IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
Integrations https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY Get an API key
Integrations

IP Blocklist Integrations for Firewalls and SIEM

IP-DB is a plain, key-authenticated REST API that works with anything speaking HTTP: a live blocklist for your firewall, enrichment for your SIEM, automatic reporting from your servers.

Feed addresses40,125hourly snapshot
Categories10
Platforms29copy-paste guides
Formats4plain · cidr · json · csv

Blocklist feed

A live blocklist, one IP per line, that your firewall refreshes from a URL on its own schedule. The feed is the highest-scoring addresses from redistributable sources, confirmed by at least two independent source families — no noise, no unlicensed data. Build your feed URL below.

https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY

Free5,000 addresses / fetch
Verified50,000 addresses / fetch
Morefree on request

Format hands you the same list as the file the target product expects — FortiGate CLI, an ipset script, nftables, RouterOS, Suricata rules, a Wazuh CDB list. Delta returns only the addresses first listed inside the window you choose, so a scheduled job need not pull the whole list every time. Existing feed URLs keep working exactly as before: the default format has not changed.

The feed uses your API key (create a key) and counts toward your daily usage; every fetch returns the latest snapshot. For the complete bulk download use /datasets (CSV, JSON, TXT, MMDB · CC BY-SA 4.0).

WordPress plugin

A ready-made plugin for WordPress. It mirrors IP-DB's blocklist into your own site, checks the address behind login, comment, registration and checkout requests, and reports what attacks you back to the pool. Beyond your API key there is nothing to configure.

IP-DB Threat Protection WordPress 5.8+ · PHP 7.4+ · WooCommerce and multisite
Download the plugin (.zip) Free API key
Version
1.1.1
Size
104 KB
License
GPL-2.0+
Updates
ip-db.com

SHA-256439fa9136209d5ed500e682da8222bbfa62c09245eed452fff48a177177af495

example.com/wp-admin/admin.php?page=ipdb
The plugin's own dashboard. The figures are illustrative.

What it does

The login page

Refuses the login page to listed addresses, and counts failed sign-ins per address.

Comments and pingbacks

Marks, holds or outright refuses comments and pingbacks — whichever you choose.

Independent switches

Independent switches for registration, WooCommerce checkout, unauthenticated REST calls and XML-RPC.

Dashboard and activity log

A dashboard for what was blocked, held and reported, plus a filterable activity log you can export as CSV.

Reverse proxies

Explicit reverse-proxy handling: Cloudflare, X-Forwarded-For and a trusted-proxy list — because anything a client can send, a client can forge.

Everyday operation

WP-CLI commands, Site Health checks, a translated interface and self-updating — updates appear on the Plugins screen the usual way.

How it decides

Two sources of truth, deliberately kept apart.

hot path

The mirrored blocklist

One indexed query. It can run on the hot path — on every anonymous page view, if you want it to — and spends nothing from your quota.

spends quota

A live API lookup

Only on the requests that are worth a call: a login attempt, a comment, a sign-up, a checkout.

It was written to be safe to switch on. Monitor mode logs every decision without blocking anything, so you can read a day of real traffic before trusting a threshold. The address you activate it from goes on the allow list, administrators are exempt in any case, and an unanswered lookup lets the request through — the plugin never fails closed.

Installation

  1. Download the plugin, then install it with Plugins → Add New → Upload Plugin and activate it.
  2. Paste your free API key into IP-DB → Settings.
  3. Press Sync blocklist now on the dashboard. WP-Cron keeps it fresh from then on.
  4. Leave it in monitor mode for a day, read the activity log, then switch to blocking.
  5. If you want to give something back, switch reporting on under the Reporting tab.

The sync runs on WP-Cron; on a quiet site a real cron entry hitting wp-cron.php is more reliable. When the list goes stale the plugin raises it on the Site Health screen, so the problem surfaces where you already look for problems.

Turn reporting on and the brute-force runs and comment spam your site absorbs go back into the pool — including comments a moderator marks as spam by hand, which is the most reliable signal a site has to offer. Reports do not count against your lookup quota.

The moment the plugin makes its first call with your key, your site appears in My shields in your dashboard, tagged WordPress, with its version, last report and call count. While it keeps reporting, your account stays on the contributor tier.

