Free IP blocklists compared: what each one holds, its terms and how often it changes

Free IP blocklists differ most in what earns a listing. Spamhaus DROP lists whole networks run by criminals. blocklist.de, CINS Army and FFraud list single addresses caught attacking recently. IPsum and FireHOL level 1 combine other lists. On October 23, 2026, the single-address lists held between 5 and 126,847 entries. For most firewalls, Spamhaus DROP plus one list of recent attackers is a sound start.

We run FFraud, which publishes four of the lists below. We counted them on the same day and by the same rules as the others, and this page states their limits.

#Which free blocklists did we count?

We downloaded each list's plain-text file on October 23, 2026, and counted what it held: single IPv4 addresses, IPv4 ranges with the addresses they cover, and IPv6 entries. Each owner's own page gave what earns a listing, how often the file changes and its terms. We read robots.txt first and skipped any file it closed to automated readers. That left out the Emerging Threats list of compromised addresses.

Two lists hold ranges instead of single addresses, so they sit outside the chart. Spamhaus DROP held 1,688 ranges covering 14,917,376 addresses. FireHOL level 1 held 4,638 ranges and one single address, covering 611,049,089 addresses. Size says little about quality, because each list counts a different thing over a different window.

#What does each list hold?

Spamhaus DROP

DROP stands for Don't Route Or Peer. Spamhaus calls it an advisory to drop all traffic from netblocks that are leased or stolen by professional spam or crime operations. It re-evaluates listings daily, and its FAQ calls the list free for any use. The file we read was dated October 22 and held 1,688 ranges. As the name says, it is meant for routers and firewalls at the edge of a network.

blocklist.de

blocklist.de lists every address that attacked one of its users' servers in the last 48 hours, and it regenerates its files every 30 minutes. Its all.txt held 28,383 IPv4 and 531 IPv6 addresses on October 23. Separate files cover SSH, mail, Apache and other services: the export page counted 5,004 addresses for SSH and 13,741 for mail that morning. Its terms are short. The files come as they are, to be used at your own risk.

CINS Army

CINS Army is a free subset of the threat data that Sentinel IPS units collect for their owners. An address qualifies with a very poor recent packet score, or by tripping a set number of trusted alerts across several sensors. The list has been capped at 15,000 addresses since September 25, 2017, which is why it held exactly 15,000. Its page invites anyone to parse and use the file in any way they see fit. It states no update schedule, though the file had changed minutes before we read it.

IPsum

IPsum merges more than 30 public lists once a day and counts how many of them name each address. Its README says a higher count generally means higher confidence and fewer false positives. The full file held 126,847 addresses, and 107,085 of them were named by only one or two lists. The level 3 file keeps the addresses named by 3 or more lists: 19,762 that day. IPsum is released under The Unlicense, so anyone may use it for anything.

FireHOL level 1

FireHOL combines other lists into ready-made sets for firewalls. Level 1 joins DShield, Feodo Tracker, Spamhaus DROP and the full bogons, and FireHOL describes it as maximum protection with minimum false positives. Its 611,049,089 addresses look huge. FireHOL's own README of October 22 puts 596,233,600 of them in the full bogons, which is 97.6 percent of the list.

Bogons are address space that a regional registry holds but has not yet assigned to any network. That space shrinks as registries hand it out, so an old copy can block networks that went live after your download. Refresh level 1 at least daily. FireHOL also warns that some lists it combines carry their own terms, so check each source before you use it.

Feodo Tracker

Feodo Tracker, run by abuse.ch, lists botnet command servers. An address joins only after it answers like a live command server, which keeps false positives low. abuse.ch generates the file every 5 minutes and asks users to fetch it at least every 15. On October 23 the file held 5 addresses, and its header said it was last updated on March 4, 2026. Read a list's own date before you count on it.

Tor exit list

The Tor Project publishes the addresses of Tor exit relays as a bulk list, which held 1,227 on October 23. Each of these addresses carries traffic for many Tor users at once. The list records which addresses relay Tor traffic and says nothing about attacks. Load it only when your service should refuse every Tor user.

FFraud's four lists

FFraud's lists come from its own honeypot sensors and community reports, and each file states its rule in its header. All four are rebuilt every six hours with the strongest entries first. FFraud publishes its data under the MIT license.

The limits are easy to state. Each file is capped, at 500 to 2,500 entries. A six-hour rebuild is slower than blocklist.de's 30 minutes. Only freships.txt carried IPv6 addresses that day. The full data behind the lists, 1,581,262 addresses on October 23, is a free download in the malicious IP database.

Lists that need an account

AbuseIPDB and CrowdSec also offer free blocklists, behind an account. AbuseIPDB's free plan downloads a blacklist of up to 10,000 addresses, 5 times a day. Its Basic plan, at $25 a month, raises that to 100,000 addresses and 100 downloads a day. Premium, at $99 a month, allows 500,000 addresses and 500 downloads. CrowdSec offers a free Community plan. We left both out of the counts, since what you get depends on the account and the plan.

#What do the terms allow?

Every list here is free to download. What you may do with it differs, so read the owner's words before you build a product on one.

#Which list should you load?

Pick by where the block happens. Each setup below names the lists that fit it and why.

• A router or firewall at the edge. Start with Spamhaus DROP, whose 1,688 ranges are built for this use. Add one list of recent attackers, such as blocklist.de for the last 48 hours or FFraud's badips.txt for repeat offenders. Our ipset guide loads lists like these into the kernel.
• nginx or another web server. Load a short list of web attackers. FFraud's webattack.txt, with 2,000 entries, added 1.7 MB to an nginx worker in our nginx test. Large lists belong in the kernel: 1,556,296 addresses needed 736.6 MB per nginx worker and 39.2 MB in ipset.
• Signups, logins and payments. A list alone blocks too bluntly here. One listed address can carry many people, such as a mobile carrier's CGNAT gateway. Score the address and the request together, as an IP fraud score does.
• Tor. Load the exit list only if your service should refuse all Tor users.
• FireHOL level 1. Use it at the edge only, refreshed at least daily, because of the bogons inside it.

#What does this comparison leave out?

We did not measure quality. How many false positives each list carries, and how much of today's attack traffic it catches, needs a test of its own. Paid enterprise feeds are out of scope. Every count here is from October 23, 2026, and most of these files change daily or faster.

#Questions people ask