FortiGate threat feed of malicious IPs and domains, with basic authentication

Up to FortiOS 7.4.3 a feed holds 131,072 entries or 10 MB; from 7.4.4 one budget per entry type covers every feed, 300,000 IPs on the smallest models. Every list below fits each release and model.

Entries rounded from the build of 2026-10-01; each list is rebuilt every 12 hours. Today’s counts are public and need no key.

# IsMalicious.com Blocklist - IPs (Critical)
# Format: Plain
# Generated: <BUILD_TIME>
# Total entries: <COUNT>
# Update frequency: every 12 hours
# Category: All
# Threat level: Critical
# Website: https://ismalicious.com
# © <YEAR> IsMalicious (compilation). Licensed to the downloading account under https://ismalicious.com/terms; redistribution of the compilation prohibited. Third-party entries remain under their providers' licences — see https://ismalicious.com/sources.
#

• FortiOS 7.0.8, 7.2.4 or later, the first builds that can verify a feed server’s certificate (the check is off by default). Avoid 7.4.5 to 7.4.8 and 7.6.1 to 7.6.3, which fail that check on threat feeds; 7.4.9 and 7.6.4 fix it.
• If management traffic must leave by a given interface, set interface-select-method specify and interface, or source-ip, on the external resource.
• For the domain feed only: a FortiGuard Web Filter license, which category-based DNS filtering requires.
• An isMalicious API key and secret, from Account › API access.
• Outbound HTTPS (TCP 443) over IPv4 from FortiGate to api.ismalicious.com, which has no IPv6 address.

1. 1

   Copy your API key and secret

   Open Account › API access and copy the API Key and the API Secret. The full list needs a Basic, Pro, or Enterprise plan; a Free key, or a lapsed plan, loads the 10% sample.
2. 2

   Create the IP feed

   • Security Fabric › External Connectors › Create New, then External Feeds › IP Address from 7.6.1, Threat Feeds › IP Address on 7.0 to 7.6.0.
   • Name it isMalicious-IPs, keep Update method on External Feed where the field is shown, paste the list URL in URL of external resource (URI of external resource on 7.0 and 7.2), set Refresh Rate to 60 minutes, and click OK.
   • In the GUI, save the connector with HTTP basic authentication off, run the certificate block of the next step, then turn on HTTP basic authentication with the API key as Username and the API secret as Password: FortiOS fetches the feed as soon as it is saved, and the check is off until then.
   • The CLI block sets both in one commit.

   config system external-resource
     edit "isMalicious-IPs"
       set type address
       set resource "https://api.ismalicious.com/blocklist/download/blocklist-ips-critical.txt"
       set username "<API_KEY>"
       set password "<API_SECRET>"
       set refresh-rate 60
       set server-identity-check full
     next
   end

3. 3

   Turn on certificate checking

   If you created the feed in the GUI, set the check in the CLI: FortiOS does not verify the feed server’s certificate by default (server-identity-check none), and Fortinet documents the setting in the CLI only. Set it to full, which also checks the host name. Without it, the API secret travels over TLS that a man in the middle could terminate.

   config system external-resource
     edit "isMalicious-IPs"
       set server-identity-check full
     next
   end

4. 4

   Deny the feed in firewall policies

   • Policy & Objects › Firewall Policy › Create New: Destination isMalicious-IPs (in the IP ADDRESS FEED section), Action DENY, logging on, for outbound traffic.
   • Add a second policy with the feed as Source for inbound traffic, with match-vip enabled when servers are reached through VIPs (no GUI field; the default from 7.2.4): a regular deny policy does not block VIP traffic.
   • An SD-WAN member cannot be a policy interface: use its zone.
   • In the CLI, edit 0 takes the next free policy ID and adds the policy at the bottom, under the allow policies, where it never matches: move both above them with the move block.

   config firewall policy
     edit 0
       set name "isMalicious-outbound"
       set srcintf "<LAN_INTERFACE>"
       set dstintf "<WAN_INTERFACE>"
       set srcaddr "all"
       set dstaddr "isMalicious-IPs"
       set action deny
       set schedule "always"
       set service "ALL"
       set logtraffic all
     next
     edit 0
       set name "isMalicious-inbound"
       set srcintf "<WAN_INTERFACE>"
       set dstintf "<LAN_INTERFACE>"
       set srcaddr "isMalicious-IPs"
       set dstaddr "all"
       set action deny
       set schedule "always"
       set service "ALL"
       set logtraffic all
       set match-vip enable
     next
   end
   
   # edit 0 adds each policy at the bottom. Read the two new IDs at the end of
   # "show firewall policy", then put them above the policies that allow the traffic:
   config firewall policy
     move <OUTBOUND_ID> before <FIRST_LAN_TO_WAN_ALLOW_ID>
     move <INBOUND_ID> before <FIRST_WAN_TO_LAN_ALLOW_ID>
   end

5. 5

   Protect the FortiGate itself (optional)

