Firewall and Nginx blacklists


Enter an IP Address

### AbuseIPDB - Firewall ip blocklist
# Blocklist for AbuseIPDB: A list of the most reported IP addresses.
# Blacklist url: https://abuseipdb.tmiland.com/abuseipdb.txt
# Blacklist Parameters:
# maxAgeInDays: 60
# confidenceMinimum: 90
# countMinimum: 15
# limit: 10,000
# Last generated on Sunday 01 March 2026 (12:00:01 AM)
### More info: https://docs.abuseipdb.com/#blacklist-endpoint


### AbuseIPDB - Nginx ip blocklist
# Blocklist for AbuseIPDB: A list of the most reported IP addresses.
# Blacklist url: https://abuseipdb.tmiland.com/snippets/nginx-abuseipdb.conf.txt
# Blacklist Parameters:
# maxAgeInDays: 60
# confidenceMinimum: 90
# countMinimum: 15
# limit: 10,000
# Last generated on Sunday 01 March 2026 (12:00:01 AM)
### More info: https://docs.abuseipdb.com/#blacklist-endpoint


Download to your Nginx folder:

$ wget https://abuseipdb.tmiland.com/snippets/nginx-abuseipdb.conf.txt -O /etc/nginx/snippets/nginx-abuseipdb.conf


Include in /etc/nginx/nginx.conf:

# Include AbuseIPDB Nginx Blacklist
include snippets/nginx-abuseipdb.conf;

( Depending on your setup )


For use with Nginx

Documentation: Dynamic Blacklisting of IP Addresses

Dynamic Blacklisting of IP Addresses

### AbuseIPDB - Ngxblocker ip blocklist
# For use with Nginx Bad Bot and User-Agent Blocker
# https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker
# Blocklist for AbuseIPDB: A list of the most reported IP addresses.
# Blacklist url: https://abuseipdb.tmiland.com/snippets/ngxblocker-abuseipdb.conf.txt
# Blacklist Parameters:
# maxAgeInDays: 60
# confidenceMinimum: 90
# countMinimum: 15
# limit: 10,000
# Last generated on Sunday 01 March 2026 (12:00:01 AM)
### More info: https://docs.abuseipdb.com/#blacklist-endpoint


Download to your Nginx folder:

$ wget https://abuseipdb.tmiland.com/snippets/ngxblocker-abuseipdb.conf.txt -O /etc/nginx/snippets/ngxblocker-abuseipdb-blacklist.conf


Include in /etc/nginx/bots.d/blacklist-ips.conf:

# Include AbuseIPDB Ngxblocker Blacklist
include snippets/ngxblocker-abuseipdb-blacklist.conf;


Simple shell script to download on a schedule:

#!/usr/bin/env bash

# Author: Tommy Miland (@tmiland) - Copyright (c) 2019
# Download AbuseIPDB - Ngxblocker ip blocklist

# only runs if nginx -t succeeds
safe_nginx_reload() {
  nginx -t &&
  systemctl reload nginx
}

# Download ngxblocker-abuseipdb-blacklist.conf to /etc/nginx/snippets
get_ngxblocker_blacklist() {
  wget https://abuseipdb.tmiland.com/snippets/ngxblocker-abuseipdb.conf.txt -O /etc/nginx/snippets/ngxblocker-abuseipdb-blacklist.conf
}

main() {
  get_ngxblocker_blacklist
  safe_nginx_reload
}

main $@
exit 0

save as ngxblocker-abuseipdb.sh

chmod +x ngxblocker-abuseipdb.sh

A cron job can then be set up like so:

crontab -e

@hourly bash /root/ngxblocker-abuseipdb.sh > /dev/null 2>&1


For use with Nginx Bad Bot and User-Agent Blocker

Nginx Bad Bot and User-Agent Blocker on GitHub

                        ###############################################################
                        #               Welcome to AbuseIPDB.tmiland.com              # 
                        #          All connections are monitored and recorded         #
                        # Repeated offenders will be instantly reported to AbuseIPDB! #
                        #                https://abuseipdb.tmiland.com                #
                        ###############################################################

