29M+
Indexed indicators
Records counted in the indicator corpus.
Blocklists
IP and domain blocklists, rebuilt every 12 hours.
Lists from 591 sources with at least one entry in the corpus, by threat level or category, in plain, hosts, dnsmasq or AdGuard format.
No key: 10% sample · full lists on paid plans
By the numbers
591
Sources in the corpus
Distinct sources with at least one indicator in the corpus; not customer references.
484K+
Additions today
Records added to the corpus today.
58%
Multiple-source records
Share of records listed by two or more sources.
Counters read at 2026-10-17T06:24:17.983Z. Indicator dates vary by source.
TAXII 2.1 feed
Poll the same data as a STIX/TAXII feed
The blocklists below are files. The feed serves the same corpus as STIX 2.1 indicators over TAXII 2.1, split into the collections listed here, so a SIEM, a TIP or OpenCTI can poll it with a standard client.
- Collections rebuilt every night from the corpus
- Feed polling does not count against the monthly lookup quota
- Included in Pro (€99/month) and Enterprise
GET/taxii/api-root/collections/
| Collection | Indicators |
|---|---|
| malicious-domainsMalicious Domains | 18 675 572 |
| malicious-ipsMalicious IP Addresses | 8 676 321 |
| malicious-urlsMalicious URLs | 1 353 431 |
| malicious-file-hashesMalicious File Hashes | 3 887 743 |
| malicious-subdomainsMalicious Subdomains | 5 843 786 |
| malware-iocsMalware IOCs | 27 974 981 |
| c2-indicatorsCommand-and-Control Indicators | 13 503 562 |
| ransomware-iocsRansomware IOCs | 6 784 |
| phishing-indicatorsPhishing Indicators | 9 607 512 |
9 collectionsSTIX 2.1 · TAXII 2.1counted 8 hr. ago
Threat levels
Choose how strict. Source agreement sets the level.
Domain lists use the same levels: swap ips for domains in the file name.
| Level | Listed when | IP list |
|---|---|---|
| critical | 6+ sources agree, or 3+ for a critical category such as malware, phishing or C2. | blocklist-ips-critical.txt |
| high | 4–5 sources, or 2 for a critical category. | blocklist-ips-high.txt |
| medium | 2–3 sources, or 1 for a critical category. | blocklist-ips-medium.txt |
| low | A single source outside the critical categories. | blocklist-ips-low.txt |
| all | Every listed indicator, whatever its level. | blocklist-ips-all.txt |
Categories
One list per threat type. In four file formats.
Verified sources per category
How many catalogue sources feed each category list.
- malware126
- attack93
- phishing85
- ads57
- abuse46
- spam34
- scam26
- proxy23
- tracking14
- ransomware11
- c210
- botnet2
blocklist-domains-{category}.txt · blocklist-ips-{category}.txt
File formats
Formats apply to domain lists. IP lists hold one address per line.
- Plain text.txt
- example.test
- Hosts file-hosts.txt
- 0.0.0.0 example.test
- dnsmasq-dnsmasq.txt
- server=/example.test/
- AdGuard-adguard.txt
- ||example.test^
Access
Try the sample. Switch to full lists on a paid plan.
No key or Free plan
10%
A sample of every list, in the same files and formats.
Paid plans
100%
Every list in full. Send X-API-KEY, or HTTP Basic auth for appliances with short key fields.
download.sh
# Anonymous: 10% lite sample, no key needed
curl -X GET "https://api.ismalicious.com/blocklist/download/blocklist-domains-phishing.txt" \
-o blocklist-domains-phishing.txt
# Authenticated (BASIC+): full blocklist
curl -X GET "https://api.ismalicious.com/blocklist/download/blocklist-domains-phishing.txt" \
-H "X-API-KEY: YOUR_BASE64_CREDENTIALS" \
-o blocklist-domains-phishing.txtIntegrations
Where the lists go.
- 01
Firewalls
pfSense, FortiGate and Palo Alto pull the list URL; iptables loads it into an ipset.
- 02
DNS filtering
Load domain lists into Pi-hole, AdGuard Home, dnsmasq or any hosts-file resolver.
- 03
Applications
Check a single IP or domain with GET /check before you trust it.
- 04
SIEM
Splunk, Elastic and Sentinel connectors, or any TAXII 2.1 client.
FAQ
Frequently asked questions.
How often are the lists rebuilt?
Every 12 hours. Each file starts with a comment header giving its type, level, format and entry count. Lookups through GET /check run at request time.
What does the free version include?
Without a key, or with a Free key, every list returns a 10% sample in the same format. Paid plans get the full lists.
How are threat levels assigned?
By source agreement. Six sources make an indicator critical, or three when its category is critical, such as malware, phishing, ransomware, botnet or C2.
Can I consume the blocklist as a threat feed (STIX/TAXII or malware hashes)?
Yes, on Pro and Enterprise. IPs, domains, URLs and malware hashes are served as STIX 2.1 over TAXII 2.1, rebuilt nightly. Feed polling does not count against your request quota.
What if my IP or domain is listed by mistake?
Request a review on the delisting page. Approved removals apply to our API and reports; ask the original sources to delist it too.
Blog
Related reading.
DNS Security and Threat Intelligence
Learn how DNS-level blocking stops requests before a connection is established.
Read more
Proactive Threat Defense
Shift from reactive to proactive security with blocklist intelligence.
Read more
Detecting Malicious Domains and IPs
Technical guide to reputation checking and threat assessment.
Read more