Protect Your Web Server With a Live IP Blacklist

The ReportedIP community blacklist carries roughly 10,000 IPs at 90+ percent abuse confidence, regenerated server-side every 15 minutes (as of July 21, 2026). One query parameter turns that single list into five port-scoped firewall block lists — SSH, mail, web, FTP, and network edge.

The full walkthrough with cron and ipset scripts is in the blacklist documentation.

Why one block list per service beats one giant list

Every report in the ReportedIP network carries threat category IDs — 58 of them, from SSH Brute-Force (22) to a dedicated WordPress block (31–58) covering login and XML-RPC brute force, plugin exploits, comment spam, and backdoor scanning. The category parameter on GET /blacklist accepts a comma-separated list of those IDs, so each exposed service gets exactly the attackers that target it.

List	Categories	Applied to	Size (July 21, 2026)
SSH	`22,18`	Port 22	5,141 IPs
Mail	`11,7,17,18`	Ports 25, 465, 587, 110, 143, 993, 995	2,784 IPs
Web	`21,16,10,19,12` + WP block `31–58`	Ports 80, 443	3,666 IPs
FTP	`5,18`	Port 21	2,580 IPs
Edge	`4,14,20`	All ports	5,920 IPs

Port-scoped sets keep mistakes cheap: an IP on the web list can never lock an admin out of SSH. The lists stay clean because a score of 90+ requires at least 10 effective reports from 2 or more independent reporters, old reports decay with a 30-day half-life, and known crawlers are excluded server-side before the list is built.

How to pull a list and block it in five minutes

One authenticated GET per service list, plain text, one IP per line:

curl -H "X-Key: YOUR_API_KEY" 
  "https://reportedip.de/wp-json/reportedip/v2/blacklist?confidence=90&format=txt&limit=10000&category=22,18" 
  | while read ip; do ipset add rip-ssh "$ip" -exist; done

iptables -I INPUT -p tcp --dport 22 -m set --match-set rip-ssh src -j DROP

An hourly cron per list is plenty — the endpoint returns an ETag, and sending it back as If-None-Match answers unchanged lists with 304 Not Modified, so repeat polls cost almost nothing. Blacklist pulls do not count against any daily quota; parameters and response formats are in the API reference. Mail operators who prefer DNS lookups over list syncing can query the same data as a private RBL zone.

Report attackers back with fail2ban

Blocking is half the loop. A small fail2ban action posts every ban on your server to POST /report with the matching threat category per jail — sshd bans arrive as category 22, Postfix bans as category 11, nginx bans as category 21. Reports charge only your daily report quota, never the check quota, and every report sharpens the exact lists you pull the next hour.

The ready-made action config and the jail-to-category mapping table are in the fail2ban integration guide.

Start with the free tier

Create a free account — blacklist access starts at the Contributor tier, no credit card
Blacklist documentation — service lists, formats, auto-update script
fail2ban integration — report your bans back to the community