{
  "name": "IP-DB.com free IP blocklist",
  "generated_at": "2026-11-02T12:58:03Z",
  "records": 39272,
  "ipv6_records": 28,
  "rule": "single IP addresses listed by at least one source that permits redistribution and by at least 2 independent source families in total",
  "score_basis": "IP-DB's own score, computed from 46 sources",
  "update_interval": "hourly",
  "license": "CC BY-SA 4.0 — https://creativecommons.org/licenses/by-sa/4.0/",
  "attribution": "IP-DB.com (https://ip-db.com/en/datasets); data from the sources listed below",
  "homepage": "https://ip-db.com/en/datasets",
  "fields": {
    "ip": "IPv4 or IPv6 address",
    "score": "IP-DB abuse score 0-100 (see https://ip-db.com/en/sources)",
    "sources": "number of independent source families listing the address",
    "category": "main abuse category",
    "country": "ISO 3166-1 alpha-2 country of the address",
    "asn": "autonomous system number",
    "first_seen": "first time any source listed it (UTC)",
    "last_seen": "latest time any source listed it (UTC)"
  },
  "sources": [
    {
      "name": "Tor Exit Nodes",
      "license": "The Tor Project — CC0 (metrics.torproject.org)",
      "url": "https://check.torproject.org/torbulkexitlist"
    },
    {
      "name": "Tor Exit Nodes (IPv6)",
      "license": "Mirror of the Tor Project exit list — CC0 data",
      "url": "https://raw.githubusercontent.com/SecOps-Institute/Tor-IP-Addresses/master/tor-exit-nodes.lst"
    },
    {
      "name": "IPsum (4+ lists)",
      "license": "stamparm/ipsum — Unlicense (public domain), aggregated from 30+ public lists",
      "url": "https://raw.githubusercontent.com/stamparm/ipsum/master/levels/4.txt"
    },
    {
      "name": "Malicious IP (romainmarcoux)",
      "license": "romainmarcoux/malicious-ip — MIT licence",
      "url": "https://raw.githubusercontent.com/romainmarcoux/malicious-ip/main/full-40k.txt"
    },
    {
      "name": "IPThreat Community Reports",
      "license": "IPThreat.net — CC BY-SA 4.0, commercial use allowed, attribution with link required",
      "url": "https://lists.ipthreat.net/file/ipthreat-lists/threat/threat-30.txt"
    },
    {
      "name": "TweetFeed (infosec community IOCs)",
      "license": "0xDanielLopez/TweetFeed — CC0 1.0 (public domain)",
      "url": "https://raw.githubusercontent.com/0xDanielLopez/TweetFeed/master/month.csv"
    },
    {
      "name": "ShadowWhisperer Threats",
      "license": "ShadowWhisperer/IPs — Unlicense (public domain)",
      "url": "https://raw.githubusercontent.com/ShadowWhisperer/IPs/master/Lists/Threats.csv"
    },
    {
      "name": "IP-DB Sensor Network",
      "license": "IP-DB Sensor Network — our own honeypot observations, CC BY-SA 4.0",
      "url": "https://ip-db.com/en/honeypot"
    }
  ],
  "files": {
    "ip-db-blocklist.txt": {
      "sha256": "512e79b90834b69179cc2a73801738dce89dc2a4ec10dfcba940cb6a5dc22689",
      "bytes": 558326
    },
    "ip-db-blocklist.csv": {
      "sha256": "1c12540c5f5b9e794de1a648eea6e2faa183af0fb058a12578b010cfbcb4a76f",
      "bytes": 3425211
    },
    "ip-db-blocklist.csv.gz": {
      "sha256": "6713596107f94a98e54b47ed935075b7be4cc83e7ba163776b6947f96f595d1c",
      "bytes": 388930
    },
    "ip-db-blocklist.json": {
      "sha256": "d54b5de197ba7701b152918d747edaa0cc3264496bc583cd15c9dda6c6114bfe",
      "bytes": 6844952
    },
    "ip-db-blocklist.mmdb": {
      "sha256": "9f32c8261fb65707f0f6131269688f14b894e3b68f9c4a188ddeeeb1d41b2369",
      "bytes": 2021403
    }
  }
}