Threat Intelligence — Open access

DenyGrid community blocklist

Threat intelligence shared across the entire DenyGrid network. Thousands of malicious IP addresses detected in real time, exportable in 8 formats to protect your infrastructure.

24,2k
Active banned IPs
82,3k
External blocklist IPs
119
Countries covered
34.2
Average score

Download the blocklist

Ready-to-use formats for your firewalls, reverse proxies and routers. No registration required.

Plain text
One IP per line — universal
JSON
IP + reason + score + dates
CSV
Spreadsheet / SIEM import
iptables
Ready-to-run DROP rules
Nginx deny
deny block for nginx.conf
Apache deny
Require not ip for .htaccess
MikroTik
RouterOS address-list
pfSense
IP/32 — alias table

Integration examples

Integrate the DenyGrid blocklist in a few lines. Automatic update recommended every 5 minutes.

Crontab — automatic update

# Update every 5 minutes */5 * * * * curl -sS https://www.denygrid.com/api/blocklist_export.php?format=plain_text&scope=community -o /etc/denygrid-blocklist.txt

iptables — blocking script

#!/bin/bash # Flush the old chain and recreate it iptables -F DENYGRID 2>/dev/null || iptables -N DENYGRID iptables -D INPUT -j DENYGRID 2>/dev/null iptables -A INPUT -j DENYGRID # Load the IPs while IFS= read -r ip; do iptables -A DENYGRID -s "$ip" -j DROP done < /etc/denygrid-blocklist.txt

Nginx — config include

# nginx.conf — inside the http {} or server {} block include /etc/nginx/denygrid-blocklist.conf; # Generate the file (cron): curl -sS https://www.denygrid.com/api/blocklist_export.php?format=nginx_deny&scope=community \ -o /etc/nginx/denygrid-blocklist.conf && nginx -s reload

Fail2ban — external jail

# /etc/fail2ban/jail.d/denygrid.conf [denygrid] enabled = true filter = denygrid banaction = iptables-allports logpath = /var/log/denygrid-sync.log maxretry = 1 # Sync script: download the list and log new IPs curl -sS https://www.denygrid.com/api/blocklist_export.php?format=plain_text&scope=community | \ while read ip; do echo "$(date) DenyGrid ban $ip" >> /var/log/denygrid-sync.log; done

Apache — .htaccess or VirtualHost

# Generate the file (cron): curl -sS https://www.denygrid.com/api/blocklist_export.php?format=apache_deny&scope=community \ -o /etc/apache2/denygrid-blocklist.conf && apachectl graceful # In the VirtualHost: Include /etc/apache2/denygrid-blocklist.conf

Top 10 attacking countries

Geographic distribution of banned IPs

CN
1,1k IPs
US
897 IPs
GB
405 IPs
CA
340 IPs
SG
334 IPs
FR
276 IPs
IN
201 IPs
DE
197 IPs
HK
186 IPs
NL
185 IPs

Top attacking AS

Most malicious autonomous systems

AS Name Score IPs
AS135377 AS135377 UCLOUD INFORMATION TECHNOL 99 255
AS197170 AS197170 TechTies Inc. 90 353
AS202412 AS202412 Omegatech LTD 90 142
AS136907 AS136907 HUAWEI CLOUDS 89 130
AS63949 AS63949 Akamai Connected Cloud 88 78
AS56046 AS56046 China Mobile communications 85 183
AS137718 AS137718 Beijing Volcano Engine Tec 85 110
AS4837 AS4837 CHINA UNICOM China169 Backbo 84 503
AS47890 AS47890 UNMANAGED LTD 82 130
AS24086 AS24086 Viettel Corporation 81 80

Frequently asked questions

Everything about the community blocklist

What is this list?
It is a list of IP addresses detected as malicious by all the machines in the DenyGrid network. Each IP was identified following real intrusion attempts (SSH brute-force, HTTP scans, exploits, etc.).
How often is it updated?
The list is updated continuously. The API cache is 5 minutes, so downloading every 5 minutes guarantees you the freshest data.
Can I use it in production / for commercial purposes?
Yes. The community blocklist is distributed under the Creative Commons BY 4.0 license. You may freely integrate it into your scripts, firewalls and products, provided you credit DenyGrid as the source.
Is there a rate limit?
Public access is limited to 60 requests per hour per IP. For heavy use, sign up and use an API key (10 requests/minute, advanced filters, custom whitelist).
How do I report a false positive?
Sign in to the DenyGrid dashboard and use the whitelist feature to exclude an IP. If you don't have an account, contact the instance administrator.
What's the difference with CrowdSec or AbuseIPDB?
DenyGrid is self-hosted: your data stays with you. The community blocklist is fed by the machines in your network, not by a third party. You keep full control over the ban criteria.

Contribute to the network

Install a DenyGrid agent on your servers to feed the community blocklist. The bigger the network, the faster and more accurate the detection.

Join DenyGrid