Firewall and Nginx blacklists


Enter an IP Address

### AbuseIPDB - Firewall ip blocklist
# Blocklist for AbuseIPDB: A list of the most reported IP addresses.
# Blacklist url: https://abuseipdb.tmiland.com/abuseipdb.txt
# Blacklist Parameters:
# maxAgeInDays: 60
# confidenceMinimum: 90
# countMinimum: 15
# limit: 10,000
# Last generated on Wednesday 31 December 2025 (12:00:01 AM)
### More info: https://docs.abuseipdb.com/#blacklist-endpoint


### AbuseIPDB - Nginx ip blocklist
# Blocklist for AbuseIPDB: A list of the most reported IP addresses.
# Blacklist url: https://abuseipdb.tmiland.com/snippets/nginx-abuseipdb.conf.txt
# Blacklist Parameters:
# maxAgeInDays: 60
# confidenceMinimum: 90
# countMinimum: 15
# limit: 10,000
# Last generated on Wednesday 31 December 2025 (12:00:01 AM)
### More info: https://docs.abuseipdb.com/#blacklist-endpoint


Download to your Nginx folder:

$ wget https://abuseipdb.tmiland.com/snippets/nginx-abuseipdb.conf.txt -O /etc/nginx/snippets/nginx-abuseipdb.conf


Include in /etc/nginx/nginx.conf:

# Include AbuseIPDB Nginx Blacklist
include snippets/nginx-abuseipdb.conf;

( Depending on your setup )


For use with Nginx

Documentation: Dynamic Blacklisting of IP Addresses

Dynamic Blacklisting of IP Addresses

### AbuseIPDB - Ngxblocker ip blocklist
# For use with Nginx Bad Bot and User-Agent Blocker
# https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker
# Blocklist for AbuseIPDB: A list of the most reported IP addresses.
# Blacklist url: https://abuseipdb.tmiland.com/snippets/ngxblocker-abuseipdb.conf.txt
# Blacklist Parameters:
# maxAgeInDays: 60
# confidenceMinimum: 90
# countMinimum: 15
# limit: 10,000
# Last generated on Wednesday 31 December 2025 (12:00:01 AM)
### More info: https://docs.abuseipdb.com/#blacklist-endpoint


Download to your Nginx folder:

$ wget https://abuseipdb.tmiland.com/snippets/ngxblocker-abuseipdb.conf.txt -O /etc/nginx/snippets/ngxblocker-abuseipdb-blacklist.conf


Include in /etc/nginx/bots.d/blacklist-ips.conf:

# Include AbuseIPDB Ngxblocker Blacklist
include snippets/ngxblocker-abuseipdb-blacklist.conf;


Simple shell script to download on a schedule:

#!/usr/bin/env bash

# Author: Tommy Miland (@tmiland) - Copyright (c) 2019
# Download AbuseIPDB - Ngxblocker ip blocklist

# only runs if nginx -t succeeds
safe_nginx_reload() {
  nginx -t &&
  systemctl reload nginx
}

# Download ngxblocker-abuseipdb-blacklist.conf to /etc/nginx/snippets
get_ngxblocker_blacklist() {
  wget https://abuseipdb.tmiland.com/snippets/ngxblocker-abuseipdb.conf.txt -O /etc/nginx/snippets/ngxblocker-abuseipdb-blacklist.conf
}

main() {
  get_ngxblocker_blacklist
  safe_nginx_reload
}

main $@
exit 0

save as ngxblocker-abuseipdb.sh

chmod +x ngxblocker-abuseipdb.sh

A cron job can then be set up like so:

crontab -e

@hourly bash /root/ngxblocker-abuseipdb.sh > /dev/null 2>&1


For use with Nginx Bad Bot and User-Agent Blocker

Nginx Bad Bot and User-Agent Blocker on GitHub

                        ###############################################################
                        #               Welcome to AbuseIPDB.tmiland.com              # 
                        #          All connections are monitored and recorded         #
                        # Repeated offenders will be instantly reported to AbuseIPDB! #
                        #                https://abuseipdb.tmiland.com                #
                        ###############################################################

