Blocklist updated
A free IP blocklist, updated every 15 minutes
ThreatHive correlates more than 20 public threat feeds with attack data from our own network of over 50 honeypots, removes major CDNs and public DNS resolvers, and publishes the result as a plain text list your firewall can pull.
- IPs on the blocklist
- 172,489
- IPs tracked in total
- 3,186,550
- Updated every
- 15 minutes
- Sources
- 20+ feeds, 50+ honeypots
New: the blocklist is now also published in 100,000-entry parts that fit UniFi network lists. Read the announcement
Feeds
Plain text, one IPv4 address per line, no authentication. Use the full list if your firewall accepts it. Use the 100k parts on platforms that cap list size at 100,000 entries, such as UniFi.
| Feed | URL | Entries | Copy |
|---|---|---|---|
| Full blocklist | https://threathive.net/hiveblocklist.txt | 172,473 | |
| 100k part A | https://threathive.net/hiveblocklist-100k-a.txt | 100,000 | |
| 100k part B | https://threathive.net/hiveblocklist-100k-b.txt | 72,473 | |
| 100k part C | https://threathive.net/hiveblocklist-100k-c.txt | Reserved, fills past 200,000 |
Major CDNs, public DNS resolvers and uptime monitoring services are excluded to keep false positives down. To check a single address, use the IP lookup.
Setup guides
Step-by-step instructions for loading the feed into common firewalls and security tools.
News
Changes to the feeds and new integrations.
-
Blocklist now available in 100,000-entry parts for UniFi
Three new feed URLs split the blocklist into parts of up to 100,000 IPv4 addresses each, so it fits UniFi's dynamic network lists. The full list is unchanged.
What's on the list
Where the listed addresses are announced from, by network operator and by country. The charts are regenerated along with the list.
How the list is built
ThreatHive doesn't simply mirror public feeds. Every 15 minutes, indicators from more than 20 public threat intelligence feeds are correlated with what our own network of over 50 honeypots observes, and the blocklist is built from that combined picture. Known infrastructure such as major CDNs, public DNS resolvers and uptime monitors is removed before the list is published.
If one of your addresses is listed by mistake, check it with the IP lookup and email [email protected] with the address and a short explanation.
Free to use, not free to run
Tracking 3,186,550 addresses and updating the list every 15 minutes takes servers, bandwidth and honeypots. The project is funded by its users.