Blocklist Downloads

Download our aggregated IP blocklist in the format that suits your infrastructure. Lists are regenerated every 4 hours from ipinsights.io's threat-intelligence feeds.

530685 unique IPs listed. Last generated: 2026-04-04T12:15:07Z

Plain Text

TXT

One IP address per line, sorted. Ready for any tool that accepts a simple IP list.

Download (7.3 MB)

Efficient Blocklist (CIDR)

CIDR

CIDR-aggregated list — consecutive IPs are merged into subnet blocks (e.g. /24, /16) for fewer firewall rules.

Download (5.7 MB)

CSV

CSV

Comma-separated values with IP, source, category and listed date. Import into spreadsheets or SIEMs.

Download (49.3 MB)

iptables Script

SH

Bash script that creates an IPINSIGHTS_BLOCK chain and drops all listed IPs. Run with sudo bash.

Download (27.6 MB)

UFW Script

SH

Bash script that adds ufw deny rules for every listed IP. Run with sudo bash.

Download (18 MB)

Check Point Firewall

JSON

JSON file containing host objects and a group definition. Import via Check Point Management API.

Download (115.4 MB)

Cisco IOS ACL

TXT

Extended ACL configuration that denies all listed IPs. Paste into your Cisco IOS device.

Download (16.4 MB)

STIX 2.1 Bundle

STIX

STIX 2.1 indicator bundle for threat intelligence platforms. Import into MISP, OpenCTI, or any TAXII-compatible TIP.

Download (597.2 MB)
Country Blocklist Generator

Select countries to generate a custom IP blocklist. Only IPs currently listed on active threat-intelligence feeds are included.

Usage Notes

  • All files are regenerated automatically every 4 hours. There is no need to cache or poll more frequently.
  • The plain-text and CSV files work well for automated ingestion via curl or wget.
  • The Efficient CIDR list contains the same IPs as the plain-text file but merges consecutive addresses into CIDR blocks (e.g. a full /24 instead of 256 individual IPs), significantly reducing rule counts for firewalls and routers.
  • The iptables and UFW scripts create or flush a dedicated rule set — they will not disturb your existing rules.
  • The Check Point JSON can be imported with the mgmt_cli tool or the SmartConsole API.
  • The Cisco IOS ACL includes a trailing permit ip any any — remove it if you prefer an implicit deny policy.
  • The STIX 2.1 bundle can be imported directly into platforms like MISP, OpenCTI, or any TAXII-compatible threat intelligence platform. Each IP is represented as a STIX Indicator with a standard pattern.