2
Hostile IP Addresses Blocked

Blocked by WhoKnew Intelligence™?

Check if your IP address is on our blocklist.

A small, silver robot is partially submerged in a large pot filled with thick, orange soup on a kitchen countertop. The robot's head and shoulders are visible above the surface.

Stuck on our blocklist? Think it’s a false positive?

Request Removal.

Community Driven

The Collaborative Threat Intelligence Network

Navigate to the next section

About Us

A community-driven threat list, launched with established industry feeds and built to grow through WordPress sites running WhoKnew Shield™ Pro. Each site contributes IPs that Scraper Trap™ catches; when enough independent WordPress sites report the same IP address, it is added to the network blocklist. Here’s a quick overview:

Community-driven

IPs are added only after multiple independent sites report them.

Shield-powered

Built for WhoKnew Shield™ Pro; the same list protects all participating sites.

Multi-site confirmed

An IP reaches the blocklist only when multiple sites have caught it.

No personal data

We share only IPs; no site URLs, email addresses, or other identifying data.

Updated regularly

Constantly refreshed as sites report in—the list stays current with the latest threats.

Firewall-ready

Use the list in firewalls, WAFs, fail2ban, or your own scripts. Absolutely free.

What is WhoKnew Intelligence™?

WhoKnew Intelligence™ is a shared blocklist of over 15 million hostile IP addresses, built on established industry threat feeds and strengthened continuously as independent sites using WhoKnew Shield™ Pro report bad actors they catch. When several sites independently catch the same bad actor, that IP is added to the network list so every participating site can block it before it hits them. You can use the blocklist inside Shield Pro, or download it for firewalls and other tools.

Join the Network & Stop Threats – Get WhoKnew Shield™ Pro

Download the Blocklist

Anyone can download the current blocklist for use in firewalls, security tools, or scripts. No API key required. All endpoints use standard HTTP caching (blocklists: 1 hour, stats: 5 minutes) for optimal performance.

Use CaseEndpointResponse Format
Plain text (one IP per line)/v1/blocklist.txtText file with header comments
JSON (list + metadata)/v1/blocklist.jsonJSON with ips, metadata, stats
Stats only (no IP list)/v1/statsBlocklist size, contributing sites, last updated

How to Use

Direct Download: Open any endpoint URL in a browser or use curl / wget to save the file.

Firewalls & fail2ban: Point your tool at the .txt endpoint. The file is one IP per line after the comment header. Refresh daily or as needed.

Scripts & Automation: GET the .json endpoint for structured data. Use the /stats endpoint to check list size and “last updated” without pulling the full list.

Example:

curl -o blocklist.txt "https://whoknew.io/wp-json/whoknew-intelligence/v1/blocklist.txt"

WhoKnew Intelligence™ is part of the WhoKnew Shield™ ecosystem.

Questions? Contact us or see the Shield knowledge base.