Blacklist

The ReportedIP blacklist is a community-driven list of malicious IP addresses, generated automatically from real-world attack reports and available via API and GitHub. Use it to block known malicious IPs in your firewall, web server, or application, it refreshes daily without manual review.

How the blacklist is generated

Every IP in the blacklist comes from community reports that hit our reputation engine. An IP is included only when:

• Its confidence score is ≥ 75 % (computed from report frequency, source diversity, severity, and recency)
• Its most recent report is at least 48 hours old (false-positive cool-down, entries only enter the export once the score has had time to recalibrate)
• It is not on the whitelist (search engines, CDN providers, known-good infrastructure are excluded)

The blacklist refreshes automatically, there is no manual editorial review. The whole pipeline is open and transparent. Without a key, the DNSBL Blacklist Check shows the status of any address; with one you can verify any entry via GET /reportedip/v2/check?ip=<ip>&verbose=true to see the exact score breakdown.

GitHub Repository

The full blacklist is published as a public GitHub repository, pushed daily from the live API data. The exported data itself is delayed by 48 hours (the false-positive cool-down described above). You can clone it, use it in CI/CD pipelines, or integrate it into your infrastructure.

github.com/reportedip/reportedip-blacklist

Repository Structure

reportedip-blacklist/
├── blacklist-all.txt       # All IPs, one per line
├── blacklist-all.json      # All IPs with metadata
├── blacklist-all.csv       # All IPs, CSV format
├── metadata.json           # Export metadata (version, counts, timestamps)
├── lists/                  # Thematic sub-lists
│   ├── spam.txt
│   ├── brute-force.txt
│   ├── cms-login.txt
│   ├── web-attacks.txt
│   ├── malware.txt
│   ├── ddos.txt
│   ├── fraud.txt
│   ├── infrastructure.txt
│   └── apt.txt
└── formats/                # Ready-to-include firewall snippets
    ├── nginx-deny.conf
    ├── apache-htaccess.txt
    └── iptables.sh

File Formats

TXT Format

Plain text, one IP address per line. Lines starting with # are comments containing metadata such as generation time and total count.

# ReportedIP Blacklist - All IPs
# https://reportedip.com
#
# Copyright (c) 2026 ReportedIP / Patrick Schlesinger
# Licensed under CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/
#
# IMPORTANT: Data is delayed by 48 hours.
# For real-time threat intelligence via API, contact: 1@reportedip.com
#
# Generated: 2026-07-22
# Total IPs: 12847
#
1.2.3.4
5.6.7.8
9.10.11.12

JSON Format

A meta block (export version, counts, generation timestamp) followed by an entries array. categories are numeric threat-category IDs, resolve them against the threat-category catalogue or GET /categories.

{
  "meta": {
    "version": "2026-07-22",
    "generatedAt": "2026-07-22T00:00:00Z",
    "totalCount": 12847
  },
  "entries": [
    {
      "ip": "1.2.3.4",
      "confidence": 95,
      "categories": [18, 21],
      "source": "dynamic"
    },
    {
      "ip": "5.6.7.8",
      "confidence": 82,
      "categories": [14],
      "source": "dynamic"
    }
  ]
}

CSV Format

Comma-separated values with a header row. Easy to import into spreadsheets, databases, or SIEM tools. categories holds semicolon-separated numeric category IDs.

ip,confidence,categories,last_reported
1.2.3.4,95,"18;21","2026-07-19 14:22:00"
5.6.7.8,82,"14","2026-07-18 09:15:00"
9.10.11.12,78,"21","2026-07-17 20:45:00"

Firewall Integration

Use the blacklist files to block malicious IPs at the firewall or web server level. Below are integration examples for common tools.

Nginx

Generate a blocklist config and include it in your Nginx server block:

# Generate Nginx blocklist from TXT file
awk '{print "deny " $1 ";"}' blacklist-all.txt > /etc/nginx/blocklist.conf

# /etc/nginx/sites-enabled/default
server {
    include /etc/nginx/blocklist.conf;

    # ... rest of your config
}

Apache (.htaccess)

# .htaccess: Block reported IPs
<RequireAll>
    Require all granted
    Require not ip 1.2.3.4
    Require not ip 5.6.7.8
    Require not ip 9.10.11.12
</RequireAll>

iptables (via ipset)

Load the list into an ipset and match that set from a single rule. One rule per IP would mean thousands of rules traversed for every packet; a set lookup stays constant no matter how large the list gets.

# Create the set and fill it in one pass (IPv4 entries only)
ipset create rip-block hash:ip family inet maxelem 65536 -exist
grep -E '^[0-9]+(\.[0-9]+){3}$' blacklist-all.txt \
  | sed 's|^|add rip-block |' | ipset restore -exist

# One rule blocks the whole set
iptables -I INPUT -m set --match-set rip-block src -j DROP

IPv6 needs its own set (family inet6) and its own ip6tables rule, see Network-Level Blocking for the full script including nftables, per-service sets, and the hourly sync.

API Access

The /blacklist endpoint provides real-time access to the full blacklist with filtering options. An API key with the threat-feed feature (Contributor tier and up) is required. The endpoint is feature-gated and does not count against your daily check or report quota, poll it as often as your caching strategy needs. See Authentication & Rate Limits for tiers and keys.

The endpoint takes format, confidence, category and limit. Each one is documented with its default and its accepted values in the API Reference.

curl -H "X-Key: YOUR_API_KEY" \
     "https://reportedip.com/wp-json/reportedip/v2/blacklist?format=txt&confidence=90&limit=50000"

See the API Reference for full endpoint documentation, response format, and additional parameters.

Service-specific blacklists

Combine the category filter with confidence=90 to build one block list per exposed service. Each list only contains IPs that were reported for the matching attack type, so you can apply it port-scoped, an IP on the web list never locks anyone out of SSH.

# SSH attackers only, plain text for ipset/nftables
curl -H "X-Key: YOUR_API_KEY" \
     "https://reportedip.com/wp-json/reportedip/v2/blacklist?confidence=90&format=txt&limit=50000&category=22,18"

Send the stored ETag back as If-None-Match; unchanged lists answer with 304 Not Modified, which costs no quota. The polling rhythm and the case of a stale tag are covered under Network-Level Blocking. Valid category IDs run from 1 to 63: IDs 31–58 are the dedicated WordPress block that the web list above includes, IDs 59–63 come from high-interaction honeypots. Full catalogue: Threat Categories.

A cron job that downloads the list and reloads the firewall belongs with the rest of the network setup: the sync script under Network-Level Blocking fetches conditionally, swaps the set atomically, refuses a truncated download and handles IPv6, all of which a short download-and-replace script does not.

Real-time vs. GitHub

Last updated: 20. September 2026 · Maintained by the ReportedIP team