# Reported IP Date Comment Categories
362393 45.156.87.52 2026-03-01 06:31:35 (wordpress_login) WordPress Login Attack 45.156.87.52 (NL/Netherlands/-): 3 in the last 3600 secs 18, 12, 21
362392 50.149.203.166 2026-03-01 06:27:25 (sshd) Failed SSH login from 50.149.203.166 (US/United States/c-50-149-203-166.hsd1.tn.comcast.net): 3 in the last 3600 secs 18, 22
362391 159.65.196.64 2026-03-01 06:21:29 (sshd) Failed SSH login from 159.65.196.64 (NL/Netherlands/-): 3 in the last 3600 secs 18, 22
362390 96.41.38.202 2026-03-01 06:16:24 (nginx_404) Dot directory Honeypot Trap 96.41.38.202 (US/United States/syn-096-041-038-202.res.spectrum.com): 2 in the last 3600 secs 18, 19
362389 134.199.165.155 2026-03-01 06:11:59 (sshd) Failed SSH login from 134.199.165.155 (AU/Australia/-): 3 in the last 3600 secs 18, 22
362388 138.199.54.56 2026-03-01 06:10:04 (wordpress_xmlrpc) WordPress XMLPRC Attack 138.199.54.56 (IT/Italy/-): 3 in the last 3600 secs 18, 12, 21
362387 213.209.159.159 2026-03-01 06:00:33 (sshd) Failed SSH login from 213.209.159.159 (TW/Taiwan/-): 3 in the last 3600 secs 18, 22
362386 134.199.166.210 2026-03-01 05:41:42 (sshd) Failed SSH login from 134.199.166.210 (AU/Australia/-): 3 in the last 3600 secs 18, 22
362385 149.102.225.179 2026-03-01 05:37:26 (manifest) WordPress wlwmanifest.xml Attack 149.102.225.179 (US/United States/unn-149-102-225-179.datapacket.com): 3 in the last 3600 secs 18, 12, 21
362384 185.177.72.60 2026-03-01 05:34:35 (wordpress_404) WordPress Plugins Honeypot Trap 185.177.72.60 (FR/France/-): 2 in the last 3600 secs 18, 12, 21
362383 206.81.24.227 2026-03-01 05:21:40 (nginx_404) Dot directory Honeypot Trap 206.81.24.227 (DE/Germany/b59bc1c6ef.scan.leakix.org): 2 in the last 3600 secs 18, 19
362382 64.225.75.246 2026-03-01 05:21:35 (nginx_404) Dot directory Honeypot Trap 64.225.75.246 (NL/Netherlands/b32f2b056d.scan.leakix.org): 2 in the last 3600 secs 18, 19
362381 167.99.88.29 2026-03-01 05:07:29 (sshd) Failed SSH login from 167.99.88.29 (GB/United Kingdom/-): 3 in the last 3600 secs 18, 22
362380 167.172.74.47 2026-03-01 03:52:29 (sshd) Failed SSH login from 167.172.74.47 (SG/Singapore/-): 3 in the last 3600 secs 18, 22
362379 91.92.242.178 2026-03-01 03:50:38 (wordpress_404) WordPress Plugins Honeypot Trap 91.92.242.178 (NL/Netherlands/-): 2 in the last 3600 secs 18, 12, 21
362378 178.128.88.66 2026-03-01 03:44:58 (sshd) Failed SSH login from 178.128.88.66 (SG/Singapore/-): 3 in the last 3600 secs 18, 22
362377 185.156.73.233 2026-03-01 03:34:39 185.156.73.233 (UA/Ukraine/-), 7 distributed sshd attacks on account [user] in the last 3600 secs 18, 22
362376 45.148.10.121 2026-03-01 03:34:38 45.148.10.121 (NL/Netherlands/-), 7 distributed sshd attacks on account [user] in the last 3600 secs 18, 22
362375 112.220.117.138 2026-03-01 03:34:37 112.220.117.138 (KR/South Korea/-), 7 distributed sshd attacks on account [user] in the last 3600 secs 18, 22
362374 134.122.48.21 2026-03-01 03:31:52 (sshd) Failed SSH login from 134.122.48.21 (NL/Netherlands/-): 3 in the last 3600 secs 18, 22
