Which free IP blocklists stop real attacks?

Every month we take every address that attacked LogTriage's production server — SSH brute force and web scanning — and check which free blocklists already had it. The result: how much real attack traffic each list would have blocked.

An ordinary cloud server running a production API, not a honeypot. Aggregates only: no individual IP address is published. Data under CC BY 4.0.

October 2026 edition

24 Sep – 23 Oct 2026

  • IPsum (on 1+ lists) listed 66% of the 7,110 attacking addresses — the sources of 84% of the attack traffic, more than any other single list.
  • Spamhaus DROP holds only 1,688 entries, yet its networks sent 40% of the attack traffic: much of it comes from a few hostile networks.
  • IPsum (on 1+ lists) and FireHOL level 1 together covered 91% of the attack traffic; the best third list added 0.2 points.
  • 33% of the attacking addresses were on no list at all, but they sent only 8.4% of the traffic; 98 of the 100 busiest attackers were listed.
  • Tor exit nodes and Feodo Tracker botnet C2 matched almost nothing (<0.1% and 0% of the traffic): scanners and brute-forcers do not come through Tor, and a botnet command-and-control list is for outbound connections.
  • CINS Army listed 16% of the attackers but only 3.3% of the traffic: the addresses it knows are the occasional, low-volume ones.
7,110
Attacking addresses
3,727 SSH · 3,596 web
136,441
SSH connections
that never logged in
61,271
Unsolicited web requests
probes, scanners, exploits
91%
Covered by two free lists
IPsum (on 1+ lists) + FireHOL level 1

Share of attack traffic each list covers

SSH connections and unsolicited web requests from addresses on the list, as a share of all attack traffic in the window.

  1. IPsum (on 1+ lists) 84%

    128,244 entries · 66% of attacking addresses

  2. FireHOL level 2 69%

    22,151 entries · 34% of attacking addresses

  3. IPsum level 3 (on 3+ lists) 65%

    19,670 entries · 41% of attacking addresses

  4. blocklist.de (all) 59%

    27,594 entries · 20% of attacking addresses

  5. FireHOL level 1 52%

    4,638 entries · 13% of attacking addresses

  6. blocklist.de (SSH) 42%

    4,892 entries · 17% of attacking addresses

  7. Spamhaus DROP 40%

    1,688 entries · 6% of attacking addresses

  8. AbuseIPDB blacklist (top 10,000) 38%

    10,000 entries · 19% of attacking addresses

  9. IPsum level 5 (on 5+ lists) 33%

    5,289 entries · 22% of attacking addresses

  10. FireHOL level 3 32%

    10,510 entries · 26% of attacking addresses

  11. GreenSnow 23%

    5,359 entries · 14% of attacking addresses

  12. DShield top 20 networks 13%

    20 entries · 7.9% of attacking addresses

  13. Binary Defense banlist 11%

    1,145 entries · 3.4% of attacking addresses

  14. Emerging Threats compromised IPs 3.5%

    482 entries · 1.4% of attacking addresses

  15. CINS Army 3.3%

    15,000 entries · 16% of attacking addresses

  16. Tor exit nodes <0.1%

    1,218 entries · <0.1% of attacking addresses

  17. Feodo Tracker botnet C2 0%

    5 entries · 0% of attacking addresses

All lists, side by side

"Addresses" is the share of attacking addresses on the list; "traffic" the share of their activity. "Top 100" is how many of the 100 busiest attackers it lists; "only list" the attackers no other measured list had.

List Entries SSH addresses Web addresses All addresses Traffic Top 100 Only list
IPsum (on 1+ lists) 128,244 64% 69% 66% 84% 90 15%
FireHOL level 2 22,151 44% 25% 34% 69% 82 0.1%
IPsum level 3 (on 3+ lists) 19,670 48% 37% 41% 65% 73 —
blocklist.de (all) 27,594 33% 7.1% 20% 59% 67 <0.1%
FireHOL level 1 4,638 12% 15% 13% 52% 78 0%
blocklist.de (SSH) 4,892 31% 2.4% 17% 42% 46 —
Spamhaus DROP 1,688 5.7% 6.7% 6% 40% 47 0%
AbuseIPDB blacklist (top 10,000) 10,000 24% 15% 19% 38% 41 0.1%
IPsum level 5 (on 5+ lists) 5,289 32% 13% 22% 33% 41 —
FireHOL level 3 10,510 17% 38% 26% 32% 56 0.3%
GreenSnow 5,359 24% 2.8% 14% 23% 19 0%
DShield top 20 networks 20 6.6% 10% 7.9% 13% 32 0%
Binary Defense banlist 1,145 3.2% 4.4% 3.4% 11% 20 0%
Emerging Threats compromised IPs 482 2.5% 0.6% 1.4% 3.5% 5 0%
CINS Army 15,000 6.9% 26% 16% 3.3% 1 <0.1%
Tor exit nodes 1,218 0% <0.1% <0.1% <0.1% 0 0%
Feodo Tracker botnet C2 5 0% 0% 0% 0% 0 0%
On no list 33% 8.4% 2

For comparison, the ranges LogTriage itself scores against (Spamhaus DROP, FireHOL level 1 and ranges from confirmed incidents) covered 53% of the traffic.

