Initialisation...

Analyze an IP. Review the detections.

Events recorded by BlacklistIP sensors: targeted ports, classification and history for each address.

668,931 Events, 24h 549,074 Listed IPs 1,241 Classifications, 24h
24.2 Average WAF score, 24h
Latest detections Relative time Paris · paris-1 · 321/min, last minute
87.229.79.158 8333 · BITCOIN Sonde Bitcoin Type « Sonde Bitcoin » (signaux protocolaires) · confiance 50% Scan coordonné Critique
31.58.215.148 8333 · BITCOIN Sonde Bitcoin 50% Type « Sonde Bitcoin » (signaux protocolaires) · confiance 50% Critique
87.229.79.159 8333 · BITCOIN Sonde Bitcoin Type « Sonde Bitcoin » (signaux protocolaires) · confiance 50% Scan coordonné Critique
143.20.137.136 8333 · BITCOIN Sonde Bitcoin Type « Sonde Bitcoin » (signaux protocolaires) · confiance 50% Scan coordonné Critique
143.20.137.220 8333 · BITCOIN Sonde Bitcoin Type « Sonde Bitcoin » (signaux protocolaires) · confiance 50% Scan coordonné Critique
87.229.79.247 8333 · BITCOIN Sonde Bitcoin Type « Sonde Bitcoin » (signaux protocolaires) · confiance 50% Scan coordonné Critique
220.200.77.205 36 · SSH Sonde SSH Bannière client SSH reçue · confiance 100% Critique
77.46.161.161 36 · SSH Sonde SSH Bannière client SSH reçue · confiance 100% Critique
27.130.36.227 24 · SSH Sonde SSH Bannière client SSH reçue · confiance 100% Critique
66.132.172.131 4567 · AWS ECS AGENT Scanner cloud 0% Type « Scanner cloud » (signaux protocolaires) · confiance 0% Critique
162.216.150.125 9144 · HTTP Scanner web User-Agent scanner commercial déclaré · confiance 100% Scan coordonné Élevé
103.129.109.58 27 · SSH Sonde SSH Bannière client SSH reçue · confiance 100% Critique
Activité normale Pic de menaces Capteur Paris

Last 24 hours

Most frequent classifications and countries in this window. Statistics

7-day trend

Top attack types

  1. Sonde Bitcoin 408,129
  2. Sonde SSH 113,645
  3. Flood / DDoS 46,862
  4. Scan de ports 26,829
  5. Sonde fichier configuration 18,646
  6. Protocole TDS MSSQL 6,227
  7. Sonde PostgreSQL 4,947
  8. Sonde port 3,265

Top countries

  1. États-Unis 2,407
  2. Royaume-Uni 471
  3. France 385
  4. Chine 315
  5. Émirats arabes unis 282
  6. Hongrie 254
  7. Allemagne 104
  8. R.A.S. chinoise de Hong Kong 94

Current database

Volumes calculated on addresses present in the database, not only the last 24 hours.

217 Countries covered
32,893 Identified ISPs

DNSBL

Database addresses also answer over DNS, under the zone dnsbl.blacklistip.com.

  1. 1
    Reverse

    185.177.72.38 becomes 38.72.177.185

  2. 2
    Query

    Append .dnsbl.blacklistip.com

  3. 3
    Read

    The A record gives the category, the TXT record the label.

549 420 IPv4 addresses in the zone, rebuilt every 15 minutes.

How to use it Check an address

  • 127.0.0.2 473 789
  • 127.0.0.3 63 431
  • 127.0.0.4 27
  • 127.0.0.5 11 980
  • 127.0.0.9 193
Threat intelligence

Map of the last hour

Replay of geolocated detections over 1 hour, in 5-minute slots. An empty slot draws nothing. Country and port rankings

1 h replay · loop Attack point Flow intensity Country flags 1×–4× Honeypot sensor 33 countries · 598 IP · 27,691 events (1 h)

1 h replay · loop · 5 min slot

—
Chargement du replay…
Origine d'attaque (créneau 5 min) Flow intensity, from low to high Capteur honeypot actif

Security checks

TLS, HTTP headers, IP reputation, CORS and robots.txt. 34 Security tools

Direct access

The same data, by use: lookup, export, API or tooling.

From an event to a usable list

  1. 1. Collection

    Our sensors detect scans, brute force and exploits against exposed services.

  2. 2. Enrichment

    Classification, severity, WAF score and geographic correlation to prioritize action.

  3. 3. Export

    API, exports and webhooks to feed a firewall or a SIEM. Delay depends on your integration.

Free and Premium

Free
0 € / month

Access to the IP database, public statistics and essential exports.

  • Full IP database
  • TXT/CSV/JSON exports
  • API (standard quota)
  • Rankings and statistics
Create an account
Premium
On request / month

Higher quotas, lab, webhooks and priority support.

  • API quota ×10
  • Threat lab and heatmaps
  • Webhook alerts and watchlist
  • Priority support
  • Scheduled PDF reports
See Premium

Frequently asked questions

What is Blacklist IP?
A database of IP addresses linked to sensor detections, with an API, exports and public statistics.
How do I integrate the database?
Through the documented REST API or TXT/CSV/JSON/XML exports compatible with SIEM, WAF and firewalls.
How often do events arrive?
As detections happen. Over the last 24 h, 668,931 events are counted. The homepage polls the feed every few seconds.
How do I query the DNSBL?
Reverse the IPv4 under dnsbl.blacklistip.com. The A record is the category, the TXT record is the label. How to use it
GDPR compliance?
We process only public IP addresses linked to documented malicious activity, as described in our privacy policy.

Account

The database stays readable without an account. Signing up adds an API key and account exports. Create an account