362373 167.71.200.205 2026-03-01 03:18:21 (sshd) Failed SSH login from 167.71.200.205 (SG/Singapore/-): 3 in the last 3600 secs 18, 22
362372 223.197.248.209 2026-03-01 03:17:40 223.197.248.209 (HK/Hong Kong/223-197-248-209.static.imsbiz.com), 5 distributed sshd attacks on account [root2] in the last 3600 secs 18, 22
362370 210.79.142.221 2026-03-01 03:17:38 210.79.142.221 (ID/Indonesia/-), 5 distributed sshd attacks on account [root2] in the last 3600 secs 18, 22
362371 185.196.10.248 2026-03-01 03:17:38 185.196.10.248 (GB/United Kingdom/-), 5 distributed sshd attacks on account [root2] in the last 3600 secs 18, 22
362368 172.172.196.177 2026-03-01 03:17:37 172.172.196.177 (US/United States/-), 5 distributed sshd attacks on account [root2] in the last 3600 secs 18, 22
362369 92.31.0.191 2026-03-01 03:17:36 92.31.0.191 (GB/United Kingdom/host-92-31-0-191.as13285.net), 5 distributed sshd attacks on account [root2] in the last 3600 secs 18, 22
362367 161.35.203.59 2026-03-01 02:42:59 (sshd) Failed SSH login from 161.35.203.59 (DE/Germany/-): 3 in the last 3600 secs 18, 22
362366 45.148.10.238 2026-03-01 02:39:03 (nginx_404) Dot directory Honeypot Trap 45.148.10.238 (NL/Netherlands/-): 2 in the last 3600 secs 18, 19
362365 170.64.236.149 2026-03-01 02:36:33 (sshd) Failed SSH login from 170.64.236.149 (AU/Australia/-): 3 in the last 3600 secs 18, 22
362364 68.183.11.133 2026-03-01 02:33:43 (sshd) Failed SSH login from 68.183.11.133 (NL/Netherlands/-): 3 in the last 3600 secs 18, 22
362363 124.71.113.121 2026-03-01 01:55:26 (sshd) Failed SSH login from 124.71.113.121 (CN/China/ecs-124-71-113-121.compute.hwclouds-dns.com): 3 in the last 3600 secs 18, 22
362362 64.227.139.254 2026-03-01 01:42:44 (sshd) Failed SSH login from 64.227.139.254 (IN/India/-): 3 in the last 3600 secs 18, 22
362361 165.227.155.132 2026-03-01 01:26:03 (sshd) Failed SSH login from 165.227.155.132 (DE/Germany/-): 3 in the last 3600 secs 18, 22
362360 170.64.131.194 2026-03-01 01:18:18 (sshd) Failed SSH login from 170.64.131.194 (AU/Australia/-): 3 in the last 3600 secs 18, 22
362359 185.193.156.145 2026-03-01 01:17:58 (wordpress_xmlrpc) WordPress XMLPRC Attack 185.193.156.145 (US/United States/-): 3 in the last 3600 secs 18, 12, 21
362358 209.97.191.115 2026-03-01 00:44:40 (sshd) Failed SSH login from 209.97.191.115 (GB/United Kingdom/-): 3 in the last 3600 secs 18, 22
362357 138.199.35.8 2026-03-01 00:41:25 (wordpress_xmlrpc) WordPress XMLPRC Attack 138.199.35.8 (US/United States/unn-138-199-35-8.datapacket.com): 3 in the last 3600 secs 18, 12, 21
362356 66.32.83.2 2026-03-01 00:08:58 (sshd) Failed SSH login from 66.32.83.2 (US/United States/static-66-32-83-2.earthlinkbusiness.net): 3 in the last 3600 secs 18, 22
362355 188.166.151.52 2026-02-28 23:55:26 (sshd) Failed SSH login from 188.166.151.52 (GB/United Kingdom/-): 3 in the last 3600 secs 18, 22
362354 51.75.151.149 2026-02-28 23:09:17 (wordpress_404) WordPress Plugins Honeypot Trap 51.75.151.149 (FR/France/ip149.ip-51-75-151.eu): 2 in the last 3600 secs 18, 12, 21
