Palo Alto EDL blocklist of malicious IPs and domains, sized to PAN-OS limits

PA-3400, PA-5400, PA-5500 and PA-7500 hold 150,000 IPs across every EDL used in policy, as do the older PA-5200 and PA-7000; the PA-400, PA-500, PA-800 and PA-1400 Series and most VM-Series sizes hold 50,000. List Capacities shows your firewall’s figure. The smallest models hold 50,000 domains, so the three domain lists fit every model.

Entries rounded from the build of 2026-10-01; each list is rebuilt every 12 hours. Today’s counts are public and need no key.

# IsMalicious.com Blocklist - IPs (Critical)
# Format: Plain
# Generated: <BUILD_TIME>
# Total entries: <COUNT>
# Update frequency: every 12 hours
# Category: Top 50000 by risk score
# Threat level: Critical
# Website: https://ismalicious.com
# © <YEAR> IsMalicious (compilation). Licensed to the downloading account under https://ismalicious.com/terms; redistribution of the compilation prohibited. Third-party entries remain under their providers' licences — see https://ismalicious.com/sources.
# Filtered by category: top 50000 by risk score
#

• A supported PAN-OS release: 10.2 (Extended Support until 31 March 2027), 11.1, 11.2, 12.1 or 12.2. Client authentication on EDLs dates from PAN-OS 8.0.
• PAN-OS fetches the lists from the management interface, or from a dedicated External Dynamic Lists service route (Device › Setup › Services › Service Route Configuration), and the firewall’s DNS servers (Device › Setup › Services) must resolve api.ismalicious.com.
• For the domain lists only: a Threat Prevention or Advanced Threat Prevention license.
• An isMalicious API key and secret, from Account › API access.
• Outbound HTTPS (TCP 443) over IPv4 from PAN-OS to api.ismalicious.com, which has no IPv6 address.

1. 1

   Copy your API key and secret

   Open Account › API access and copy the API Key and the API Secret. The full list needs a Basic, Pro, or Enterprise plan; a Free key, or a lapsed plan, loads the 10% sample.
2. 2

   Create a certificate profile for the api host

   • Client authentication only works with server authentication, so the EDL needs a certificate profile holding the root and intermediate certificates of api.ismalicious.com, which uses Let’s Encrypt.
   • Download the files below and import each one under Device › Certificate Management › Certificates, tab Device Certificates (Custom Certificates from PAN-OS 12.1), Import, File Format Base64 Encoded Certificate (PEM), no private key.
   • Then Device › Certificate Management › Certificate Profile › Add: name it isMalicious-LE, add every imported certificate under CA Certificates, and leave OCSP off, since Let’s Encrypt no longer runs OCSP responders.

   # Import each file (Base64 Encoded Certificate (PEM), no private key), then add
   # all of them as CA Certificates of one Certificate Profile (isMalicious-LE).
   https://letsencrypt.org/certs/isrgrootx1.pem
   https://letsencrypt.org/certs/isrg-root-x2.pem
   https://letsencrypt.org/certs/gen-y/root-ye.pem
   https://letsencrypt.org/certs/gen-y/root-x2-by-x1.pem
   https://letsencrypt.org/certs/gen-y/root-ye-by-x2.pem
   https://letsencrypt.org/certs/gen-y/int-ye1.pem
   https://letsencrypt.org/certs/gen-y/int-ye2.pem
   https://letsencrypt.org/certs/gen-y/int-ye3.pem

3. 3

   Add the IP list

   Objects › External Dynamic Lists › Add: name isMalicious-IPs, Type IP List, Source the URL below, Certificate Profile isMalicious-LE. Turn on Client Authentication with the API key as Username and the API secret as Password and Confirm Password. Set Check for updates to Hourly (the documented default differs between pages) and click OK. Test Source URL is not available once authentication is on.

   https://api.ismalicious.com/blocklist/download/blocklist-ips-critical50k.txt

4. 4

   Deny the list in security rules

   Policies › Security › Add two rules above your allow rules: one with isMalicious-IPs as Destination Address for outbound traffic, one with it as Source Address for inbound traffic, both with Application any, Service any (a new rule defaults to application-default, which matches each application on its standard ports only), Action Deny and logging on. Then Commit.
5. 5

   Import the list and check its size

   Select the list under Objects › External Dynamic Lists and click Import Now. List Entries and Exceptions should then hold 50,000 entries for blocklist-ips-critical50k.txt. About 5,000 is the 10% sample: the firewall did not send the credentials (see Troubleshooting).
6. 6

   Sinkhole the domains (optional)

   • Add a second EDL, isMalicious-Domains, with Type Domain List, blocklist-domains-c2.txt as the source, the same certificate profile and client authentication, and Check for updates set to Hourly.
   • In Objects › Security Profiles › Anti-Spyware, edit or clone a profile and, on the DNS Policies tab, add the EDL under External Dynamic Lists and set its Policy Action to sinkhole (it defaults to allow), keeping DNS Sinkhole enabled.
   • Attach the profile to the security rule that allows DNS, then Commit.

• List Entries and Exceptions shows the entries the firewall retrieved: 50,000 for critical50k, since the header lines do not count. Filter for an address to check it.
• List Capacities, on the same page, shows the entries used against what the model supports, per type.
• Monitor › Logs › System shows a rejected username or password as edl-cli-auth-failure and a certificate failure as tls-edl-auth-failure. A failed fetch reads “EDL(isMalicious-IPs) Unable to fetch external dynamic list”, followed by the reason and “Using old copy for refresh.”
• Monitor › Logs › Traffic shows the denied sessions; Device › Troubleshooting › Security Policy Match tests a listed address against your rules.

# Operational mode. The output shows 100 entries: read "Total valid entries".
request system external-list show type ip name isMalicious-IPs
request system external-list show type domain name isMalicious-Domains

# The EDL capacities of this model:
show system state | match max-edl

# Monitor > Logs > System, authentication and certificate failures:
(eventid eq edl-cli-auth-failure)
(eventid eq tls-edl-auth-failure)

• Whether PAN-OS sends the credentials with its first request, or only after a 401, is not documented and was not verified on a device. The download endpoint answers a request without credentials with the 10% sample rather than a 401, which is why the import step checks the count.
• Where List Capacities shows 50,000 IPs, blocklist-ips-critical50k.txt fills the budget and leaves nothing for other IP lists; Palo Alto’s predefined lists do not count toward it.
• No header-less file is served: the header lines are skipped, which is harmless, but they are there.
• The certificate profile must follow Let’s Encrypt’s intermediates as they rotate. The certificate is ECDSA today; an RSA reissue would need the RSA chain from the same page.
• No CIDR or ranges are served: PAN-OS accepts them, but the IP lists hold single addresses.
• Domain lists need a Threat Prevention or Advanced Threat Prevention license.
• The 10% sample is the first tenth of an unsorted file, not the riskiest tenth.

• FG

  FortiGate threat feed

  IP and domain feeds with basic authentication

• pf

  pfSense malicious IP blocklist

  A URL Table alias or pfBlockerNG feed through a relay

• OP

  OPNsense blocklist

  URL Table aliases with Basic authorization

• MT

  MikroTik adlist blocklist

  Threat domains as a RouterOS DNS adlist

• nf

  Linux firewall IP blocklist

  Threat IPs as nftables sets on any Linux host

• Firewall blocklist automation

  Keep firewall blocklists current

• IP & domain blocklist

  Every list, level and category

• STIX/TAXII threat intelligence feeds

  TAXII 2.1 collections for SIEMs and TIPs

• Threat intelligence API documentation

  Authentication, endpoints and limits

• IP reputation check

  Check one address before you block it