   From FortiOS 7.2.4 and 7.4.0, a local-in policy can use the IP feed as its source, to drop traffic aimed at the FortiGate’s own interfaces.

   config firewall local-in-policy
     edit 0
       set intf "<WAN_INTERFACE>"
       set srcaddr "isMalicious-IPs"
       set dstaddr "all"
       set action deny
       set service "ALL"
       set schedule "always"
     next
   end

6. 6

   Block the domains with a DNS filter (optional)

   • Create New › Domain Name in the same connector menu, with the same fields and blocklist-domains-c2.txt as the URL; in the CLI, category 192, or the next unused number up to 221, and server-identity-check full.
   • Then Security Profiles › DNS Filter: edit the profile, enable FortiGuard Category Based Filter, set the feed to Redirect to Block Portal under Remote Categories, then apply the profile where your clients’ DNS queries pass: in the accept policy that lets LAN clients reach DNS servers (a deny policy carries no profile), or, if clients use the FortiGate as their resolver, under Network › DNS Servers › DNS Service on Interface › DNS Filter (in the CLI, config system dns-server, then edit on the LAN interface and set dnsfilter-profile).

   config system external-resource
     edit "isMalicious-Domains"
       set type domain
       set category 192
       set resource "https://api.ismalicious.com/blocklist/download/blocklist-domains-c2.txt"
       set username "<API_KEY>"
       set password "<API_SECRET>"
       set refresh-rate 60
       set server-identity-check full
     next
   end

• Edit the connector: once the file loads it shows its last update and how many entries it holds, and View Entries lists them.
• diagnose sys external-resource stats prints, per feed, the total, valid and error lines and, from 7.4.4, buildable, the entries loaded under the limit. Valid lines should be close to the list’s count in /blocklist/stats, and buildable equal to them.
• The REST monitor API returns the feed’s entries and status: GET /api/v2/monitor/system/external-resource/entry-list?mkey=isMalicious-IPs&status_only=true.
• Denied sessions appear in the logs of the two policies; blocked domains under Log & Report › Security Events › DNS Query (Log & Report › DNS Query on 7.0).
• About a tenth of the published count means the 10% sample. The FortiGate does not show the file’s header: the forticron debug shows X-Blocklist-Version: lite in the response, or a curl from a workstation with the same key shows Lite Version in the Total entries line.

# Per feed: total, valid and error lines; from 7.4.4 also buildable, the
# entries loaded under the limit.
diagnose sys external-resource stats

# Watch one download: the request, its Authorization header (your credential,
# in base64: keep it out of tickets), the X-Blocklist-Version answer and the
# TLS result.
diagnose debug reset
diagnose debug application forticron -1
diagnose debug console timestamp enable
diagnose debug enable
# Reload the feeds now rather than waiting for the next refresh:
diagnose test application forticron 8
# ...then:
diagnose debug disable
diagnose debug reset

• blocklist-domains-critical.txt, about 2 million domains, overflows the per-feed limit up to 7.4.3 and the entry-level budget from 7.4.4; only mid-range and high-end models on 7.4.4 or later can hold it, and only on 7.4.8 or 7.6.4 and later, since a domain feed over 1 million entries in a flow-based policy exhausts the IPS engine’s memory before them. The lists are unsorted, so a truncated load is an arbitrary subset.
• From 7.4.4 the entry budget is shared by every feed of the same type: another vendor’s IP feed uses the same allowance.
• No CIDR or ranges are served: FortiOS accepts them, but the IP lists hold single addresses.
• Existing sessions are re-evaluated after the shorter of the refresh rate and 30 minutes.
• The domain path needs the FortiGuard Web Filter license. If the license lapses, FortiOS can no longer rate domains and, by default, drops all DNS through the profile: turn on Allow DNS requests when a rating error occurs (config ftgd-dns, set options error-allow) if DNS must fail open. Without the license, use the IP feeds.
• FortiOS lists STIX as a feed protocol. The isMalicious TAXII server has not been tested with it: use the lists.
• The 10% sample is the first tenth of an unsorted file, not the riskiest tenth.

• PA

  Palo Alto EDL blocklist

  External Dynamic Lists sized to PAN-OS limits

• pf

  pfSense malicious IP blocklist

  A URL Table alias or pfBlockerNG feed through a relay

• OP

  OPNsense blocklist

  URL Table aliases with Basic authorization

• MT

  MikroTik adlist blocklist

  Threat domains as a RouterOS DNS adlist

• nf

  Linux firewall IP blocklist

  Threat IPs as nftables sets on any Linux host

• Firewall blocklist automation

  Keep firewall blocklists current

• IP & domain blocklist

  Every list, level and category

• STIX/TAXII threat intelligence feeds

  TAXII 2.1 collections for SIEMs and TIPs

• Threat intelligence API documentation

  Authentication, endpoints and limits

• IP reputation check

  Check one address before you block it