362353 170.64.170.169 2026-02-28 23:08:17 (sshd) Failed SSH login from 170.64.170.169 (AU/Australia/-): 3 in the last 3600 secs 18, 22
362352 46.101.13.18 2026-02-28 23:03:37 (sshd) Failed SSH login from 46.101.13.18 (GB/United Kingdom/-): 3 in the last 3600 secs 18, 22
362351 165.22.215.30 2026-02-28 23:01:57 (sshd) Failed SSH login from 165.22.215.30 (IN/India/-): 3 in the last 3600 secs 18, 22
362350 159.223.217.101 2026-02-28 22:45:01 (sshd) Failed SSH login from 159.223.217.101 (NL/Netherlands/-): 3 in the last 3600 secs 18, 22
362349 64.23.176.57 2026-02-28 22:27:49 (sshd) Failed SSH login from 64.23.176.57 (US/United States/-): 3 in the last 3600 secs 18, 22
362348 46.101.88.184 2026-02-28 22:11:23 (sshd) Failed SSH login from 46.101.88.184 (GB/United Kingdom/-): 3 in the last 3600 secs 18, 22
362347 167.99.37.73 2026-02-28 22:09:38 (sshd) Failed SSH login from 167.99.37.73 (NL/Netherlands/-): 3 in the last 3600 secs 18, 22
362346 141.98.11.171 2026-02-28 20:27:40 (nginx_404) Dot directory Honeypot Trap 141.98.11.171 (LT/Lithuania/-): 2 in the last 3600 secs 18, 19
362345 207.180.241.56 2026-02-28 20:23:45 (wordpress_404) WordPress Plugins Honeypot Trap 207.180.241.56 (FR/France/vmi3055290.contaboserver.net): 2 in the last 3600 secs 18, 12, 21
362344 157.245.35.5 2026-02-28 20:22:55 (sshd) Failed SSH login from 157.245.35.5 (GB/United Kingdom/-): 3 in the last 3600 secs 18, 22
362343 144.91.119.214 2026-02-28 20:00:23 (wordpress_login) WordPress Login Attack 144.91.119.214 (FR/France/m11840.contaboserver.net): 3 in the last 3600 secs 18, 12, 21
362342 149.102.225.182 2026-02-28 19:56:23 (manifest) WordPress wlwmanifest.xml Attack 149.102.225.182 (US/United States/unn-149-102-225-182.datapacket.com): 3 in the last 3600 secs 18, 12, 21
362341 68.183.36.238 2026-02-28 19:14:15 (sshd) Failed SSH login from 68.183.36.238 (GB/United Kingdom/-): 3 in the last 3600 secs 18, 22
362340 161.35.166.26 2026-02-28 18:54:39 (sshd) Failed SSH login from 161.35.166.26 (GB/United Kingdom/-): 3 in the last 3600 secs 18, 22
362339 13.71.191.191 2026-02-28 18:45:37 (wordpress_404) WordPress Plugins Honeypot Trap 13.71.191.191 (CA/Canada/-): 2 in the last 3600 secs 18, 12, 21
362338 37.201.7.96 2026-02-28 18:40:58 (wordpress_xmlrpc) WordPress XMLPRC Attack 37.201.7.96 (DE/Germany/ip-037-201-007-096.um10.pools.vodafone-ip.de): 3 in the last 3600 secs 18, 12, 21
362337 178.16.53.170 2026-02-28 18:27:27 (wordpress_login) WordPress Login Attack 178.16.53.170 (NL/Netherlands/-): 3 in the last 3600 secs 18, 12, 21
362336 223.19.43.14 2026-02-28 18:22:01 (nginx_404) Dot directory Honeypot Trap 223.19.43.14 (HK/Hong Kong/14-43-19-223-on-nets.com): 2 in the last 3600 secs 18, 19
362335 171.231.179.39 2026-02-28 16:20:02 (sshd) Failed SSH login from 171.231.179.39 (VN/Vietnam/dynamic-ip-adsl.viettel.vn): 3 in the last 3600 secs 18, 22
362334 169.150.203.249 2026-02-28 11:38:06 (manifest) WordPress wlwmanifest.xml Attack 169.150.203.249 (US/United States/unn-169-150-203-249.datapacket.com): 3 in the last 3600 secs 18, 12, 21