# Reported IP Date Comment Categories
351748 161.35.89.252 2025-12-31 07:18:15 (sshd) Failed SSH login from 161.35.89.252 (NL/The Netherlands/-): 3 in the last 3600 secs 18, 22
351747 207.154.197.113 2025-12-31 07:00:43 (nginx_404) Dot directory Honeypot Trap 207.154.197.113 (DE/Germany/bf57ea116e.scan.leakix.org): 2 in the last 3600 secs 18, 19
351746 159.223.216.38 2025-12-31 06:55:24 (sshd) Failed SSH login from 159.223.216.38 (NL/The Netherlands/-): 3 in the last 3600 secs 18, 22
351745 45.78.193.93 2025-12-31 06:35:58 (sshd) Failed SSH login from 45.78.193.93 (SG/Singapore/-): 3 in the last 3600 secs 18, 22
351744 119.5.157.124 2025-12-31 06:32:57 (sshd) Failed SSH login from 119.5.157.124 (CN/China/-): 3 in the last 3600 secs 18, 22
351743 103.187.146.90 2025-12-31 06:29:32 (sshd) Failed SSH login from 103.187.146.90 (ID/Indonesia/ip103-187-146-90.cloudhost.web.id): 3 in the last 3600 secs 18, 22
351741 192.144.59.22 2025-12-31 06:29:07 (sshd) Failed SSH login from 192.144.59.22 (RU/Russia/v2995103.hosted-by-vdsina.ru): 3 in the last 3600 secs 18, 22
351742 144.31.73.16 2025-12-31 06:29:07 (sshd) Failed SSH login from 144.31.73.16 (DE/Germany/vm593004.hosted-by.u1host.com): 3 in the last 3600 secs 18, 22
351740 12.156.67.18 2025-12-31 06:28:37 (sshd) Failed SSH login from 12.156.67.18 (US/United States/-): 3 in the last 3600 secs 18, 22
351739 86.171.234.34 2025-12-31 06:28:22 (sshd) Failed SSH login from 86.171.234.34 (GB/United Kingdom/host86-171-234-34.range86-171.btcentralplus.com): 3 in the last 3600 secs 18, 22
351738 209.97.136.65 2025-12-31 06:14:36 (sshd) Failed SSH login from 209.97.136.65 (GB/United Kingdom/-): 3 in the last 3600 secs 18, 22
351737 4.213.136.62 2025-12-31 05:53:29 (shell) SHELL shell.php Attack 4.213.136.62 (IN/India/-): 3 in the last 3600 secs 18
351736 101.53.134.102 2025-12-31 05:23:52 (sshd) Failed SSH login from 101.53.134.102 (IN/India/-): 3 in the last 3600 secs 18, 22
351735 221.156.126.1 2025-12-31 05:17:07 (sshd) Failed SSH login from 221.156.126.1 (KR/South Korea/-): 3 in the last 3600 secs 18, 22
351734 193.70.86.193 2025-12-31 05:16:56 (sshd) Failed SSH login from 193.70.86.193 (FR/France/vps-0c06d590.vps.ovh.net): 3 in the last 3600 secs 18, 22
351733 103.23.198.86 2025-12-31 05:16:42 (sshd) Failed SSH login from 103.23.198.86 (ID/Indonesia/ip103-23-198-86.cloudhost.web.id): 3 in the last 3600 secs 18, 22
351732 45.78.228.64 2025-12-31 04:39:30 (sshd) Failed SSH login from 45.78.228.64 (SG/Singapore/-): 3 in the last 3600 secs 18, 22
351731 212.227.125.15 2025-12-31 04:31:38 (sshd) Failed SSH login from 212.227.125.15 (GB/United Kingdom/-): 3 in the last 3600 secs 18, 22
351730 103.26.136.173 2025-12-31 04:20:43 (sshd) Failed SSH login from 103.26.136.173 (BD/Bangladesh/mail.gshakti.org): 3 in the last 3600 secs 18, 22
