VoIP Hacker IP Blocklist

Updated October 28, 2026 · 639 entries

This list contains public IP addresses that our firewalls have observed scanning, brute-forcing or flooding VoIP services: SIP (UDP/TCP 5060 and 5061), IAX2 (UDP 4569) and RTP media ports. Every entry was seen in the last 30 days.

Download (plain text): https://www.binary-systems.com/voip-blocklist/VoIP-Blacklist.txt

Format

One IPv4 or IPv6 address (or CIDR range) per line. Lines starting with # are comments.

How to use

OPNsense / pfSense: create a URL Table (IPs) alias pointing to the download link, refresh daily, and use it as the source in a WAN block rule above your SIP port-forwards.
Linux (ipset/iptables):

ipset create voip-bl hash:net -exist
curl -s https://www.binary-systems.com/voip-blocklist/VoIP-Blacklist.txt | grep -v '^#' | grep -v : | while read ip; do ipset add voip-bl "$ip" -exist; done
iptables -I INPUT -m set --match-set voip-bl src -j DROP

Asterisk / FreePBX: load the list into your firewall or fail2ban as a permanent ban set.

Notes

The list is provided as-is, without warranty. Please test before blocking production traffic, and refresh it no more than once a day.