Threat Intelligence — Open access

DenyGrid community blocklist

Threat intelligence shared across the entire DenyGrid network. Thousands of malicious IP addresses detected in real time, exportable in 8 formats to protect your infrastructure.

20,5k
Active banned IPs
81,5k
External blocklist IPs
106
Countries covered
33.7
Average score

Download the blocklist

Ready-to-use formats for your firewalls, reverse proxies and routers. No registration required.

Plain text
One IP per line — universal
JSON
IP + reason + score + dates
CSV
Spreadsheet / SIEM import
iptables
Ready-to-run DROP rules
Nginx deny
deny block for nginx.conf
Apache deny
Require not ip for .htaccess
MikroTik
RouterOS address-list
pfSense
IP/32 — alias table

Integration examples

Integrate the DenyGrid blocklist in a few lines. Automatic update recommended every 5 minutes.

Crontab — automatic update

# Update every 5 minutes */5 * * * * curl -sS https://bigbro.gergosnet.com/api/blocklist_export.php?format=plain_text&scope=community -o /etc/denygrid-blocklist.txt

iptables — blocking script

#!/bin/bash # Flush the old chain and recreate it iptables -F DENYGRID 2>/dev/null || iptables -N DENYGRID iptables -D INPUT -j DENYGRID 2>/dev/null iptables -A INPUT -j DENYGRID # Load the IPs while IFS= read -r ip; do iptables -A DENYGRID -s "$ip" -j DROP done < /etc/denygrid-blocklist.txt

Nginx — config include

# nginx.conf — inside the http {} or server {} block include /etc/nginx/denygrid-blocklist.conf; # Generate the file (cron): curl -sS https://bigbro.gergosnet.com/api/blocklist_export.php?format=nginx_deny&scope=community \ -o /etc/nginx/denygrid-blocklist.conf && nginx -s reload

Fail2ban — external jail

# /etc/fail2ban/jail.d/denygrid.conf [denygrid] enabled = true filter = denygrid banaction = iptables-allports logpath = /var/log/denygrid-sync.log maxretry = 1 # Sync script: download the list and log new IPs curl -sS https://bigbro.gergosnet.com/api/blocklist_export.php?format=plain_text&scope=community | \ while read ip; do echo "$(date) DenyGrid ban $ip" >> /var/log/denygrid-sync.log; done

Apache — .htaccess or VirtualHost

# Generate the file (cron): curl -sS https://bigbro.gergosnet.com/api/blocklist_export.php?format=apache_deny&scope=community \ -o /etc/apache2/denygrid-blocklist.conf && apachectl graceful # In the VirtualHost: Include /etc/apache2/denygrid-blocklist.conf

Top 10 attacking countries

Geographic distribution of banned IPs

CN
1,1k IPs
US
990 IPs
GB
653 IPs
CA
466 IPs
SG
326 IPs
FR
258 IPs
HK
176 IPs
NL
172 IPs
DE
167 IPs
IN
161 IPs

Top attacking AS

Most malicious autonomous systems

AS Name Score IPs
AS135377 AS135377 UCLOUD INFORMATION TECHNOL 96 219
AS137718 AS137718 Beijing Volcano Engine Tec 90 164
AS136907 AS136907 HUAWEI CLOUDS 90 124
AS24086 AS24086 Viettel Corporation 90 101
AS63949 AS63949 Akamai Connected Cloud 87 69
AS197170 AS197170 TechTies Inc. 85 226
AS202412 AS202412 Omegatech LTD 85 117
AS4837 AS4837 CHINA UNICOM China169 Backbo 84 497
AS134756 AS134756 CHINANET Nanjing Jishan ID 82 162
AS56046 AS56046 China Mobile communications 82 154

Frequently asked questions

Everything about the community blocklist

What is this list?
It is a list of IP addresses detected as malicious by all the machines in the DenyGrid network. Each IP was identified following real intrusion attempts (SSH brute-force, HTTP scans, exploits, etc.).
How often is it updated?
The list is updated continuously. The API cache is 5 minutes, so downloading every 5 minutes guarantees you the freshest data.
Can I use it in production / for commercial purposes?
Yes. The community blocklist is distributed under the Creative Commons BY 4.0 license. You may freely integrate it into your scripts, firewalls and products, provided you credit DenyGrid as the source.
Is there a rate limit?
Public access is limited to 60 requests per hour per IP. For heavy use, sign up and use an API key (10 requests/minute, advanced filters, custom whitelist).
How do I report a false positive?
Sign in to the DenyGrid dashboard and use the whitelist feature to exclude an IP. If you don't have an account, contact the instance administrator.
What's the difference with CrowdSec or AbuseIPDB?
DenyGrid is self-hosted: your data stays with you. The community blocklist is fed by the machines in your network, not by a third party. You keep full control over the ban criteria.

Contribute to the network

Install a DenyGrid agent on your servers to feed the community blocklist. The bigger the network, the faster and more accurate the detection.

Join DenyGrid