351729 117.250.96.66 2025-12-31 04:18:38 (sshd) Failed SSH login from 117.250.96.66 (IN/India/static.ill.117.250.96.66.bsnl.co.in): 3 in the last 3600 secs 18, 22
351728 146.190.18.196 2025-12-31 03:42:40 (sshd) Failed SSH login from 146.190.18.196 (NL/The Netherlands/-): 3 in the last 3600 secs 18, 22
351727 68.155.144.44 2025-12-31 02:59:51 (wordpress_404) WordPress Plugins Honeypot Trap 68.155.144.44 (MX/Mexico/-): 2 in the last 3600 secs 18, 12, 21
351726 70.66.80.116 2025-12-31 02:59:12 (sshd) Failed SSH login from 70.66.80.116 (CA/Canada/S0106c44fd56dad06.gv.shawcable.net): 3 in the last 3600 secs 18, 22
351725 109.206.241.199 2025-12-31 02:58:56 (sshd) Failed SSH login from 109.206.241.199 (EE/Estonia/-): 3 in the last 3600 secs 18, 22
351724 87.106.36.193 2025-12-31 02:58:47 (sshd) Failed SSH login from 87.106.36.193 (GB/United Kingdom/ip87-106-36-193.pbiaas.com): 3 in the last 3600 secs 18, 22
351723 103.186.0.101 2025-12-31 02:58:37 (sshd) Failed SSH login from 103.186.0.101 (ID/Indonesia/ip103-186-0-101.cloudhost.web.id): 3 in the last 3600 secs 18, 22
351722 185.10.63.235 2025-12-31 02:58:22 (sshd) Failed SSH login from 185.10.63.235 (RU/Russia/Mail.jif.ru): 3 in the last 3600 secs 18, 22
351721 211.219.22.213 2025-12-31 02:56:12 (sshd) Failed SSH login from 211.219.22.213 (KR/South Korea/-): 3 in the last 3600 secs 18, 22
351720 197.153.57.103 2025-12-31 02:55:36 (sshd) Failed SSH login from 197.153.57.103 (MA/Morocco/-): 3 in the last 3600 secs 18, 22
351719 58.98.199.45 2025-12-31 02:50:46 (sshd) Failed SSH login from 58.98.199.45 (JP/Japan/g45.58-98-199.ppp.wakwak.ne.jp): 3 in the last 3600 secs 18, 22
351718 176.235.182.73 2025-12-31 02:38:25 (sshd) Failed SSH login from 176.235.182.73 (TR/Türkiye/-): 3 in the last 3600 secs 18, 22
351717 74.176.59.137 2025-12-31 02:23:39 (wordpress_404) WordPress Plugins Honeypot Trap 74.176.59.137 (JP/Japan/-): 2 in the last 3600 secs 18, 12, 21
351716 45.78.217.20 2025-12-31 02:07:30 45.78.217.20 (SG/Singapore/-), 5 distributed sshd attacks on account [github] in the last 3600 secs 18, 22
351715 116.1.149.196 2025-12-31 02:07:29 116.1.149.196 (CN/China/-), 5 distributed sshd attacks on account [github] in the last 3600 secs 18, 22
351714 178.156.191.29 2025-12-31 01:59:42 (sshd) Failed SSH login from 178.156.191.29 (US/United States/static.29.191.156.178.clients.your-server.de): 3 in the last 3600 secs 18, 22
351713 85.208.253.156 2025-12-31 01:57:32 (sshd) Failed SSH login from 85.208.253.156 (IR/Iran/static.156.253.208.85.clients.irandns.com): 3 in the last 3600 secs 18, 22
351712 120.48.135.189 2025-12-31 01:56:37 (sshd) Failed SSH login from 120.48.135.189 (CN/China/-): 3 in the last 3600 secs 18, 22
351711 80.94.92.182 2025-12-31 01:55:47 (sshd) Failed SSH login from 80.94.92.182 (RO/Romania/-): 3 in the last 3600 secs 18, 22
351710 135.235.138.43 2025-12-31 01:55:32 (sshd) Failed SSH login from 135.235.138.43 (IN/India/-): 3 in the last 3600 secs 18, 22