362333 49.47.154.172 2026-02-28 11:20:55 (wordpress_xmlrpc) WordPress XMLPRC Attack 49.47.154.172 (IN/India/-): 3 in the last 3600 secs 18, 12, 21
362332 119.94.171.62 2026-02-28 11:19:00 (wordpress_xmlrpc) WordPress XMLPRC Attack 119.94.171.62 (PH/Philippines/119.94.171.62.static.pldt.net): 3 in the last 3600 secs 18, 12, 21
362331 138.199.35.10 2026-02-28 11:11:09 (manifest) WordPress wlwmanifest.xml Attack 138.199.35.10 (US/United States/unn-138-199-35-10.datapacket.com): 3 in the last 3600 secs 18, 12, 21
362330 20.104.124.39 2026-02-28 11:01:08 (wordpress_404) WordPress Plugins Honeypot Trap 20.104.124.39 (CA/Canada/-): 2 in the last 3600 secs 18, 12, 21
362329 69.40.224.128 2026-02-28 10:29:41 (wordpress_xmlrpc) WordPress XMLPRC Attack 69.40.224.128 (US/United States/h128.224.40.69.dynamic.ip.windstream.net): 3 in the last 3600 secs 18, 12, 21
362328 92.118.39.72 2026-02-28 10:18:00 (sshd) Failed SSH login from 92.118.39.72 (US/United States/-): 3 in the last 3600 secs 18, 22
362327 20.220.144.87 2026-02-28 10:13:40 (wordpress_login) WordPress Login Attack 20.220.144.87 (CA/Canada/-): 3 in the last 3600 secs 18, 12, 21
362326 165.245.186.120 2026-02-28 09:05:29 (nginx_404) Dot directory Honeypot Trap 165.245.186.120 (SG/Singapore/-): 2 in the last 3600 secs 18, 19
362325 173.212.238.152 2026-02-28 05:58:10 173.212.238.152 (FR/France/vmi3056391.contaboserver.net), 5 distributed sshd attacks on account [root1] in the last 3600 secs 18, 22
362323 45.192.96.79 2026-02-28 05:58:09 45.192.96.79 (SC/Seychelles/-), 5 distributed sshd attacks on account [root1] in the last 3600 secs 18, 22
362324 103.154.77.48 2026-02-28 05:58:09 103.154.77.48 (ID/Indonesia/48.subs77.t2net.id), 5 distributed sshd attacks on account [root1] in the last 3600 secs 18, 22
362321 42.112.42.129 2026-02-28 05:58:08 42.112.42.129 (VN/Vietnam/-), 5 distributed sshd attacks on account [root1] in the last 3600 secs 18, 22
362322 13.81.183.28 2026-02-28 05:58:08 13.81.183.28 (NL/Netherlands/-), 5 distributed sshd attacks on account [root1] in the last 3600 secs 18, 22
362320 204.76.203.25 2026-02-28 05:56:25 (nginx_404) Dot directory Honeypot Trap 204.76.203.25 (NL/Netherlands/204.76.203.25.ptr.pfcloud.network): 2 in the last 3600 secs 18, 19
362319 139.59.71.87 2026-02-28 05:21:23 (sshd) Failed SSH login from 139.59.71.87 (IN/India/-): 3 in the last 3600 secs 18, 22
362318 135.148.9.11 2026-02-28 04:44:45 (sshd) Failed SSH login from 135.148.9.11 (US/United States/ip11.ip-135-148-9.us): 3 in the last 3600 secs 18, 22
362317 20.100.197.204 2026-02-28 03:02:02 (wordpress_404) WordPress Plugins Honeypot Trap 20.100.197.204 (NO/Norway/-): 2 in the last 3600 secs 18, 12, 21
362316 149.88.110.36 2026-02-28 02:56:27 (wordpress_xmlrpc) WordPress XMLPRC Attack 149.88.110.36 (UA/Ukraine/unn-149-88-110-36.datapacket.com): 3 in the last 3600 secs 18, 12, 21
362315 4.204.192.31 2026-02-28 02:10:44 (wordpress_404) WordPress Plugins Honeypot Trap 4.204.192.31 (CA/Canada/-): 2 in the last 3600 secs 18, 12, 21
