Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	ETISALAT MISR	3 min
🇧🇬80.94.95.109	88	41	DNS Poisoning Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	SS-Net	3 min
🇨🇭179.43.153.10	88	23	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control Database Attack HTTP Flood	Private Layer INC	3 min
🇧🇩160.25.5.60	87	18	DNS Poisoning Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	Server Anywhere	3 min
🇧🇷201.63.223.142	87	19	DNS Poisoning Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	TELEFÔNICA BRASIL S.A	3 min
🇺🇸129.121.124.39	87	19	DNS Poisoning Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	Oracle Corporation	3 min
🇮🇩180.247.59.235	87	18	DNS Poisoning Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	Telekomunikasi Indonesia (PT…	3 min
🇲🇽189.143.68.240	87	11	DNS Poisoning Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	Uninet S.A. de C.V.	3 min
🇮🇩43.129.56.70	87	21	DNS Poisoning Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	Shenzhen Tencent Computer Sy…	3 min
🇺🇸96.78.175.45	87	17	DNS Poisoning Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	Comcast Cable Communications…	3 min
🇰🇷14.34.249.175	87	32	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	Korea Telecom	3 min
🇸🇬58.182.58.128	87	31	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	Starhub Internet Pte Ltd	3 min
🇨🇳116.52.252.150	86	24	DNS Poisoning Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	Chinanet	3 min
🇬🇧217.60.242.61	86	23	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	Amin NezhadKahnoji	3 min
🇲🇦81.192.46.49	86	20	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control	Itissalat Al-MAGHRIB	3 min
🇨🇲102.244.97.185	86	22	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	Orange Cameroun SA	3 min
🇮🇩103.46.186.148	86	66	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	PT Air Lintas Komunikasi	3 min
🇩🇪77.90.185.20	86	24	DNS Poisoning Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	Limited Network LTD	3 min
🇭🇰152.32.225.117	86	28	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	UCLOUD INFORMATION TECHNOLOG…	3 min
🇦🇩45.148.10.240	86	31	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control Database Attack HTTP Flood	TECHOFF SRV LIMITED	3 min
🇧🇷191.249.229.125	86	17	DNS Poisoning Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	TELEFÔNICA BRASIL S.A	9 h
🇩🇪165.154.164.24	85	21	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	UCLOUD INFORMATION TECHNOLOG…	3 min
🇨🇳27.29.116.137	85	24	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	Chinanet	3 min
🇧🇩45.64.134.75	85	29	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	Aamra Networks Limited	3 min
🇺🇸129.121.141.21	85	18	DNS Poisoning Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	Oracle Corporation	3 min
🇳🇱45.156.128.63	85	24	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	NSEC - Sistemas Informaticos…	3 min
🇳🇱45.156.128.76	85	28	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	NSEC - Sistemas Informaticos…	3 min
🇨🇳8.138.154.105	85	28	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	Hangzhou Alibaba Advertising…	3 min
🇨🇳8.138.155.88	85	30	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	Hangzhou Alibaba Advertising…	3 min
🇳🇱80.94.92.234	85	20	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Command & Control	UNMANAGED LTD	3 min
🇺🇸96.78.175.36	85	18	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control	Comcast Cable Communications…	3 min
🇨🇳202.107.164.66	85	24	DNS Poisoning Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	Chinanet	3 min
🇺🇸50.221.56.52	85	27	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	Comcast Cable Communications…	3 min
🇻🇳103.159.51.70	85	25	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	NhanHoa Software company	3 min
🇭🇰107.150.123.48	85	23	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	UCLOUD INFORMATION TECHNOLOG…	3 min
🇭🇰119.28.84.193	85	26	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	Shenzhen Tencent Computer Sy…	3 min
🇺🇸152.32.236.102	85	29	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	UCLOUD INFORMATION TECHNOLOG…	3 min
🇮🇩163.7.1.156	85	25	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	Byteplus Pte. Ltd.	3 min
🇪🇹196.189.236.67	85	29	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	EthioNet	3 min
🇺🇸38.148.20.75	85	25	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	Sumofiber	3 min
🇳🇱80.82.77.139	85	26	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Email Spam Port Scan Hacking SQL Injection Spoofing Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Mail Server Attack Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	IP Volume inc	4 min
🇦🇩193.47.62.69	84	63	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Command & Control	BestDC Limited	3 min
🇦🇩195.178.110.30	84	50	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Command & Control	TECHOFF SRV LIMITED	3 min
🇺🇸20.127.185.37	84	20	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Command & Control	Microsoft Corporation	3 min
🇳🇱20.71.254.235	84	19	Web Spam Port Scan Hacking Brute-Force Bad Web Bot Web App Attack SSH Vulnerability Scan Command & Control	Microsoft Corporation	3 min
🇨🇳8.134.159.4	84	27	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	Hangzhou Alibaba Advertising…	3 min
🇭🇰118.26.37.246	84	19	DNS Poisoning Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	UCLOUD INFORMATION TECHNOLOG…	3 min

Questions

Is the IP blacklist free?

Yes. Create a free account to get an API key, and download the list up to 10 times a day. Enterprise plans have no limit and allow redistribution.

How is an address added to the blacklist?

Addresses are reported by people who run servers. An address joins the default list when its confidence score reaches 75, which takes several independent reports within 30 days. It leaves again when the reports stop and the score decays.

What if my IP address is on the list?

Look it up to see the reports and their comments. If the address was cleaned up or is shared infrastructure, contact us with the details and a person reviews it.

How often should I download it?

Hourly is plenty. Scores change slowly, and a firewall alias or cron job that refreshes every hour keeps you current.