Protect Your Web Server With a Live IP Blacklist
The ReportedIP community tracks 720,103 IP addresses across 6.59 million abuse reports, with 53,426 IPs currently rated as active threats (September 7, 2026). The dynamic blacklist distills that data into firewall-ready block lists, regenerated server-side every 15 minutes, and one query parameter splits it into five port-scoped lists: SSH, mail, web, FTP, and network edge.
The full walkthrough with cron and ipset scripts is in the blacklist documentation.
Why a live blacklist beats a static blocklist file
Static blocklists age badly. Attackers rotate through cloud providers and botnets, so an IP that ran SSH brute-force attacks in June is often a legitimate customer of the same hosting company by August. A list downloaded once and left in place keeps blocking the wrong people while missing the current wave.
The ReportedIP dynamic blacklist rebuilds every 15 minutes from live community reports. Honeypot servers, WordPress sites running the Hive plugin, and fail2ban installations feed abuse reports into a scoring pipeline, and only IPs above your chosen confidence threshold make it onto the list you pull. When an attacker goes quiet, decay pulls the score down and the IP drops off on its own. No manual review, no stale entries from last quarter.
How the confidence score keeps the list clean
Every IP on the list carries a confidence score from 0 to 100. The score is computed from four base components plus a honeypot bonus:
- Report volume (up to 30 points): the weighted number of reports against the IP.
- Reporter diversity (up to 15 points): reports from independent sources count for more. One noisy reporter cannot push an IP past a score of 60 on its own.
- Recency (up to 15 points): a report from the last 24 hours adds 5 points, one from the last week adds 3, older reports add less.
- Severity (up to 15 points): weighted by threat category, so an exploited host scores differently than a comment spammer.
- Honeypot bonus (up to 25 points): reports from high-interaction honeypots carry extra weight because no legitimate user ever touches a honeypot.
Old reports decay exponentially with a 30-day half-life: a report is worth 50 percent of its weight after 30 days and 25 percent after 60. On top of that, hard constraints cap the score: an IP with fewer than 5 effective reports can never exceed 49, and fewer than 10 reports caps it at 74. The recommended blocking threshold of 90 therefore requires sustained, recent abuse confirmed by at least two independent reporters. Known search engine and monitoring crawlers are excluded server-side before the list is built.
Why one block list per service beats one giant list
Every report carries threat category IDs. Valid IDs run from 1 to 63: classic categories like SSH Brute-Force (22) and Email Spam (11), a dedicated WordPress block (31 to 58) covering login and XML-RPC brute force, plugin exploits, comment spam, and backdoor scanning, and honeypot-only categories (59 to 63). The category parameter on GET /blacklist accepts a comma-separated list of those IDs, so each exposed service gets exactly the attackers that target it.
| List | Categories | Applied to | Size (July 21, 2026) |
|---|---|---|---|
| SSH | 22,18 | Port 22 | 5,141 IPs |
11,7,17,18 | Ports 25, 465, 587, 110, 143, 993, 995 | 2,784 IPs | |
| Web | 21,16,10,19,12 + WP block 31–58 | Ports 80, 443 | 3,666 IPs |
| FTP | 5,18 | Port 21 | 2,580 IPs |
| Edge | 4,14,20 | All ports | 5,920 IPs |
Port-scoped sets keep mistakes cheap: an IP on the web list can never lock an admin out of SSH. The edge list (DDoS, port scans, exploited hosts) is the only one worth applying to all ports, because those attackers probe everything.
How to pull a list and block it in five minutes
Blacklist access starts at the Contributor tier, which is free. One authenticated GET per service list returns plain text, one IP per line, IPv4 and IPv6 mixed:
curl -H "X-Key: YOUR_API_KEY" \
"https://reportedip.com/wp-json/reportedip/v2/blacklist?confidence=90&format=txt&limit=50000&category=22,18" \
| while read ip; do ipset add rip-ssh "$ip" -exist; done
iptables -I INPUT -p tcp --dport 22 -m set --match-set rip-ssh src -j DROPOn modern distributions, nftables sets replace ipset with the same pattern:
nft add set inet filter rip-ssh '{ type ipv4_addr; flags interval; }'
nft add rule inet filter input tcp dport 22 ip saddr @rip-ssh dropLoad the downloaded list into the set with nft add element, or use the atomic-swap update script from the network-level blocking guide, which also covers IPv6 sets and cloud firewalls. Two safety rules before the first run: whitelist your own management IPs in a separate set that is matched first, and never replace a working set with a truncated download. The reference script refuses any response with fewer than 1,000 lines.
