Threat-intelligence blocklist sources
The independent, freely-licensed feeds WorldIP.io ingests to flag malicious IPs and power the IP reputation / trust score.
How it works
Every six hours we bulk-download each feed below and load it into a local lookup table — we do not run live DNSBL queries when you view a page, so lookups are instant and the data is reproducible. Each feed is parsed to integer IP ranges and refreshed atomically (a transient fetch failure keeps the last good copy).
A feed match contributes to an IP's 0–100 reputation score by confidence tier (high > medium > low), and hits are de-duplicated per provider so an IP on several feeds from re-bundled sources isn't penalised multiple times. Tor exits and bogons are treated as low-weight context, not malice. Full scoring methodology is on the data sources & methodology page.
Highest confidence
Network/operator-grade lists with very low false positives — a hit here strongly anchors the score.
Feodo Tracker botnet C2 data by abuse.ch (feodotracker.abuse.ch), CC0.
DROP data © The Spamhaus Project (spamhaus.org/drop), used under the Spamhaus DROP terms.
DROP data © The Spamhaus Project (spamhaus.org/drop), used under the Spamhaus DROP terms.
DROP data © The Spamhaus Project (spamhaus.org/drop), used under the Spamhaus DROP terms.
Compromised-IPs © Proofpoint, Inc. — Emerging Threats Open (BSD 3-Clause).
firehol_level1 aggregate via the FireHOL blocklist-ipsets project (iplists.firehol.org).
Medium confidence
Real abuse signal but churnier; a hit nudges meaningfully without being decisive alone.
IPsum threat-intel aggregate by @stamparm (github.com/stamparm/ipsum), public domain (Unlicense).
Attacker-IP data from www.blocklist.de.
Attacker-IP data from www.blocklist.de.
Attacker-IP data from www.blocklist.de.
Attacker-IP data from www.blocklist.de.
Context only
Category facts (anonymity / unallocated space), capped so they can only nudge the score.
Bogon data from Team Cymru Community Services (team-cymru.org).
Bogon data from Team Cymru Community Services (team-cymru.org).
Tor exit-node list from The Tor Project (check.torproject.org), CC0.
Reporting & corrections
A blocklist match is an informational signal, not a verdict — reputable IPs occasionally appear on a feed (shared hosting, transient compromise). If you believe an address is mis-flagged, take it up with the originating feed (linked above); we re-import every six hours, so removals propagate automatically. See also data sources & methodology.
