Security
Probing Blocklist
Public feed of currently active IP blocks on im.forsale after probing sensitive paths or abuse review — for operators who want to block the same scanners.
Active entries
26,754
Last published
Sep 26, 2026 03:59 UTC
Active-only list (honeypot entries expire after 14 days). Download files regenerate once per day and are served as static files.
What gets listed
- First request to a sensitive path (e.g. .env, wp-admin, phpMyAdmin, .git) blocks the IP for 14 days. Re-probing after expiry blocks again. Entries drop off automatically when they expire.
- IPs blocked by site administrators for abusive behaviour (no automatic expiry until unblocked).
This is an IP list, not a User-Agent bot list. Total count stays roughly steady as old honeypot blocks expire and new probes are added.
Download formats
Plain text is one IP per line for firewalls, fail2ban, nginx deny, and WAF import. JSON includes source, trigger, blocked_at, and expires_at (null = manual). Only active blocks are listed; count stays roughly stable as honeypot entries expire after 14 days. Files regenerate once per day.
curl -s https://im.forsale/blocklist.txt
curl -s https://im.forsale/blocklist.json | jq '.count, .entries[0]'
How others publish blocklists
Most community blocklists ship a plain-text file with one IP per line for firewalls, fail2ban,
nginx deny, or WAF rules.
JSON feeds add metadata. Feeds are typically cached with a Last-Modified header.
Provided as-is for community use. No warranty; verify before blocking in production.
Request removal
If your IP hit the honeypot by mistake, request removal from a different network than the blocked IP.