Keep the list fresh without burning quota
An hourly cron per list is plenty. The endpoint returns an ETag with every response; store it and send it back as If-None-Match, and an unchanged list answers with 304 Not Modified and an empty body. Repeat polls cost almost nothing on either side.
Blacklist pulls are feature-gated but do not count against your daily check or report quota, so polling frequency is a caching decision, not a budget decision. ETags are specific to the exact parameter combination you request, so keep one stored tag per list. Parameters and response formats are documented in the API reference. Mail operators who prefer DNS lookups over list syncing can query the same data as a private RBL zone.
Report attackers back with fail2ban
Blocking is half the loop. A small fail2ban action posts every ban on your server to POST /report with the matching threat category per jail: sshd bans arrive as category 22, Postfix bans as category 11, nginx bans as category 21. Reports charge only your daily report quota, never the check quota.
The payoff is direct. Your report raises the attacker’s confidence score for everyone, and because scores need at least two independent reporters to pass 60, your confirmation is often the report that pushes a borderline IP over the blocking threshold. The ready-made action config and the jail-to-category mapping table are in the fail2ban integration guide. WordPress sites get the same loop without touching the shell: the Hive plugin monitors logins, comments, and XML-RPC, and reports confirmed attacks automatically.
What about false positives
Three mechanisms limit collateral damage. First, the score constraints above mean a single misconfigured reporter cannot blacklist an IP by itself. Second, the 30-day half-life removes reformed IPs automatically instead of waiting for someone to notice. Third, a server-side whitelist covers known infrastructure such as search engine crawlers and major monitoring services before the list is generated.
If one of your own IPs ever lands on the list, the delisting process resolves it: reports against an IP stop counting once the abuse stops, and manual review handles disputed cases. On your side, running the first week with logging instead of dropping (fail2ban calls this a dry run, the Hive plugin calls it report-only mode) shows you exactly what would have been blocked before anything is.
Frequently asked questions
How many IPs are on the ReportedIP blacklist?
The database tracks 720,103 reported IPs, of which 53,426 are currently rated as active threats (September 7, 2026). How many you pull depends on your filters: confidence=90 with a service category typically returns between 2,500 and 6,000 IPs per list, and the limit parameter accepts values up to 50,000.
How often should I update the blacklist?
Hourly per list. The server regenerates lists every 15 minutes, but with ETag revalidation an hourly cron catches every meaningful change at near-zero cost. Pulls do not count against any daily quota.
What confidence score should I use for automated blocking?
Use 90. The endpoint defaults to 75, which is fine for alerting or rate limiting, but a score of 90 or higher requires at least 10 effective reports from 2 or more independent reporters with recent activity. That is the threshold where automated dropping is safe.
Can the blacklist lock me out of my own server?
Not if you follow two rules: keep your management IPs in a whitelist set that the firewall checks before the block set, and apply each list only to its own ports. An entry on the web list then cannot affect your SSH session even in the worst case.
Does the blacklist include IPv6 addresses?
Yes. The plain-text format returns IPv4 and IPv6 addresses mixed, one per line. Use separate ipset or nftables sets per address family; the firewall guide shows the two-set pattern.
What does blacklist access cost?
Nothing to start. Blacklist access begins at the Contributor tier, which is free and requires no credit card. Higher tiers raise daily check and report quotas for other endpoints; the blacklist itself is not metered.
Start with the free tier
- Create a free account, blacklist access starts at the Contributor tier, no credit card
- Blacklist documentation, service lists, formats, auto-update script
- fail2ban integration, report your bans back to the community