An IP is listed if, in the last 14 days, it performed at least one malicious action: a login attempt, a POST request, or a hit on probe / ssh-cmd / ssh-malware. Merely visiting or scanning (a GET, an SSH connection without login) does not count.
Private/reserved ranges are always excluded. There is no delisting contact: removal is automatic — an IP drops off after 14 days with no new activity.
Formats: /blocklist.txt (fail2ban/ipset/nftables) · /blocklist.json (with metadata).
| IP | Country | Hits | Actions | Categories | Seen |
|---|---|---|---|---|---|
| 45.156.87.34 | NL | 3044 | 1520 | ssh, ssh-cmd | 2026-07-17 |
| 195.178.110.227 | US | 657 | 552 | ssh, ssh-cmd | 2026-07-17 |
| 195.178.110.217 | US | 277 | 232 | ssh, ssh-cmd | 2026-07-17 |
| 94.154.43.230 | GB | 14 | 12 | ssh, ssh-cmd, ssh-malware | 2026-07-17 |
| 213.199.51.156 | CA | 31 | 5 | ssh, ssh-cmd | 2026-07-17 |
| 101.47.8.187 | SG | 45 | 3 | other | 2026-07-17 |
| 188.32.210.218 | RU | 5 | 3 | ssh, ssh-cmd, ssh-malware | 2026-07-17 |
| 130.12.180.51 | ?? | 6 | 2 | ssh | 2026-07-17 |
| 195.178.110.137 | US | 4 | 1 | ssh | 2026-07-17 |
| 83.97.78.224 | GB | 3 | 1 | ssh | 2026-07-17 |
| 185.97.116.210 | IR | 3 | 1 | ssh | 2026-07-17 |
| 57.159.30.22 | – | 2 | 1 | hikvision | 2026-07-17 |
| 213.30.117.197 | – | 2 | 1 | other, probe | 2026-07-17 |
| 20.15.203.34 | US | 2 | 1 | other, probe | 2026-07-17 |
| 64.226.71.148 | DE | 1 | 1 | probe | 2026-07-17 |