Firewall guides
Step-by-step guides for iptables, pfSense, FortiGate and Palo Alto. Any firewall that reads a URL list works.
Solutions
Firewall Enhancement Dynamic threat blocklists
Point your firewall at a blocklist URL: IPs, domains, URLs or hashes, by severity or category.
No credit card required · Free API key
By the numbers
Threats Your Firewall Would Block
Blocklist categories available as firewall feeds.
Current data sample
public samplepublic sample
29 986 142
Total threats
20 416 459
Malicious domains
9 569 683
Malicious IPs
591
Sources in the corpus
By the numbersUpdated Oct 17, 03:33 UTC · Counters read at 2026-10-17T06:25:18.125Z. Indicator dates vary by source.public sample
Get Free Blocklist Access
No credit card required · Free: a 10% sample of each list · full lists on paid plans
- Indicator types: IP, domain, URL, hash
- 4
- Formats: plain text, hosts, dnsmasq, AdGuard
- 4
- Guides: iptables, pfSense, FortiGate, Palo Alto
- 4
- Free sample; full lists on paid plans
- 10%
Capabilities
Key features at a glance.
Scheduled rebuilds
Lists are rebuilt on a schedule; /blocklist/stats shows each file’s freshness, no key needed.
IP Blocklists
Malicious IPs by severity or category, including C2, botnet, brute force, Tor and proxy.
Domain Blocklists
Phishing, malware, scam and spam domains, also in hosts, dnsmasq and AdGuard formats.
Choose the scope
Pick a severity level from critical to low, or a single category, for each list.
False positives
Report a wrong listing at /delist. Pro and Enterprise teams can also exclude it from their TAXII pulls.
Applications
Use cases to evaluate first.
Perimeter Defense
Block known malicious IPs at the network edge.
C2 Prevention
Cut malware off from its command-and-control servers.
Phishing Protection
Block access to phishing and scam domains.
DNS filtering
Load domain lists into dnsmasq or AdGuard resolvers.
FAQ
Frequently asked questions.
Which firewalls do you support?
Any firewall that fetches a list over HTTPS. Step-by-step guides cover iptables, pfSense, FortiGate and Palo Alto.
How often are blocklists updated?
Lists are regenerated on a schedule, not per event. GET /blocklist/stats returns the available files and their freshness without an API key.
What types of blocklists are available?
IPs, domains, URLs and file hashes, each by severity level or by category such as phishing, malware, C2 or ransomware, plus lists per malware family.
Can I whitelist false positives?
Yes. Pro and Enterprise teams can maintain false-positive exceptions in the Team hub. Excluded items are filtered from your global TAXII pulls.
Research
Related articles from the research blog.
Blog post
IOC Expiration: When to Remove an IP From a Blocklist
Manage IOC expiration with separate DNS, evidence and STIX validity clocks. Review stale IP blocks, process withdrawals and preserve the audit trail.
Read more
Blog post
IP Blacklisted? Check for a False Positive Before Blocking
Check DNSBL scope, shared IPs, stale evidence and lookup errors to find why an IP was blacklisted and choose a proportionate response.
Read more
Blog post
Enhancing Zero Trust with Malicious IP and Domain Reputation Analysis
Zero Trust security demands constant verification. Discover how integrating malicious IP and domain reputation checks strengthens your threat intelligence and prevents phishing.
Read moreTest it with your own indicators.
The free plan includes 50 lookups a month. Check the sources and limits, then connect the API.
No credit card required · Free API key