Plain IP blocklists

text/plain, one address per line

Shorter windows block aggressively with fewer stale entries; longer windows give broader coverage. Lists contain no reason codes, sensor names or log data.

10-day listActive IPs observed within 10 days515 addresses49 downloads 15-day listActive IPs observed within 15 days791 addresses31 downloads 30-day listActive IPs observed within 30 days1,794 addresses1,510 downloads

Automating updates

Lists are regenerated continuously and cached for two minutes. Fetching more than once every few minutes provides no new data.

ipset / iptables

curl -fsS https://abuse.secureinsight.my/blocklists/10days.txt \
  | while read -r ip; do ipset add abuse-radar "$ip" -exist; done

nftables

nft add element inet filter abuse_radar \
  { $(curl -fsS https://abuse.secureinsight.my/blocklists/15days.txt | paste -sd, -) }

fail2ban / cron

*/30 * * * * curl -fsS -o /etc/abuse-radar.list \
  https://abuse.secureinsight.my/blocklists/30days.txt

Machine-readable index

GET https://abuse.secureinsight.my/api/v2/blocklists