Ransomware Tracker Blocklist

The update interval for the available blocklists is 5 minutes. Blocklists are separated based on malware and blocklist type (URL, Domain, or IP). They allow you to be more specific in what you want to block (e.g. only a certain malware family or blocklist type). The recommended format for the blocklists is a combined format which contains data from all malware types. They might not catch everything, but the false positive rate should be low. However, false positives are possible, especially with regards to RW_IPBL. IP addresses associated with Ransomware Payment Sites (*_PS_IPBL) or Locky botnet C&Cs (LY_C2_IPBL) stay listed on RW_IPBL for a time of 30 days after the last appearence. This means that an IP address stays listed on RW_IPBL even after the threat has been eliminated (e.g. the VPS / server has been suspended by the hosting provider) for another 30 days.