WP-CLI
wp ipdb status wp ipdb sync wp ipdb check 185.220.101.45 wp ipdb report 203.0.113.9 --categories=brute_force --comment="20 failed logins" wp ipdb flush --blocklist

Updates are served from ip-db.com: the plugin uses WordPress 5.8’s Update URI header, so a new version shows up on the Plugins screen exactly as it would for a directory plugin.

fail2ban

Have fail2ban automatically report the same IP to IP-DB the moment it bans it. Create /etc/fail2ban/action.d/ipdb-report.conf:

[Definition] actionban = curl -s -X POST https://ip-db.com/api/v1/report \ -H "Key: YOUR_API_KEY" -H "Content-Type: application/json" \ -d '{"ip":"<ip>","categories":["brute_force"],"comment":"fail2ban jail: <name>"}' actionunban =

Then add it to the relevant jail's jail.local definition — for sshd, for example:

[sshd] enabled = true action = %(action_)s ipdb-report

Palo Alto Networks

Wire our pool directly into PAN-OS as an External Dynamic List (EDL) — no separate sync script needed, the firewall pulls the list itself on a schedule.

  1. Objects → External Dynamic Lists → Add
  2. Type: IP List
  3. Source URL: https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY
  4. Repeat: Hourly (the pool itself refreshes every 30 minutes)
  5. Reference the EDL in a Security Policy rule's source/destination field

To scope it to one category, append &category=tor_exit (see the API docs for valid values).

Step-by-step guide: certificate profile, service route, policy order, and verification→

Fortinet FortiGate

FortiGate's Threat Feed external connector consumes the same plain-text URL.

GUI: Security Fabric → External Connectors → Create New → Threat Feed → IP Address. Or via CLI:

config system external-resource edit "ipdb-blacklist" set type address set resource "https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY" set refresh-rate 30 next end

Then reference that external-resource as the source address in a firewall policy set to deny.

Step-by-step guide: policy design, verification commands, and troubleshooting→

iptables / ipset (generic Linux)

Paginate /api/v1/blacklist to pull the whole pool into an ipset, then block it with a single iptables rule. Running it every 30 minutes via cron is enough — the pool itself refreshes on that same cadence.

sync_blacklist.py
#!/usr/bin/env python3 import subprocess, requests API_KEY = "YOUR_API_KEY" BASE = "https://ip-db.com/api/v1/blacklist" subprocess.run(["ipset", "create", "ipdb-blacklist", "hash:net", "-exist"]) page = 1 while True: r = requests.get(BASE, params={"page": page, "limit": 1000}, headers={"Key": API_KEY}) r.raise_for_status() payload = r.json() for entry in payload["data"]: subprocess.run(["ipset", "add", "ipdb-blacklist", entry["cidr"], "-exist"]) if page * payload["limit"] >= payload["total"]: break page += 1
crontab
*/30 * * * * /usr/bin/python3 /opt/scripts/sync_blacklist.py >> /var/log/ipdb-sync.log 2>&1

One-time setup — add the rule that actually enforces the ipset:

iptables -I INPUT -m set --match-set ipdb-blacklist src -j DROP

Cisco Secure Firewall (FTD / FMC)

Cisco Secure Firewall (FTD) consumes a URL feed natively through FMC — no script needed. Define it as a Security Intelligence network list and block it on the access control policy's Security Intelligence tab.

# FMC: Objects → Object Management → Security Intelligence # → Network Lists and Feeds → Add Network Feed Name: ipdb-blacklist Feed URL: https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY Update Frequency: 30 minutes # Access Control Policy → Security Intelligence → Networks # ipdb-blacklist -> Block list

Check Point

Check Point R80.20 and later pulls an external indicator source as a Custom Intelligence Feed. Our feed carries one value per line, so the value column is 1.

# Security Gateway CLI (R80.20+) ioc_feeds add \ --feed_name ipdb \ --transport "https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY" \ --format CSV --value_column 1 --feed_action Prevent ioc_feeds show # SmartConsole: Threat Prevention → Custom Policy → Threat Indicators

Juniper SRX

SRX can feed an external list into a dynamic address group. Define the feed server, then use the address group as the source in a security policy.

set security dynamic-address feed-server ipdb url "https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY" set security dynamic-address feed-server ipdb update-interval 1800 set security dynamic-address feed-server ipdb feed-name blocklist path "/" set security dynamic-address address-name ipdb-blocklist profile feed-name blocklist set security policies from-zone untrust to-zone trust policy block-ipdb \ match source-address ipdb-blocklist destination-address any application any set security policies from-zone untrust to-zone trust policy block-ipdb then deny

pfSense / pfBlockerNG

pfBlockerNG accepts URL-based IPv4 lists directly: <span class="mono">Firewall → pfBlockerNG → IPv4 → Add</span>, with the feed URL as the source.

