IP reputation feeds

Hourly CSV exports of the addresses attacking our honeypots: SSH and FTP brute force, Postfix and IMAP scans, RDP, Telnet, SMB, MySQL, SIP and more. Drop them into a router, a firewall, a fraud-prevention system or a threat-intel platform.

Ask for pricing How many IPs per day

Feeds included in a subscription

A yearly subscription unlocks every feed below. Each one is regenerated every hour and fetched with your key over HTTPS, as CSV or as a STIX 2.1 bundle.

Feed	Window	Contents	Typical size
last-1-days	24 hours	IPv4 addresses seen in the last day	20–30K
last-2-days	2 days	IPv4 addresses seen in the last two days	40–55K
last-7-days	7 days	Default feed, IPv4 addresses seen in the last week	100–140K
last-15-days	15 days	Widest IPv4 window, everything still considered active	150–180K
top-ips	15 days	IPv4 addresses with 100+ attack days: persistent scanners	25–30K
last-15-days-ipv6	15 days	IPv6 addresses seen in the last 15 days	3–5K

Sizes are rough and move with scanning activity. An address leaves every feed 15 days after its last detection; see the statistics page for live daily counts.

File formats

Every feed is available in two formats: plain CSV (default) and STIX 2.1 JSON, ready for OpenCTI and other threat-intelligence platforms. Add /format/stix/ to the feed URL to get the bundle.

ipspamlist_ipfeeds.csv

first_seen,last_seen,value,category,attacks_count,labels,entity_type,country_code,asn,asn_org,hostname
2016-10-17T19:17:04Z,2026-09-24T23:36:51Z,71.6.135.131,Postfix,2257,malicious-ip,IPv4-Addr,US,10439,"CariNet, Inc.",soda.census.shodan.io
2024-03-02T08:11:39Z,2026-09-24T21:02:10Z,45.148.10.72,SSH Brute Force,188,malicious-ip,IPv4-Addr,NL,48090,TECHOFF SRV LIMITED,
2026-09-01T14:20:51Z,2026-09-24T19:44:03Z,185.220.101.34,Telnet,441,malicious-ip,IPv4-Addr,DE,60729,Stiftung Erneuerbare Freiheit,tor-exit-34.for-privacy.net

first_seen	First detection, ISO 8601 UTC.
last_seen	Most recent detection. Sort or filter on this to build your own window.
value	The IPv4 or IPv6 address.
category	Service attacked: one of 28 categories such as SSH Brute Force, Postfix, RDP Attack, MS-DS Attack, Mirai.
attacks_count	Number of distinct days the address was seen. Higher means more persistent.
labels	Always `malicious-ip`; reserved for future tagging.
entity_type	`IPv4-Addr` or `IPv6-Addr` (STIX naming).
country_code	ISO 3166-1 alpha-2 country of the address.
asn	Autonomous system number announcing the address (numeric, without the `AS` prefix).
asn_org	Organisation registered for that ASN. Values containing commas are double-quoted (RFC 4180).
hostname	Reverse DNS at detection time, when one exists.

ipspamlist_ipfeeds.stix.json STIX 2.1 · OpenCTI-compatible

{
  "type": "bundle", "id": "bundle--…", "objects": [
    { "type": "identity", "id": "identity--…", "name": "IPSpamList", "identity_class": "organization" },
    { "type": "indicator", "spec_version": "2.1", "id": "indicator--…",
      "name": "71.6.135.131 (Postfix)", "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '71.6.135.131']", "pattern_type": "stix",
      "valid_from": "2016-10-17T19:17:04.000Z", "valid_until": "2026-10-09T23:36:51.000Z",
      "labels": ["malicious-ip", "postfix"], "confidence": 100,
      "x_opencti_score": 100, "x_opencti_main_observable_type": "IPv4-Addr",
      "x_ipspamlist_country": "US", "x_ipspamlist_asn": "AS6939", "x_ipspamlist_attack_days": 2257 },
    { "type": "ipv4-addr", "id": "ipv4-addr--…", "value": "71.6.135.131" },
    { "type": "relationship", "relationship_type": "based-on", "source_ref": "indicator--…", "target_ref": "ipv4-addr--…" }
  ] }

One indicator per address, with its observable and a based-on relationship; object ids are stable across refreshes, so hourly re-imports update existing objects instead of duplicating them. Indicators expire 15 days after the last detection.

Loading the feed into a firewall

One fetch, one cut, one ipset. Run it from cron every hour to stay in sync.

update-blocklist.sh

#!/bin/sh
curl -fsS "https://www.ipspamlist.com/subscription/YOUR_KEY/feed/last-7-days/" -o /tmp/ipspamlist.csv
ipset create ipspamlist hash:ip -exist
ipset flush ipspamlist
tail -n +2 /tmp/ipspamlist.csv | cut -d, -f3 | while read ip; do ipset add ipspamlist "$ip" -exist; done
iptables -C INPUT -m set --match-set ipspamlist src -j DROP 2>/dev/null \
  || iptables -I INPUT -m set --match-set ipspamlist src -j DROP

Appliances

pfSense and OPNsense URL aliases, MikroTik address lists, Fortinet threat feeds and Palo Alto EDLs all accept a plain list of addresses: take column 3.

Fraud and risk engines

Import the CSV into your scoring pipeline and weight by attacks_count and recency of last_seen.

Prefer an API?

This data is already inside APIVoid's IP Reputation API, together with other blocklists, geolocation and proxy/VPN detection.

Put the blocklist to work

Hourly CSV feeds of the IPs attacking our honeypots, ready for firewalls, fraud models and threat-intel platforms.