Threat Intelligence — Open access

DenyGrid community blocklist

Threat intelligence shared across the entire DenyGrid network. Thousands of malicious IP addresses detected in real time, exportable in 8 formats to protect your infrastructure.

41,1k
Active banned IPs
75,8k
External blocklist IPs
123
Countries covered
32.2
Average score

Download the blocklist

Ready-to-use formats for your firewalls, reverse proxies and routers. No registration required.

Plain text
One IP per line — universal
JSON
IP + reason + score + dates
CSV
Spreadsheet / SIEM import
iptables
Ready-to-run DROP rules
Nginx deny
deny block for nginx.conf
Apache deny
Require not ip for .htaccess
MikroTik
RouterOS address-list
pfSense
IP/32 — alias table

Integration examples

Integrate the DenyGrid blocklist in a few lines. Automatic update recommended every 5 minutes.

Crontab — automatic update

# Update every 5 minutes */5 * * * * curl -sS https://bigbro.gergosnet.com/api/blocklist_export.php?format=plain_text&scope=community -o /etc/denygrid-blocklist.txt

iptables — blocking script

#!/bin/bash # Flush the old chain and recreate it iptables -F DENYGRID 2>/dev/null || iptables -N DENYGRID iptables -D INPUT -j DENYGRID 2>/dev/null iptables -A INPUT -j DENYGRID # Load the IPs while IFS= read -r ip; do iptables -A DENYGRID -s "$ip" -j DROP done < /etc/denygrid-blocklist.txt

Nginx — config include

# nginx.conf — inside the http {} or server {} block include /etc/nginx/denygrid-blocklist.conf; # Generate the file (cron): curl -sS https://bigbro.gergosnet.com/api/blocklist_export.php?format=nginx_deny&scope=community \ -o /etc/nginx/denygrid-blocklist.conf && nginx -s reload

Fail2ban — external jail

# /etc/fail2ban/jail.d/denygrid.conf [denygrid] enabled = true filter = denygrid banaction = iptables-allports logpath = /var/log/denygrid-sync.log maxretry = 1 # Sync script: download the list and log new IPs curl -sS https://bigbro.gergosnet.com/api/blocklist_export.php?format=plain_text&scope=community | \ while read ip; do echo "$(date) DenyGrid ban $ip" >> /var/log/denygrid-sync.log; done

Apache — .htaccess or VirtualHost

# Generate the file (cron): curl -sS https://bigbro.gergosnet.com/api/blocklist_export.php?format=apache_deny&scope=community \ -o /etc/apache2/denygrid-blocklist.conf && apachectl graceful # In the VirtualHost: Include /etc/apache2/denygrid-blocklist.conf

Top 10 attacking countries

Geographic distribution of banned IPs

CN
1,4k IPs
US
1,3k IPs
GB
871 IPs
FR
417 IPs
CA
386 IPs
SG
362 IPs
NL
235 IPs
IN
220 IPs
HK
219 IPs
DE
205 IPs

Top attacking AS

Most malicious autonomous systems

AS Name Score IPs
AS202412 AS202412 Omegatech LTD 95 195
AS63949 AS63949 Akamai Connected Cloud 92 80
AS197170 AS197170 TechTies Inc. 90 474
AS135377 AS135377 UCLOUD INFORMATION TECHNOL 90 330
AS136907 AS136907 HUAWEI CLOUDS 86 123
AS16276 AS16276 OVH SAS 85 2,3k
AS4837 AS4837 CHINA UNICOM China169 Backbo 85 388
AS206092 AS206092 F.N.S. HOLDINGS LIMITED 83 734
AS56046 AS56046 China Mobile communications 80 166
AS31898 AS31898 Oracle Corporation 80 39

Frequently asked questions

Everything about the community blocklist

What is this list?
It is a list of IP addresses detected as malicious by all the machines in the DenyGrid network. Each IP was identified following real intrusion attempts (SSH brute-force, HTTP scans, exploits, etc.).
How often is it updated?
The list is updated continuously. The API cache is 5 minutes, so downloading every 5 minutes guarantees you the freshest data.
Can I use it in production / for commercial purposes?
Yes. The community blocklist is distributed under the Creative Commons BY 4.0 license. You may freely integrate it into your scripts, firewalls and products, provided you credit DenyGrid as the source.
Is there a rate limit?
Public access is limited to 60 requests per hour per IP. For heavy use, sign up and use an API key (10 requests/minute, advanced filters, custom whitelist).
How do I report a false positive?
Sign in to the DenyGrid dashboard and use the whitelist feature to exclude an IP. If you don't have an account, contact the instance administrator.
What's the difference with CrowdSec or AbuseIPDB?
DenyGrid is self-hosted: your data stays with you. The community blocklist is fed by the machines in your network, not by a third party. You keep full control over the ban criteria.

Contribute to the network

Install a DenyGrid agent on your servers to feed the community blocklist. The bigger the network, the faster and more accurate the detection.

Join DenyGrid