351709 101.47.50.51 2025-12-31 01:55:10 101.47.50.51 (SG/Singapore/-), 5 distributed sshd attacks on account [elasticsearch] in the last 3600 secs 18, 22
351707 27.45.146.119 2025-12-31 01:55:09 27.45.146.119 (CN/China/-), 5 distributed sshd attacks on account [elasticsearch] in the last 3600 secs 18, 22
351708 89.44.137.240 2025-12-31 01:55:09 89.44.137.240 (RO/Romania/-), 5 distributed sshd attacks on account [elasticsearch] in the last 3600 secs 18, 22
351706 148.206.53.155 2025-12-31 01:55:07 148.206.53.155 (MX/Mexico/-), 5 distributed sshd attacks on account [elasticsearch] in the last 3600 secs 18, 22
351705 182.42.71.56 2025-12-31 01:54:58 (sshd) Failed SSH login from 182.42.71.56 (CN/China/-): 3 in the last 3600 secs 18, 22
351703 51.178.43.161 2025-12-31 01:54:07 (sshd) Failed SSH login from 51.178.43.161 (FR/France/prod1.masterit.fr): 3 in the last 3600 secs 18, 22
351704 194.113.236.217 2025-12-31 01:54:07 (sshd) Failed SSH login from 194.113.236.217 (RU/Russia/-): 3 in the last 3600 secs 18, 22
351702 128.14.225.164 2025-12-31 01:53:57 (sshd) Failed SSH login from 128.14.225.164 (US/United States/-): 3 in the last 3600 secs 18, 22
351701 193.106.245.20 2025-12-31 01:51:27 (sshd) Failed SSH login from 193.106.245.20 (PL/Poland/do-fn.rom.net.pl): 3 in the last 3600 secs 18, 22
351700 134.209.206.122 2025-12-31 01:47:22 (sshd) Failed SSH login from 134.209.206.122 (NL/The Netherlands/-): 3 in the last 3600 secs 18, 22
351699 20.255.61.0 2025-12-31 00:57:58 (sshd) Failed SSH login from 20.255.61.0 (HK/Hong Kong/-): 3 in the last 3600 secs 18, 22
351698 101.47.141.103 2025-12-31 00:25:51 (sshd) Failed SSH login from 101.47.141.103 (SG/Singapore/-): 3 in the last 3600 secs 18, 22
351697 45.78.224.112 2025-12-31 00:21:51 (sshd) Failed SSH login from 45.78.224.112 (SG/Singapore/-): 3 in the last 3600 secs 18, 22
351696 14.103.120.242 2025-12-31 00:18:36 (sshd) Failed SSH login from 14.103.120.242 (CN/China/-): 3 in the last 3600 secs 18, 22
351694 78.39.48.166 2025-12-31 00:17:00 (sshd) Failed SSH login from 78.39.48.166 (IR/Iran/-): 3 in the last 3600 secs 18, 22
351695 103.250.10.42 2025-12-31 00:17:00 (sshd) Failed SSH login from 103.250.10.42 (ID/Indonesia/ip103-250-10-42.cloudhost.web.id): 3 in the last 3600 secs 18, 22
351692 165.154.231.252 2025-12-31 00:16:40 (sshd) Failed SSH login from 165.154.231.252 (JP/Japan/-): 3 in the last 3600 secs 18, 22
351693 62.113.36.174 2025-12-31 00:16:40 (sshd) Failed SSH login from 62.113.36.174 (RU/Russia/-): 3 in the last 3600 secs 18, 22
351691 172.96.179.9 2025-12-31 00:15:50 (sshd) Failed SSH login from 172.96.179.9 (CA/Canada/itdev789.hostpapavps.net): 3 in the last 3600 secs 18, 22
351690 38.137.11.10 2025-12-31 00:12:05 (sshd) Failed SSH login from 38.137.11.10 (IN/India/-): 3 in the last 3600 secs 18, 22