362314 195.216.166.156 2026-02-28 01:17:35 (wordpress_404) WordPress Plugins Honeypot Trap 195.216.166.156 (ES/Spain/-): 2 in the last 3600 secs 18, 12, 21
362313 20.220.232.101 2026-02-27 23:34:26 (wordpress_404) WordPress Plugins Honeypot Trap 20.220.232.101 (CA/Canada/-): 2 in the last 3600 secs 18, 12, 21
362312 91.224.92.164 2026-02-27 23:18:25 (nginx_404) Dot directory Honeypot Trap 91.224.92.164 (GB/United Kingdom/srv-91-224-92-164.serveroffer.net): 2 in the last 3600 secs 18, 19
362311 66.94.122.148 2026-02-27 22:43:08 (sshd) Failed SSH login from 66.94.122.148 (US/United States/vmi2094115.contaboserver.net): 3 in the last 3600 secs 18, 22
362310 94.26.106.114 2026-02-27 22:16:16 (wordpress_login) WordPress Login Attack 94.26.106.114 (DE/Germany/-): 3 in the last 3600 secs 18, 12, 21
362309 139.59.0.116 2026-02-27 20:39:04 (sshd) Failed SSH login from 139.59.0.116 (IN/India/-): 3 in the last 3600 secs 18, 22
362308 164.92.203.51 2026-02-27 20:26:28 (sshd) Failed SSH login from 164.92.203.51 (DE/Germany/-): 3 in the last 3600 secs 18, 22
362307 61.216.105.59 2026-02-27 20:19:08 (sshd) Failed SSH login from 61.216.105.59 (TW/Taiwan/61-216-105-59.hinet-ip.hinet.net): 3 in the last 3600 secs 18, 22
362306 185.177.72.60 2026-02-27 20:02:51 (wordpress_404) WordPress Plugins Honeypot Trap 185.177.72.60 (FR/France/-): 2 in the last 3600 secs 18, 12, 21
362305 193.212.61.148 2026-02-27 20:00:51 (wordpress_xmlrpc) WordPress XMLPRC Attack 193.212.61.148 (NO/Norway/148.61.212.193.static.cust.telenor.net): 3 in the last 3600 secs 18, 12, 21
362304 80.94.92.186 2026-02-27 19:29:59 (sshd) Failed SSH login from 80.94.92.186 (RO/Romania/-): 3 in the last 3600 secs 18, 22
362303 171.231.178.171 2026-02-27 18:39:26 (sshd) Failed SSH login from 171.231.178.171 (VN/Vietnam/dynamic-ip-adsl.viettel.vn): 3 in the last 3600 secs 18, 22
362302 167.172.148.241 2026-02-27 16:30:12 (sshd) Failed SSH login from 167.172.148.241 (US/United States/-): 3 in the last 3600 secs 18, 22
362301 35.233.233.40 2026-02-27 16:24:26 (manifest) WordPress wlwmanifest.xml Attack 35.233.233.40 (US/United States/40.233.233.35.bc.googleusercontent.com): 3 in the last 3600 secs 18, 12, 21
362300 159.223.113.215 2026-02-27 16:10:56 159.223.113.215 (US/United States/-), 7 distributed sshd attacks on account [sol] in the last 3600 secs 18, 22
362298 192.241.170.180 2026-02-27 16:10:55 192.241.170.180 (US/United States/-), 7 distributed sshd attacks on account [sol] in the last 3600 secs 18, 22
362299 159.223.228.122 2026-02-27 16:10:55 159.223.228.122 (NL/Netherlands/-), 7 distributed sshd attacks on account [sol] in the last 3600 secs 18, 22
362297 159.223.61.156 2026-02-27 16:04:15 (sshd) Failed SSH login from 159.223.61.156 (SG/Singapore/-): 3 in the last 3600 secs 18, 22
362296 159.89.158.127 2026-02-27 15:40:12 (sshd) Failed SSH login from 159.89.158.127 (US/United States/-): 3 in the last 3600 secs 18, 22
362295 167.71.217.106 2026-02-27 15:36:47 (sshd) Failed SSH login from 167.71.217.106 (SG/Singapore/-): 3 in the last 3600 secs 18, 22