You can download the entire blocklist data set in CSV or TXT format.
The CSV format has 2 columns, the first column is the IP address and the second column contains the blocklist categories.
If an IP address appears on more than one blocklist then the blocklist categories appear as colon separated values.
The TXT format is just a simple plain text dump of all the currently listed IP addresses with no specific blocklist data included.
• The 'vpn' category is only available for Tier 3 or higher accounts.
• We recommend enabling the 'cidr' option for IPv4 because it allows for listing large network ranges efficiently which would otherwise not be
included in the download due to being too many addresses to list individually.
• The 'ip6' option only supports output in CIDR format, this is required because the IPv6 address space is too vast to include individual IP addresses.
The data format. Can be either CSV or TXT
Output IPs using CIDR notation. This option should be preferred but is off by default for backwards compatibility
Output the IPv6 version of the blocklist, the default is to output IPv4 only. Note that this option enables CIDR notation too as this is the only notation currently supported for IPv6
The category of IP addresses to include in the download file, possible values are:
all - all IPs available on your current plan (excludes VPN providers for any plans lower than Tier 3)
bot - all IPs hosting a malicious bot or part of a botnet. This is a broad category which includes brute-force crackers
exploit-bot - all IPs hosting an exploit finding bot or running exploit scanning software
hijacked - all IPs that are part of a hijacked netblock or a netblock controlled by a criminal organization
malware - all IPs involved in distributing or running malware
proxy - all IPs detected as an anonymous web proxy or anonymous HTTP proxy
spam-bot - all IPs hosting a spam bot, comment spamming or any other spamming type software
spider - all IPs running a hostile web spider / web crawler
spyware - all IPs involved in distributing or running spyware
tor - all IPs that are Tor nodes or running a Tor related service
vpn - all IPs belonging to public VPN providers (only available for Tier 3 or higher accounts)
Set this option to 'gzip' to have the output file compressed using gzip
Do not download the file but just return the current files MurmurHash3 checksum. You can use this feature to check if the file has changed since a previous check