blocklist-abuseipdb

Lists with worst IPv4 & IPv6 offenders (~99% confidence), provided by AbuseIPDB (with permission).

• Lists are updated multiple times per day.
• The repository is continously squashed to keep down size.

Extra Features

• Statistics
• Hall of Shame ip lists with aggressive /24 subnets - i.e 1 2 3
• ASN Database from ipinfo.io is used to decorate all IPs with metadata
• Selfhosted honeypot integration with verified abuse score (to get those pesky ~90% confidence offenders)
• Smart heuristic-based detection of aggressive /24 subnets

Disclaimer:

#1 This repository is using the "free forever" plan (5 fetches per day + 1000 ip lookups), but also aggregates the data from multiple publicly free & legal sources (also with free plan) to create a larger iplist.

#2 All credits goes to AbuseIPDB. Please support them. Seriously!

#3 Use ip-blocking with caution. Firewalls should preferably use rules on the incoming WAN side

#4 Recommended usage is the maximum 30 days or less to avoid false positives.

#5 Do not use the abuseipdb-s100-all.ipv4. It is only exposed for statistical usage.

#6 Regarding naming: s100 means ~100% confidence lists.

#7 IPv6 blocking is almost useless.

Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

Source: AbuseIPDB

Last check: 2026-01-10 - 17:05:08 (UTC)

❯ abuseipdb-s100-1d (66880 ips)
❯ abuseipdb-s100-3d (70299 ips)
❯ abuseipdb-s100-7d (79560 ips)
❯ abuseipdb-s100-14d (95474 ips)
❯ abuseipdb-s100-30d (130483 ips)
❯ abuseipdb-s100-60d (184394 ips)
❯ abuseipdb-s100-90d (240906 ips)
❯ abuseipdb-s100-120d (294969 ips)
❯ abuseipdb-s100-180d (466606 ips)
❯ abuseipdb-s100-365d (1177107 ips)
❯ abuseipdb-s100-all (1927852 ips)