Combining lists

Each step adds the list that covers the most traffic the previous ones missed (one list per source, the broadest variant).

  1. 1. IPsum (on 1+ lists)

    84% of the attack traffic · 66% of the attacking addresses

  2. 2. IPsum (on 1+ lists) + FireHOL level 1

    91% of the attack traffic · 67% of the attacking addresses

  3. 3. IPsum (on 1+ lists) + FireHOL level 1 + FireHOL level 2

    92% of the attack traffic · 67% of the attacking addresses

Using the lists on a Linux server

IPsum at level 3 and up, as in the project's own README (run it daily — the list is rebuilt every 24 hours): 

sudo -i
apt-get update && apt-get install -y iptables ipset
ipset -q flush ipsum
ipset -q create ipsum hash:ip
for ip in $(curl https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt 2>/dev/null | grep -v "#" | grep -Ev '[[:space:]]([12])$' | cut -f 1); do ipset add ipsum $ip; done
iptables -D INPUT -m set --match-set ipsum src -j DROP 2>/dev/null
iptables -I INPUT -m set --match-set ipsum src -j DROP

FireHOL level 1, which holds networks rather than single addresses (hash:net). Replace eth0 with your public interface: 

# Refresh into a temporary set, then swap it in (no window without protection)
ipset -exist create firehol_level1 hash:net
ipset -exist create firehol_level1_tmp hash:net
ipset flush firehol_level1_tmp
curl -fsS https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level1.netset | grep -v '^#' | while read -r net; do ipset add firehol_level1_tmp "$net"; done
ipset swap firehol_level1_tmp firehol_level1 && ipset destroy firehol_level1_tmp

# Once. Internet-facing interface only: level 1 includes 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16
iptables -I INPUT -i eth0 -m set --match-set firehol_level1 src -j DROP
# Ports published by Docker never pass INPUT; filter them in Docker's DOCKER-USER chain
iptables -I DOCKER-USER -i eth0 -m set --match-set firehol_level1 src -j DROP

Spamhaus asks that DROP be downloaded at most once a day and credited when used in a product. Whatever the list, schedule the refresh: a blocklist that is a month old has lost most of the addresses that made it useful.

Questions

What is the best free IP blocklist?
On our server, IPsum (on 1+ lists) covered the most attack traffic (84%) of the 17 free lists measured, and IPsum (on 1+ lists) with FireHOL level 1 together covered 91%. Coverage is not the only criterion: a bigger list also has more room for false positives, so prefer the smallest list that covers what you need.
Which IPsum level should I block?
IPsum gives every address the number of public lists that name it. Level 1 (on any list) covered 84% of the attack traffic, level 3 65% and level 5 33%. The project's own ipset example blocks level 3 and up, trading some coverage for fewer addresses named by a single list.
Does blocking Tor exit nodes stop attacks?
Not the attacks we see: Tor exit relays sent <0.1% of the attack traffic in this window. SSH brute force and web scanning come from rented servers and compromised hosts, not through Tor. Block Tor only if you have a reason to refuse anonymous visitors.
Why are so many attackers on no list?
33% of the attacking addresses were on none of the lists, but they sent only 8.4% of the traffic. They are mostly addresses that tried a handful of times, too quiet to be reported. Blocklists stop the persistent, high-volume sources; rate limiting and key-only SSH handle the rest.
Can a blocklist block legitimate users?
Yes. Lists built from reports can contain shared addresses (mobile carriers, cloud NAT, VPN exits), and FireHOL level 1 deliberately includes private and reserved ranges, which will cut off your own networks if you apply it to internal interfaces. An attacked server cannot measure false positives, so this report measures coverage only.
How is this measured?
For 30 days we collect every address that attacked LogTriage's production server — SSH connections that never logged in and unsolicited web requests — excluding our own monitoring and logins. At the end of the window we download each list and count how many of those addresses, and how much of their traffic, it contains. Only totals are published; no address ever is.

Method and caveats

  • Attackers: every address that opened an SSH connection without logging in, or sent the API an unsolicited web request (probes, scanners, exploit attempts), over 30 days. Our own monitoring, the operator's logins and Cloudflare's edge addresses are excluded.
  • Traffic counts SSH connections and web requests; one address can be in both. The 100 busiest attackers are ranked by that total.
  • Lists were downloaded on 2026-10-24, after the window, from each provider's public URL; the table links each provider.
  • Feeds were downloaded when the report ran, after the window: a list that adds attackers quickly and keeps them for weeks scores higher than one that would have blocked them before their first attempt.
  • Bigger lists catch more and also risk blocking legitimate addresses; an attacked server cannot measure that side, so weigh coverage against list size.
  • SSH is counted in pre-authentication connections: the server has accepted keys only since 2026-10-06, so password failures no longer measure attack volume.
  • The server: LogTriage's production API server (Hetzner, Germany): port 22 open to the internet, key-only since 6 October 2026 (password and keyboard-interactive authentication off); nginx in front of the API on ports 80 and 443.

The numbers for every edition: October 2026 (JSON).

Related

Check your own attackers against threat intelligence

LogTriage reads 51 log formats, enriches every source address against threat intelligence and writes an analyst-grade report in minutes. Try the live demo — no signup.

Try Live Demo → Analyze your own logs