Check IP addresses against 12 free blocklists
Paste addresses — one per line, or whole lines from an access log, auth.log, a firewall export or a CSV. Every IPv4 address in the text is checked against IPsum, FireHOL, Spamhaus DROP, blocklist.de, CINS Army, GreenSnow, DShield, Emerging Threats and the Tor exit list. Your browser downloads the lists from GitHub; what you paste never leaves it.
Which of these lists actually stops attacks?
We measure it every month on our own production server: in the latest window, IPsum (on 1+ lists) listed the sources of 84% of 7,110 attackers’ traffic, and IPsum (on 1+ lists) with FireHOL level 1 together 91%. Read the blocklist report →
The lists
| List | What it holds |
|---|---|
| IPsum | Daily aggregate of 30+ public lists; counts how many of them name each address. |
| FireHOL level 1 | Networks safe to block outright: Spamhaus DROP, DShield, Feodo and bogons (includes private ranges). |
| FireHOL level 2 | Addresses seen attacking in roughly the last 48 hours. |
| FireHOL level 3 | Addresses seen attacking in roughly the last 30 days. |
| Spamhaus DROP | Netblocks hijacked or leased by spam and cybercrime operations (© The Spamhaus Project). |
| blocklist.de | Attackers reported by fail2ban and similar sensors in the last 48 hours. |
| blocklist.de SSH | blocklist.de’s SSH attackers. |
| CINS Army | Sentinel IPS’s list of addresses with poor reputation scores. |
| GreenSnow | Addresses caught attacking GreenSnow’s honeypots. |
| DShield top 20 | The 20 /24 networks SANS ISC sensors saw attacking most in the last three days. |
| ET compromised | Proofpoint Emerging Threats’ known compromised hosts. |
| Tor exit | Current Tor exit relays — anonymity, not necessarily abuse. |
IPsum is read from its own repository; the others from FireHOL’s continuously updated copies on GitHub. Spamhaus DROP © The Spamhaus Project.
Questions
- How do I check if an IP address is on a blocklist?
- Paste it above — or a whole log file’s worth of lines — and press Check. Every IPv4 address in the text is looked up in 12 free blocklists, which your browser downloads from their public GitHub copies. Private and documentation addresses are recognised and skipped, since no public list holds them on purpose.
- What does the IPsum count mean?
- IPsum is rebuilt every day from more than 30 public blocklists, and gives each address the number of those lists that name it. An address on one list may be a single report; one on five or more has been reported independently many times. IPsum’s own blocking example uses 3 or more.
- Is an address on a blocklist always malicious?
- No. Lists are built from reports and sensors, so they also catch shared addresses — mobile carriers and corporate NAT, cloud servers that changed hands, VPN and Tor exits. A listing says the address was seen attacking recently, not who is behind it now. Check how many lists agree and what the address did in your own logs.
- Why is my own server’s address listed?
- Either it sent attack traffic recently — a compromised service or a scanner running on it — or it belonged to someone else before (cloud addresses are reused). Report-based lists such as blocklist.de drop addresses that stop attacking within days, and IPsum is rebuilt daily from its sources, so an address that stays listed is usually still sending something.
- Does the checker upload my logs or addresses?
- No. Your browser downloads the public lists from GitHub, and the matching runs on your machine. The text you paste and the addresses in it are never sent anywhere.
- Why are IPv6 addresses not checked?
- These lists hold IPv4 addresses only, which is still where almost all scanning and brute force comes from. IPv6 addresses in your text are counted and reported as skipped.
Want the whole picture, not just the list hits?
LogTriage enriches every address in your logs with AbuseIPDB, OTX, ThreatFox and our own ranges, groups the activity into attack sessions and writes the incident report.