Blacklist

The ReportedIP blacklist is a community-driven list of malicious IP addresses, generated automatically from real-world attack reports and available via API and GitHub. Use it to block known malicious IPs in your firewall, web server, or application. There is no manual review: the API list is rebuilt continuously from the current scores, and the GitHub export is refreshed once a day.

How the blacklist is generated

Every IP in the blacklist comes from community reports that hit our reputation engine. An IP is included only when:

• Its confidence score reaches the threshold (computed from report frequency, source diversity, severity, and recency). Via the API you choose it with confidence; the GitHub export uses ≥ 75 %
• GitHub export only: its first report is at least 48 hours old (false-positive cool-down, a new address enters the export only once its score has had time to settle, and then stays as long as its score holds)
• It is not on the whitelist (search engines, CDN providers, known-good infrastructure are excluded)

Both lists are built automatically, there is no manual editorial review. Scores follow new reports and age with time, so an address that goes quiet loses score and drops out again. The whole pipeline is open and transparent. Without a key, the DNSBL Blacklist Check shows the status of any address; with one you can verify any entry via GET /reportedip/v2/check?ip=<ip>&verbose=true to see the exact score breakdown.

GitHub Repository

The full blacklist is published as a public GitHub repository, rebuilt once a day from the current scores. A new address appears there 48 hours after its first report (the false-positive cool-down described above) and stays for as long as it remains active. The wait applies only to new addresses: one that dropped out and is lifted back to 75 by new reports returns with the next daily snapshot. You can clone it, use it in CI/CD pipelines, or integrate it into your infrastructure.

github.com/reportedip/reportedip-blacklist

Repository Structure

reportedip-blacklist/
├── blacklist-all.txt       # All IPs, one per line
├── blacklist-all.json      # All IPs with metadata
├── blacklist-all.csv       # All IPs, CSV format
├── metadata.json           # Export metadata (version, counts, timestamps)
├── lists/                  # Thematic sub-lists
│   ├── spam.txt
│   ├── brute-force.txt
│   ├── cms-login.txt
│   ├── web-attacks.txt
│   ├── malware.txt
│   ├── ddos.txt
│   ├── fraud.txt
│   ├── infrastructure.txt
│   └── apt.txt
└── formats/                # Ready-to-include firewall snippets
    ├── nginx-deny.conf
    ├── apache-htaccess.txt
    └── iptables.sh

File Formats

TXT Format

Plain text, one IP address per line. Lines starting with # are comments containing metadata such as generation time and total count.

# ReportedIP Blacklist - All IPs
# https://reportedip.com
#
# Copyright (c) 2026 ReportedIP / Patrick Schlesinger
# Licensed under CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/
#
# Daily snapshot. New addresses appear 48 hours after their first report.
# For real-time threat intelligence via API, contact: 1@reportedip.com
#
# Generated: 2026-07-22
# Total IPs: 12847
#
1.2.3.4
5.6.7.8
9.10.11.12

JSON Format

A meta block (export version, counts, generation timestamp) followed by an entries array. categories are numeric threat-category IDs, resolve them against the threat-category catalogue or GET /categories.

{
  "meta": {
    "version": "2026-07-22",
    "generatedAt": "2026-07-22T00:00:00Z",
    "totalCount": 12847
  },
  "entries": [
    {
      "ip": "1.2.3.4",
      "confidence": 95,
      "categories": [18, 21],
      "source": "dynamic"
    },
    {
      "ip": "5.6.7.8",
      "confidence": 82,
      "categories": [14],
      "source": "dynamic"
    }
  ]
}

CSV Format

Comma-separated values with a header row. Easy to import into spreadsheets, databases, or SIEM tools. categories holds semicolon-separated numeric category IDs.

ip,confidence,categories,last_reported
1.2.3.4,95,"18;21","2026-07-19 14:22:00"
5.6.7.8,82,"14","2026-07-18 09:15:00"
9.10.11.12,78,"21","2026-07-17 20:45:00"

Firewall Integration

Use the blacklist files to block malicious IPs at the firewall or web server level. Below are integration examples for common tools.

Nginx

Generate a blocklist config and include it in your Nginx server block:

# Generate Nginx blocklist from TXT file
awk '{print "deny " $1 ";"}' blacklist-all.txt > /etc/nginx/blocklist.conf

# /etc/nginx/sites-enabled/default
server {
    include /etc/nginx/blocklist.conf;

    # ... rest of your config
}

Apache (.htaccess)

# .htaccess: Block reported IPs
<RequireAll>
    Require all granted
    Require not ip 1.2.3.4
    Require not ip 5.6.7.8
    Require not ip 9.10.11.12
</RequireAll>

iptables (via ipset)

Load the list into an ipset and match that set from a single rule. One rule per IP would mean thousands of rules traversed for every packet; a set lookup stays constant no matter how large the list gets.

# Create the set and fill it in one pass (IPv4 entries only)
ipset create rip-block hash:ip family inet maxelem 65536 -exist
grep -E '^[0-9]+(\.[0-9]+){3}$' blacklist-all.txt \
  | sed 's|^|add rip-block |' | ipset restore -exist

# One rule blocks the whole set
iptables -I INPUT -m set --match-set rip-block src -j DROP

IPv6 needs its own set (family inet6) and its own ip6tables rule, see Network-Level Blocking for the full script including nftables, per-service sets, and the hourly sync.

API Access

The /blacklist endpoint provides real-time access to the full blacklist with filtering options. An API key with the threat-feed feature (Contributor tier and up) is required. The endpoint is feature-gated and does not count against your daily check or report quota, poll it as often as your caching strategy needs. See Authentication & Rate Limits for tiers and keys.

The endpoint takes format, confidence, category and limit. Each one is documented with its default and its accepted values in the API Reference.

curl -H "X-Key: YOUR_API_KEY" \
     "https://reportedip.com/wp-json/reportedip/v2/blacklist?format=txt&confidence=90&limit=50000"

See the API Reference for full endpoint documentation, response format, and additional parameters.

Service-specific blacklists

Combine the category filter with confidence=90 to build one block list per exposed service. Each list only contains IPs that were reported for the matching attack type, so you can apply it port-scoped, an IP on the web list never locks anyone out of SSH.

# SSH attackers only, plain text for ipset/nftables
curl -H "X-Key: YOUR_API_KEY" \
     "https://reportedip.com/wp-json/reportedip/v2/blacklist?confidence=90&format=txt&limit=50000&category=22,18"

Send the stored ETag back as If-None-Match; unchanged lists answer with 304 Not Modified, which costs no quota. The polling rhythm and the case of a stale tag are covered under Network-Level Blocking. Valid category IDs run from 1 to 63: IDs 31–58 are the dedicated WordPress block that the web list above includes, IDs 59–63 come from high-interaction honeypots. Full catalogue: Threat Categories.

A cron job that downloads the list and reloads the firewall belongs with the rest of the network setup: the sync script under Network-Level Blocking fetches conditionally, swaps the set atomically, refuses a truncated download and handles IPv6, all of which a short download-and-replace script does not.

Real-time vs. GitHub

Last updated: 29. September 2026 · Maintained by the ReportedIP team