Free Blocklists of Suspected Malicious IPs and URLs

Several organizations maintain and publish free blocklists of IP addresses and URLs of systems and networks suspected in malicious activities on-line. Some of these lists have usage restrictions:

• Artists Against 419: Lists fraudulent websites
• ATLAS from Arbor Networks: Registration required by contacting Arbor
• Blackweb Project: Optimized for Squid
• CLEAN-MX Realtime Database: XML output available
• CriticalStack Intel Marketplace: Registration required; optimized for Bro
• CYMRU Bogon List
• DShield Blocklist
• FireHOL IP Lists: Combines several blocklists from other sources
• Google Safe Browsing API: Programmatic access; restrictions apply
• hpHosts File: Limited automation on request
• Malc0de Database
• Malware Domain Blocklist: Free for non-commercial use
• MalwareDomainList.com Hosts List
• Malware Patrol's Malware Block Lists: Free for non-commercial use
• MalwareURL List: Commercial service; free licensing options may be available
• OpenPhish: Phishing sites; free for non-commercial use
• PhishTank Phish Archive: Query database via API
• Project Honey Pot's Directory of Malicious IPs: Registration required to view more than 25 IPs
• Risk Discovery: Programmatic access, based on HoneyPy data
• Scumware.org
• Shadowserver IP and URL Reports: Registration and approval required
• StrictBlockPAllebone
• URLhaus: Programmatic access available
• VoIP Blacklist: Specific to VoIP abusers
• www.BlockList.de