Hey, I'm on Twitter

Public Blocklists of Suspected Malicious IPs and URLs

Several organizations maintain and publish blocklists (a.k.a blacklists) of IP addresses and URLs of systems and networks suspected in malicious activities on-line. Here are the publicly-available lists:

• ATLAS from Arbor Networks: Free; registration required by contacting Arbor
• CYMRU Bogon List: Free
• DShield Blocklist: Free
• DShield Highly Predictive Blacklist: Free; registration required
• hpHosts File: Free; limited automation on request
• Malware Domain Blocklist: Free for non-commercial use
• MalwareDomainList.com Hosts List: Free
• Malware Patrol's Malware Block Lists: Free for non-commercial use
• MalwareURL List: Free for non-commerical use
• PhishTank Phish Archive: Free; query database via API
• Project Honey Pot's Directory of Malicious IPs: Free; registration required to view more than 25 IPs
• Shadowserver IP and URL Reports: Free; registration and approval required
• ThreatStop: Paid; free trial available
• URL Blacklist: Paid; first download free.
• ZeuS Tracker Blocklist: Free

The lists differ in format, goals, and data-collection methodology. Be sure to read about the list before making use of it.

Any blocklist sources that should be on this list, but are missing? Let me know.

For a listing that includes SPAM blacklists and lookups, take a look at OkamalO's page of Malicious IPs and URL FREE Databases.

My other lists of on-line security resources outline Automated Malware Analysis Services and On-Line Tools for Malicious Website Lookups.