Format: Auto Source: https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY Header/Label: ipdb_blacklist Update Frequency: Every 1 hour List Action: Deny Both

OPNsense

In OPNsense create an alias of type URL Table; the firewall refreshes the list on its own schedule.

# Firewall → Aliases → Add Type: URL Table (IPs) Content: https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY Refresh: 1 # gun / day / Tag / dia # Firewall → Rules → WAN: Source = ipdb_blacklist, Action = Block

MikroTik RouterOS

On RouterOS, use a script that downloads the list into an address-list, then drop that list with a single firewall rule.

# RouterOS 7.x /tool fetch url="https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY&category=botnet_c2" \ mode=https dst-path=ipdb.rsc /ip firewall address-list remove [find list=ipdb] :foreach line in=[:toarray [/file get ipdb.rsc contents]] do={ /ip firewall address-list add list=ipdb address=$line } /ip firewall filter add chain=forward src-address-list=ipdb action=drop \ comment="ip-db.com blocklist"

nftables

On modern distributions running nftables, a named set is the direct equivalent of an ipset.

nft add table inet filter nft add set inet filter ipdb '{ type ipv4_addr; flags interval; }' nft add rule inet filter input ip saddr @ipdb drop # cron: her 30 dakikada bir / every 30 minutes curl -fsS "https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY" \ | grep -E '^[0-9]' | paste -sd, - \ | xargs -I{} nft flush set inet filter ipdb \; add element inet filter ipdb { {} }

Windows Firewall

On Windows Server, create one rule with PowerShell and update its remote address list. Use a category filter — a single rule holds a limited number of addresses.

# PowerShell $ips = (Invoke-RestMethod "https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY&category=botnet_c2") ` -split "`n" | Where-Object { $_ -match '^\d' } if (Get-NetFirewallRule -Name ipdb-block -ErrorAction SilentlyContinue) { Set-NetFirewallRule -Name ipdb-block -RemoteAddress $ips } else { New-NetFirewallRule -Name ipdb-block -DisplayName "ip-db.com blocklist" ` -Direction Inbound -Action Block -RemoteAddress $ips }

Wazuh

Since Wazuh isn't a firewall, the logic runs the other way: instead of a firewall pulling data from us, Wazuh reports to us the moment it raises an alert. This uses Wazuh's custom integration script mechanism — the structure below is a solid starting point, adapt it to your environment.

ossec.conf
<integration> <name>custom-ipdb-report</name> <hook_url>https://ip-db.com/api/v1/report</hook_url> <api_key>YOUR_API_KEY</api_key> <rule_id>5712,5720,5760</rule_id> <alert_format>json</alert_format> </integration>
/var/ossec/integrations/custom-ipdb-report.py
#!/usr/bin/env python3 import sys, json, requests alert_file, api_key = sys.argv[1], sys.argv[2] alert = json.load(open(alert_file)) src_ip = alert.get("data", {}).get("srcip") if src_ip: requests.post("https://ip-db.com/api/v1/report", headers={"Key": api_key}, json={ "ip": src_ip, "categories": ["brute_force"], "comment": f"Wazuh rule {alert['rule']['id']}: {alert['rule']['description']}", }, timeout=5)

Swap the rule_id list for the real brute-force/attack rule IDs in your environment, and remember to make the script executable (chmod +x).

Step-by-step guide: CDB lists, the match rule, and active response→

Splunk

Load the feed into a KV Store lookup and match at search time, so every event whose source IP is in the pool gets flagged.

# $SPLUNK_HOME/etc/apps/ipdb/bin/sync.sh — cron, 30 dk / 30 min curl -fsS "https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY" \ | awk 'BEGIN{print "cidr"} /^[0-9]/{print}' \ > $SPLUNK_HOME/etc/apps/ipdb/lookups/ipdb_blacklist.csv # SPL — kaynak IP havuzda mi? / is the source IP in the pool? index=firewall | lookup ipdb_blacklist cidr AS src_ip OUTPUT cidr AS ipdb_match | where isnotnull(ipdb_match) | stats count by src_ip, dest_port

Elastic Security

For Elastic Security's indicator match rule, write the feed into a threat indicator index.

