Threat Intelligence — Open access

DenyGrid community blocklist

Threat intelligence shared across the entire DenyGrid network. Thousands of malicious IP addresses detected in real time, exportable in 8 formats to protect your infrastructure.

42,9k
Active banned IPs
80,6k
External blocklist IPs
126
Countries covered
32.2
Average score

Download the blocklist

Ready-to-use formats for your firewalls, reverse proxies and routers. No registration required.

Plain text
One IP per line — universal
JSON
IP + reason + score + dates
CSV
Spreadsheet / SIEM import
iptables
Ready-to-run DROP rules
Nginx deny
deny block for nginx.conf
Apache deny
Require not ip for .htaccess
MikroTik
RouterOS address-list
pfSense
IP/32 — alias table

Integration examples

Integrate the DenyGrid blocklist in a few lines. Automatic update recommended every 5 minutes.

Crontab — automatic update

# Update every 5 minutes */5 * * * * curl -sS https://www.denygrid.com/api/blocklist_export.php?format=plain_text&scope=community -o /etc/denygrid-blocklist.txt

iptables — blocking script

#!/bin/bash # Flush the old chain and recreate it iptables -F DENYGRID 2>/dev/null || iptables -N DENYGRID iptables -D INPUT -j DENYGRID 2>/dev/null iptables -A INPUT -j DENYGRID # Load the IPs while IFS= read -r ip; do iptables -A DENYGRID -s "$ip" -j DROP done < /etc/denygrid-blocklist.txt

Nginx — config include

# nginx.conf — inside the http {} or server {} block include /etc/nginx/denygrid-blocklist.conf; # Generate the file (cron): curl -sS https://www.denygrid.com/api/blocklist_export.php?format=nginx_deny&scope=community \ -o /etc/nginx/denygrid-blocklist.conf && nginx -s reload

Fail2ban — external jail

# /etc/fail2ban/jail.d/denygrid.conf [denygrid] enabled = true filter = denygrid banaction = iptables-allports logpath = /var/log/denygrid-sync.log maxretry = 1 # Sync script: download the list and log new IPs curl -sS https://www.denygrid.com/api/blocklist_export.php?format=plain_text&scope=community | \ while read ip; do echo "$(date) DenyGrid ban $ip" >> /var/log/denygrid-sync.log; done

Apache — .htaccess or VirtualHost

# Generate the file (cron): curl -sS https://www.denygrid.com/api/blocklist_export.php?format=apache_deny&scope=community \ -o /etc/apache2/denygrid-blocklist.conf && apachectl graceful # In the VirtualHost: Include /etc/apache2/denygrid-blocklist.conf

Top 10 attacking countries

Geographic distribution of banned IPs

CN
1,4k IPs
US
1,3k IPs
GB
868 IPs
FR
438 IPs
CA
372 IPs
SG
367 IPs
NL
234 IPs
HK
228 IPs
IN
223 IPs
DE
215 IPs

Top attacking AS

Most malicious autonomous systems

AS Name Score IPs
AS63949 AS63949 Akamai Connected Cloud 93 57
AS197170 AS197170 TechTies Inc. 90 431
AS135377 AS135377 UCLOUD INFORMATION TECHNOL 90 242
AS136907 AS136907 HUAWEI CLOUDS 90 117
AS206092 AS206092 F.N.S. HOLDINGS LIMITED 87 857
AS202412 AS202412 Omegatech LTD 85 162
AS16276 AS16276 OVH SAS 83 2,3k
AS8075 AS8075 Microsoft Corporation 82 374
AS396982 AS396982 Google LLC 81 1,5k
AS14061 AS14061 DigitalOcean, LLC 79 138

Frequently asked questions

Everything about the community blocklist

What is this list?
It is a list of IP addresses detected as malicious by all the machines in the DenyGrid network. Each IP was identified following real intrusion attempts (SSH brute-force, HTTP scans, exploits, etc.).
How often is it updated?
The list is updated continuously. The API cache is 5 minutes, so downloading every 5 minutes guarantees you the freshest data.
Can I use it in production / for commercial purposes?
Yes. The community blocklist is distributed under the Creative Commons BY 4.0 license. You may freely integrate it into your scripts, firewalls and products, provided you credit DenyGrid as the source.
Is there a rate limit?
Public access is limited to 60 requests per hour per IP. For heavy use, sign up and use an API key (10 requests/minute, advanced filters, custom whitelist).
How do I report a false positive?
Sign in to the DenyGrid dashboard and use the whitelist feature to exclude an IP. If you don't have an account, contact the instance administrator.
What's the difference with CrowdSec or AbuseIPDB?
DenyGrid is self-hosted: your data stays with you. The community blocklist is fed by the machines in your network, not by a third party. You keep full control over the ban criteria.

Contribute to the network

Install a DenyGrid agent on your servers to feed the community blocklist. The bigger the network, the faster and more accurate the detection.

Join DenyGrid