Fail2ban observations, made searchable.

f2b-api is a public API that aggregates IP addresses recorded by Fail2ban. It provides IPv4 and IPv6 lookup, per-jail observations, country and ASN statistics, and a deduplicated IP feed.

An IP record means that the address matched a blocking rule on one of the collection sources. It does not prove malicious activity or compromise. Take shared IPs, dynamic assignment, and configuration-dependent false positives into account when using the data.

Blocking policies

Authentication failures, repeated detections, and the conditions that permanently ban on a single match.

Using the API

IP lookup, pagination, statistics, and the text feed.

Reading the data

Observation times, current bans, and released or stale entries.

Quick start

What is published

We publish the public label of each collection source, jail names, observed IP addresses, first and last confirmation times, and enrichment such as country, ASN, and organization. This site explains the policies behind those observations and the limitations of the judgment.

The public read API requires no authentication. See About this service for the overall architecture.