# gostergeleri indekse yaz / write indicators into the index curl -fsS "https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY&category=botnet_c2" \ | grep -E '^[0-9]' | sed 's|/32$||' \ | while read ip; do echo '{"index":{}}' echo "{\"@timestamp\":\"$(date -u +%FT%TZ)\",\"threat\":{\"indicator\":{\"type\":\"ipv4-addr\",\"ip\":\"$ip\",\"provider\":\"ip-db.com\"}}}" done | curl -s -XPOST "$ES/logs-ti_ipdb-default/_bulk" -H 'Content-Type: application/x-ndjson' --data-binary @- # Security → Rules → Create → Indicator Match # Index: logs-ti_ipdb-* | Field: threat.indicator.ip ↔ source.ip

Microsoft Sentinel

In Microsoft Sentinel the practical route is a watchlist, joined against in analytics rules.

# Watchlist olarak yukle / upload as a watchlist curl -fsS "https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY&category=botnet_c2" \ | awk 'BEGIN{print "IPAddress"} /^[0-9]/{sub("/32","");print}' > ipdb.csv # Sentinel → Watchlist → New → alias: ipdb, search key: IPAddress // KQL let ipdb = _GetWatchlist('ipdb') | project IPAddress; CommonSecurityLog | where SourceIP in (ipdb) | summarize count() by SourceIP, DestinationPort

IBM QRadar

Create a reference set in QRadar, populate it over the API, then test against it in your rules.

# referans kumesi olustur / create the reference set curl -s -X POST -H "SEC: $QRADAR_TOKEN" \ "https://$QRADAR/api/reference_data/sets?name=ipdb_blacklist&element_type=IP" # toplu doldur / bulk load curl -fsS "https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY" \ | grep -E '^[0-9]' | sed 's|/32$||' | jq -Rn '[inputs]' \ | curl -s -X POST -H "SEC: $QRADAR_TOKEN" -H "Content-Type: application/json" \ "https://$QRADAR/api/reference_data/sets/bulk_load/ipdb_blacklist" --data-binary @- # Rule: when the source IP is contained in any of ipdb_blacklist

Graylog

Define a lookup table in Graylog with the CSV file adapter and query it for the source IP in your pipeline.

# /etc/graylog/server/ipdb.csv — cron ile yenile / refresh by cron curl -fsS "https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY" \ | awk 'BEGIN{print "ip,listed"} /^[0-9]/{sub("/32","");print $0",true"}' \ > /etc/graylog/server/ipdb.csv # System → Lookup Tables: Data Adapter = CSV File, Cache = In-Memory # Pipeline rule: rule "ipdb lookup" when has_field("src_ip") then set_field("ipdb_listed", lookup_value("ipdb", to_string($message.src_ip))); end

SIEM /Automation Platforms

There's no official plugin — you don't need one. The API is plain JSON over REST with a Key header, so it works directly with the generic "HTTP request" / "Webhook" step in Zapier, Make, n8n, Splunk (via an HEC-forwarding script), or any SOAR playbook. Auth: a custom header, Key: YOUR_API_KEY.

Suricata

Suricata 6 and later can match datasets directly inside a rule.

# /var/lib/suricata/ipdb.list curl -fsS "https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY" \ | grep -E '^[0-9]' | sed 's|/32$||' > /var/lib/suricata/ipdb.list # local.rules alert ip [!$HOME_NET] any -> $HOME_NET any (msg:"ip-db.com listed source"; \ dataset:isset,ipdb,type string,load ipdb.list; sid:9000001; rev:1;)

Snort

Snort 2.9's reputation preprocessor reads a plain IP list file.

# snort.conf preprocessor reputation: \ blacklist /etc/snort/rules/ipdb.blacklist, \ memcap 1000, \ nested_ip both # cron curl -fsS "https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY" \ | grep -E '^[0-9]' > /etc/snort/rules/ipdb.blacklist

Zeek

Zeek's Intel framework expects a tab-separated indicator file.

