Open Dynamic Block Lists
Free threat intelligence blocklists compatible with all firewalls and security devices supporting the following formats:
Standalone IPs:
x.x.x.x
CIDR Subnets: x.x.x.x/yy
Total Unique IPs: 53,757
Multi-Source Verified: 5,261
Polling Interval: ≥ 15 min
10+ Years Operational
Continuous, high-uptime threat intelligence service for enterprise firewalls since 2014.
Automated Feed Sanitization
Real-time filtering ensuring core Internet services & public DNS never show up in published lists.
Zero-Touch FP Safeguards
Multi-feed validation & automated surge anomaly detection protect production traffic.
OpenDBL Tiered Threat Lists
| List name | Entries | Last update | Direction | False Positive Risk | Description |
|---|---|---|---|---|---|
| 4,462 | 2026-07-25 21:49 | Both | Very Low Risk | CIDR-optimized multi-source threat feed (4,462 CIDR blocks blocking 5,261 verified IPs). Designed for zero-touch automated firewall blocking. | |
| 19,636 | 2026-07-25 21:49 | Both | Low Risk | CIDR-optimized broad threat feed (19,636 CIDR blocks blocking 52,476 unique IPs). Aggregates active attack scanners, malware C2s & persistent attack sources (high-risk single-source IPs require 3+ day persistence or multi-feed verification). | |
| 20,333 | 2026-07-25 21:49 | Both | Medium Risk | CIDR-optimized full-spectrum threat feed (20,333 CIDR blocks blocking 53,757 unique IPs). Combines 100% of active attack scanners, TOR exit nodes, and brute-force reporters. |
Individual Block Lists & Threat Feeds
| List name | Entries | Last update | Direction | False Positive Risk | Description |
|---|---|---|---|---|---|
| 24,698 | 2026-07-25 21:49 | Incoming | Medium Risk | Attacking IP addresses detected across customer systems within the last 48 hours. Read more → | |
| 585 | 2026-07-25 21:49 | Incoming | High Risk | IP addresses reporting high volumes of SSH/service brute-force attack attempts. Read more → | |
| 5,120 | 2026-07-25 21:49 | Incoming | Low Risk | Top recommended attack sources from SANS Internet Storm Center DShield. Read more → | |
| 583 | 2026-07-25 21:49 | Incoming | Medium Risk | Compiled from multiple sources containing active, severely infected, and hostile hosts. Read more → | |
| 1 | 2026-07-25 21:49 | Outgoing | Low Risk | Active Command & Control (C2) servers for botnets, ransomware, and banking trojans (Dridex, TrickBot, QakBot). Read more → | |
| 3,144 | 2026-07-25 21:49 | Incoming | Medium Risk | Real-time list of IP addresses carrying out brute-force attacks, port scans, and web exploits. Read more → | |
| 14,811 | 2026-07-25 21:49 | Both | Low Risk | Aggregated threat list consisting of malicious IPs present in 3 or more blocklists. Read more → | |
| 1,669 | 2026-07-25 21:49 | Both | Low Risk | Advisory list of hijacked or leased IP netblocks controlled entirely by cybercriminals. Read more → | |
| 1,850 | 2026-07-25 21:49 | Outgoing | Medium Risk | Real-time Indicators of Compromise (IOCs) for malware C2 and payload delivery infrastructure from abuse.ch. Read more → | |
| 1,392 | 2026-07-25 21:49 | Incoming | High Risk | Real-time updated list of known TOR network exit nodes. Read more → |
