Open Dynamic Block Lists
Free threat intelligence blocklists compatible with all firewalls and security devices supporting the following formats:
Standalone IPs:
x.x.x.x
CIDR Subnets: x.x.x.x/yy
Total Unique IPs: 64,671
Multi-Source Verified: 18,017
Polling Interval: ≥ 15 min
10+ Years Operational
Continuous, high-uptime threat intelligence service for enterprise firewalls since 2014.
Automated Feed Sanitization
Real-time filtering ensuring core Internet services & public DNS never show up in published lists.
Zero-Touch FP Safeguards
Multi-feed validation & automated surge anomaly detection protect production traffic.
OpenDBL CIDR-Optimized Feeds
| List name | Entries | Last update | Direction | False Positive Risk | Description |
|---|---|---|---|---|---|
|
14,863 CIDRs
(18,017 IPs)
|
2026-09-28 22:51 | Incoming | Very Low Risk | Ultra-strict threat feed requiring multi-sensor correlation (2+ independent feeds) or a hit on an externally-vetted threat-intelligence feed (ThreatFox, Feodo Tracker, Spamhaus DROP) (14,863 CIDR blocks blocking 18,017 verified IPs). Engineered for zero-touch automated blocking with very low false positive risk. | |
|
41,927 CIDRs
(58,573 IPs)
|
2026-09-28 22:51 | Incoming | Low Risk | Wide-spectrum threat feed combining active web scanners, brute-force bots, and malware hosts (41,927 CIDR blocks blocking 58,573 unique IPs). Darknet-sensor-only sightings must be corroborated by another feed or persist across 2+ distinct days; TOR exit nodes are excluded. Suited for production firewalls. | |
|
44,250 CIDRs
(64,671 IPs)
|
2026-09-28 22:51 | Incoming | High Risk | Complete union of all active external threat feeds (44,250 CIDR blocks blocking 64,671 unique IPs), including TOR exit nodes and single-report scanners with no corroboration or scoring threshold - except single-day-only sightings from our own darknet sensor pending corroboration. High false-positive risk — best suited for SIEM correlation and honeypots, not direct inbound blocking. |
Individual Block Lists & Threat Feeds
| List name | Entries | Last update | Direction | False Positive Risk | Description |
|---|---|---|---|---|---|
| 23,836 IPs | 2026-09-28 22:51 | Incoming | Medium Risk | Real-time threat feed generated directly from OpenDBL's passive darknet sensor network. Read more → | |
| 669 IPs | 2026-09-28 22:49 | Incoming | Medium Risk | Compiled from multiple sources containing active, severely infected, and hostile hosts. Read more → | |
| 1,378 IPs | 2026-09-28 22:49 | Incoming | High Risk | Real-time updated list of known TOR network exit nodes. Read more → | |
| 643 IPs | 2026-09-28 22:49 | Incoming | High Risk | IP addresses reporting high volumes of SSH/service brute-force attack attempts. Read more → | |
| 30,761 IPs | 2026-09-28 22:49 | Incoming | Medium Risk | Attacking IP addresses detected across customer systems within the last 48 hours. Read more → | |
| 5,120 IPs | 2026-09-28 22:51 | Incoming | Low Risk | Top recommended attack sources from SANS Internet Storm Center DShield. Read more → | |
| 18,277 IPs | 2026-09-28 22:50 | Both | Low Risk | Aggregated threat list consisting of malicious IPs present in 3 or more blocklists. Read more → | |
| 1 IPs | 2026-09-28 22:50 | Outgoing | Low Risk | Active Command & Control (C2) servers for botnets, ransomware, and banking trojans (Dridex, TrickBot, QakBot). Read more → | |
| 4,897 IPs | 2026-09-28 22:50 | Incoming | Medium Risk | Real-time list of IP addresses carrying out brute-force attacks, port scans, and web exploits. Read more → | |
| 2,632 IPs | 2026-09-28 22:50 | Outgoing | Medium Risk | Real-time Indicators of Compromise (IOCs) for malware C2 and payload delivery infrastructure from abuse.ch. Read more → | |
| 1,692 IPs | 2026-09-28 22:50 | Both | Low Risk | Advisory list of hijacked or leased IP netblocks controlled entirely by cybercriminals. Read more → |