351688 185.197.163.38 2025-12-30 22:49:08 (sshd) Failed SSH login from 185.197.163.38 (NL/The Netherlands/vps12089.ua-hosting.company): 3 in the last 3600 secs 18, 22
351689 188.166.169.185 2025-12-30 22:49:08 (sshd) Failed SSH login from 188.166.169.185 (GB/United Kingdom/-): 3 in the last 3600 secs 18, 22
351687 103.189.208.13 2025-12-30 22:17:11 (sshd) Failed SSH login from 103.189.208.13 (-): 3 in the last 3600 secs 18, 22
351686 103.154.237.236 2025-12-30 22:16:16 (sshd) Failed SSH login from 103.154.237.236 (BD/Bangladesh/-): 3 in the last 3600 secs 18, 22
351685 184.168.21.211 2025-12-30 22:15:11 (sshd) Failed SSH login from 184.168.21.211 (US/United States/211.21.168.184.host.secureserver.net): 3 in the last 3600 secs 18, 22
351684 193.23.199.107 2025-12-30 22:14:41 (sshd) Failed SSH login from 193.23.199.107 (DE/Germany/-): 3 in the last 3600 secs 18, 22
351683 2.83.107.150 2025-12-30 22:12:41 (sshd) Failed SSH login from 2.83.107.150 (PT/Portugal/bl22-107-150.dsl.telepac.pt): 3 in the last 3600 secs 18, 22
351682 14.63.198.239 2025-12-30 22:11:56 (sshd) Failed SSH login from 14.63.198.239 (KR/South Korea/-): 3 in the last 3600 secs 18, 22
351681 101.47.163.14 2025-12-30 21:40:03 (sshd) Failed SSH login from 101.47.163.14 (SG/Singapore/-): 3 in the last 3600 secs 18, 22
351680 1.95.143.66 2025-12-30 21:33:38 (sshd) Failed SSH login from 1.95.143.66 (CN/China/ecs-1-95-143-66.compute.hwclouds-dns.com): 3 in the last 3600 secs 18, 22
351679 45.78.217.210 2025-12-30 21:32:18 (sshd) Failed SSH login from 45.78.217.210 (SG/Singapore/-): 3 in the last 3600 secs 18, 22
351678 101.47.163.114 2025-12-30 21:30:58 (sshd) Failed SSH login from 101.47.163.114 (SG/Singapore/-): 3 in the last 3600 secs 18, 22
351677 101.47.161.75 2025-12-30 21:28:58 (sshd) Failed SSH login from 101.47.161.75 (SG/Singapore/-): 3 in the last 3600 secs 18, 22
351675 101.47.163.225 2025-12-30 21:28:53 (sshd) Failed SSH login from 101.47.163.225 (SG/Singapore/-): 3 in the last 3600 secs 18, 22
351676 101.47.163.225 2025-12-30 21:28:53 101.47.163.225 (SG/Singapore/-), 5 distributed sshd attacks on account [jenkins] in the last 3600 secs 18, 22
351674 103.13.206.152 2025-12-30 21:27:48 (sshd) Failed SSH login from 103.13.206.152 (ID/Indonesia/ip103-13-206-152.cloudhost.web.id): 3 in the last 3600 secs 18, 22
351673 192.3.159.149 2025-12-30 21:26:17 (sshd) Failed SSH login from 192.3.159.149 (US/United States/192-3-159-149-host.colocrossing.com): 3 in the last 3600 secs 18, 22
351672 2.134.15.100 2025-12-30 21:25:17 (sshd) Failed SSH login from 2.134.15.100 (KZ/Kazakhstan/-): 3 in the last 3600 secs 18, 22
351671 200.196.50.91 2025-12-30 21:23:12 (sshd) Failed SSH login from 200.196.50.91 (BR/Brazil/mvx-200-196-50-91.mundivox.com): 3 in the last 3600 secs 18, 22
351670 106.37.72.112 2025-12-30 21:22:32 (sshd) Failed SSH login from 106.37.72.112 (CN/China/-): 3 in the last 3600 secs 18, 22