# /opt/zeek/share/zeek/site/intel/ipdb.dat (sekmeyle ayrilmis / tab separated) curl -fsS "https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY&category=botnet_c2" \ | grep -E '^[0-9]' | sed 's|/32$||' \ | awk 'BEGIN{OFS="\t"; print "#fields","indicator","indicator_type","meta.source"} {print $1,"Intel::ADDR","ip-db.com"}' > intel/ipdb.dat # local.zeek @load frameworks/intel/seen redef Intel::read_files += { "/opt/zeek/share/zeek/site/intel/ipdb.dat" };

CrowdSec

Add the pool to CrowdSec as a custom blocklist; your existing bouncers enforce the decisions.

curl -fsS "https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY&category=botnet_c2" \ | grep -E '^[0-9]' | sed 's|/32$||' \ | while read ip; do cscli decisions add --ip "$ip" --duration 24h \ --reason "ip-db.com blocklist"; done cscli decisions list --scope Ip | head

Nginx

Nginx's geo module can include a generated map file directly.

# /etc/nginx/conf.d/ipdb.map olustur / generate curl -fsS "https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY" \ | awk '/^[0-9]/{print $1" 1;"}' > /etc/nginx/conf.d/ipdb.map # nginx.conf (http blogu / http block) geo $ipdb_blocked { default 0; include /etc/nginx/conf.d/ipdb.map; } server { if ($ipdb_blocked) { return 403; } }

Apache

On Apache 2.4, read a generated file with RewriteMap and refuse matching requests.

curl -fsS "https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY" \ | awk '/^[0-9]/{sub("/32","");print $1" deny"}' > /etc/apache2/ipdb.txt # httpd.conf RewriteEngine On RewriteMap ipdb "txt:/etc/apache2/ipdb.txt" RewriteCond ${ipdb:%{REMOTE_ADDR}|ok} =deny RewriteRule ^ - [F,L]

HAProxy

HAProxy reads an ACL straight from a file, and it can also be updated through the Runtime API without a reload.

curl -fsS "https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY" \ | grep -E '^[0-9]' > /etc/haproxy/ipdb.lst # haproxy.cfg frontend web bind :443 ssl crt /etc/ssl/site.pem acl ipdb_blocked src -f /etc/haproxy/ipdb.lst http-request deny deny_status 403 if ipdb_blocked # yeniden yuklemeden guncelle / update without a reload echo "add map #0 <ip> 1" | socat stdio /var/run/haproxy.sock

Cloudflare

Create an IP list in Cloudflare and reference it from a WAF rule. List size is plan-limited, so use a category filter.

# Rules → Lists → Create (kind: ip) curl -fsS "https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY&category=botnet_c2" \ | grep -E '^[0-9]' | jq -Rn '[inputs | {ip: .}]' \ | curl -s -X PUT -H "Authorization: Bearer $CF_TOKEN" -H "Content-Type: application/json" \ "https://api.cloudflare.com/client/v4/accounts/$CF_ACCOUNT/rules/lists/$LIST_ID/items" \ --data-binary @- # WAF custom rule: (ip.src in $ipdb) → Block

AWS WAF

AWS WAF IP sets take CIDRs. There is a per-set entry limit, so narrow it with a category.

ADDRS=$(curl -fsS "https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY&category=botnet_c2" \ | grep -E '^[0-9]' | jq -Rn '[inputs]') LOCK=$(aws wafv2 get-ip-set --name ipdb --scope REGIONAL --id $IPSET_ID \ --query LockToken --output text) aws wafv2 update-ip-set --name ipdb --scope REGIONAL --id $IPSET_ID \ --lock-token $LOCK --addresses "$ADDRS"

Postfix

Postfix can read a CIDR table as a client restriction, refusing connections to your mail server at the source.

curl -fsS "https://ip-db.com/api/v1/feed.txt?key=YOUR_API_KEY&category=mail_abuse" \ | awk '/^[0-9]/{print $1"\tREJECT ip-db.com listed"}' > /etc/postfix/ipdb.cidr # main.cf smtpd_client_restrictions = check_client_access cidr:/etc/postfix/ipdb.cidr, permit_mynetworks, reject_unknown_client_hostname postfix reload

Minimal Python Client

import requests class IpDbClient: def __init__(self, api_key): self.session = requests.Session() self.session.headers["Key"] = api_key def check(self, ip): r = self.session.get(f"https://ip-db.com/api/v1/check/{ip}") r.raise_for_status() return r.json() def report(self, ip, categories, comment=None): r = self.session.post("https://ip-db.com/api/v1/report", json={"ip": ip, "categories": categories, "comment": comment}) r.raise_for_status() return r.json() client = IpDbClient("YOUR_API_KEY") print(client.check("185.220.101.45")["abuseConfidenceScore"])

API →