351669 162.255.166.156 2025-12-30 21:21:37 (sshd) Failed SSH login from 162.255.166.156 (US/United States/SoupMan): 3 in the last 3600 secs 18, 22
351668 103.143.238.100 2025-12-30 21:21:02 (sshd) Failed SSH login from 103.143.238.100 (HK/Hong Kong/-): 3 in the last 3600 secs 18, 22
351667 27.111.32.174 2025-12-30 21:15:22 (sshd) Failed SSH login from 27.111.32.174 (ID/Indonesia/-): 3 in the last 3600 secs 18, 22
351666 101.47.161.217 2025-12-30 20:26:23 (sshd) Failed SSH login from 101.47.161.217 (SG/Singapore/-): 3 in the last 3600 secs 18, 22
351665 45.78.207.78 2025-12-30 20:22:48 (sshd) Failed SSH login from 45.78.207.78 (SG/Singapore/-): 3 in the last 3600 secs 18, 22
351664 184.82.115.42 2025-12-30 20:21:13 (sshd) Failed SSH login from 184.82.115.42 (TH/Thailand/184-82-115-0.24.public.tls1b-bcr02.myaisfibre.com): 3 in the last 3600 secs 18, 22
351663 45.202.211.6 2025-12-30 20:20:52 (sshd) Failed SSH login from 45.202.211.6 (HK/Hong Kong/-): 3 in the last 3600 secs 18, 22
351662 162.223.91.130 2025-12-30 20:17:22 (sshd) Failed SSH login from 162.223.91.130 (US/United States/ussrv.colopart.com): 3 in the last 3600 secs 18, 22
351661 222.239.56.211 2025-12-30 19:54:26 (sshd) Failed SSH login from 222.239.56.211 (KR/South Korea/-): 3 in the last 3600 secs 18, 22
351660 185.158.22.150 2025-12-30 19:53:40 (sshd) Failed SSH login from 185.158.22.150 (IQ/Iraq/-): 3 in the last 3600 secs 18, 22
351659 158.174.210.161 2025-12-30 19:51:30 (sshd) Failed SSH login from 158.174.210.161 (SE/Sweden/h-158-174-210-161.NA.cust.bahnhof.se): 3 in the last 3600 secs 18, 22
351658 194.74.196.10 2025-12-30 19:50:20 (sshd) Failed SSH login from 194.74.196.10 (GB/United Kingdom/-): 3 in the last 3600 secs 18, 22
351657 164.90.196.78 2025-12-30 19:36:44 (sshd) Failed SSH login from 164.90.196.78 (NL/The Netherlands/-): 3 in the last 3600 secs 18, 22
351656 101.126.17.224 2025-12-30 18:40:51 (sshd) Failed SSH login from 101.126.17.224 (CN/China/-): 3 in the last 3600 secs 18, 22
351655 115.129.88.87 2025-12-30 18:13:08 (sshd) Failed SSH login from 115.129.88.87 (AU/Australia/115-129-88-87.tpgi.com.au): 3 in the last 3600 secs 18, 22
351654 188.166.248.139 2025-12-30 17:56:47 (sshd) Failed SSH login from 188.166.248.139 (SG/Singapore/-): 3 in the last 3600 secs 18, 22
351653 164.92.236.103 2025-12-30 17:54:57 (sshd) Failed SSH login from 164.92.236.103 (DE/Germany/sa04.jiwebhosting.com): 3 in the last 3600 secs 18, 22
351652 168.167.228.74 2025-12-30 17:54:52 (sshd) Failed SSH login from 168.167.228.74 (BW/Botswana/-): 3 in the last 3600 secs 18, 22
351651 165.154.29.57 2025-12-30 17:54:37 (sshd) Failed SSH login from 165.154.29.57 (SG/Singapore/-): 3 in the last 3600 secs 18, 22
351650 114.66.59.217 2025-12-30 17:54:32 (sshd) Failed SSH login from 114.66.59.217 (CN/China/-): 3 in the last 3600 secs 18, 22