Static IP blocklists miss most edge attack traffic

At a glance

What this is: GreyNoise measured how well widely used IP blocklists tracked live malicious edge activity and found that static feeds covered only a small fraction of observed threats.

Why it matters: This matters because perimeter controls that rely on stale reputation data can create false confidence, while IAM and NHI teams should treat edge blocking as a continuously updated control rather than a one-time list problem.

By the numbers:

• On a single day, May 14, 2026, the GreyNoise Global Observation Grid recorded 119,842 malicious, non-spoofable IPs targeting edge infrastructure.
• The average coverage across eleven widely deployed OSINT and commercial IP feeds was 2.0%.

Context

Static IP reputation lists struggle when attacker infrastructure changes faster than manual curation can track it. GreyNoise's article shows that the problem is not one bad feed but a structural mismatch between today’s edge threat volume and legacy blocklist maintenance models, which also affects how teams think about access control for internet-facing systems.

The identity angle is indirect but real: when defenders use dynamic blocklists to constrain exposure, those lists behave like a control plane for inbound trust decisions. If the intelligence behind them is stale, security teams end up over-trusting source IP reputation and under-estimating how often attacker infrastructure is rotated, repurposed, or hidden behind residential and cloud intermediaries.

For IAM and NHI practitioners, the lesson is that machine-to-machine exposure at the edge needs governance just as much as human access does. The starting position described in the article is typical of many enterprise environments, where static allow-and-block logic survives long after the threat model has changed.

Key questions

Q: What breaks when IP blocklists are updated too slowly for current attack traffic?

A: They stop reflecting the infrastructure attackers are actually using, so defenders end up blocking yesterday’s scanners while today’s sources pass through. The practical failure is a control window that closes too late to matter. Teams should measure feed refresh cadence against the observed churn in malicious sources, not against a vendor’s coverage claims.

Q: Why do static reputation feeds miss so much malicious edge traffic?

A: Static feeds rely on manual curation, confidence thresholds, and delayed refresh cycles, while attackers rotate cloud, proxy, and residential infrastructure continuously. That mismatch makes the control structurally late. A feed can be accurate about a subset of known bad IPs and still fail as a blocking mechanism because the underlying threat surface has already moved.

Q: How can security teams tell whether their blocklist control is actually working?

A: Look for evidence that the list reflects current malicious activity, not just a large count of historical indicators. Useful signals include short refresh intervals, low time-to-provision, and a visible decline in hits from sources that are still active elsewhere. If the control only matches old events, it is functioning as a record, not an enforcement tool.

Q: Should organisations replace static blocklists with dynamic threat-intelligence feeds?

A: They should replace the assumption that one static list is enough, not every existing control. Dynamic feeds are most useful when they complement perimeter filtering with faster observation, better scoping, and a clear operational owner. The decision is about control freshness and trust, not about abandoning blocklists altogether.

Technical breakdown

Why static IP reputation loses coverage so quickly

IP reputation feeds depend on curation, confidence thresholds, and periodic refreshes. That model works when malicious infrastructure is stable, but it weakens when adversaries rotate cloud hosts, residential proxies, and scanner fleets in hours rather than days. Once the attacker’s infrastructure churn outpaces the feed’s update cycle, the control becomes a lagging indicator instead of a blocking signal. The core failure is not precision alone but timeliness, because a highly confident list that updates slowly can still miss most active infrastructure.

Practical implication: Treat IP blocklists as a time-sensitive detection input, not as a durable access control boundary.

Why primary-source sensors outperform static OSINT feeds

Primary-source intelligence is gathered by observing the traffic directly rather than inferring reputation from third-party reports. That matters because direct observation captures the actual malicious session at the moment it happens, while also filtering out spoofed source addresses that can distort reputation data. In the article’s model, the value is not just freshness but evidentiary quality: the feed is built from observed malicious behavior, not from aggregated suspicion. This creates a very different trust basis for defensive automation.

Practical implication: Prefer observed, non-spoofable telemetry when a blocking decision must be tied to current behavior rather than historical reputation.

How dynamic blocklist delivery changes perimeter governance

Dynamic blocklist delivery turns threat intelligence into a policy artifact that can be refreshed automatically in firewalls and external dynamic lists. That changes the governance burden from manual list maintenance to query design, scope validation, and update cadence. Teams can express conditions such as recent malicious activity, vendor-tagged traffic, or CVE-specific exploitation, then push those results into enforcement points. The architecture is useful only if the control chain from observation to enforcement remains short and auditable.

Practical implication: Build review, expiry, and monitoring around the query-to-firewall pipeline so the blocklist itself does not become another stale control.

NHI Mgmt Group analysis

Static reputation is a governance failure when the threat infrastructure churns faster than curation. The article’s central point is not that blocklists are useless, but that static curation cannot keep pace with a threat environment measured in tens of thousands of changing IPs. That creates a control gap between what defenders think they are blocking and what is actually active. Practitioners should treat feed freshness as an operational control requirement, not a procurement preference.

Edge blocking is becoming a time-bound trust decision, not a permanent deny list. When attacker infrastructure turns over daily, the blocking layer behaves more like short-lived risk scoring than a fixed reputation database. That shifts the governance question from

how many IPs are on the list

to

how quickly the list can be refreshed and enforced.

What this signals

Blocklist freshness is now the control variable that matters most. The operational question is no longer whether a list exists, but whether it still reflects the infrastructure attacking you right now. For perimeter teams, that means turning refresh cadence, query scope, and update latency into measurable control objectives.

Machine identities at the edge need the same governance discipline as human access. When source IP reputation is used to gate inbound trust, stale indicators create the same kind of policy drift that unmanaged credentials create inside an identity programme. Security teams should align dynamic blocking with the broader access governance model instead of treating it as a separate network convenience.

For practitioners

• Audit blocklist freshness against attacker turnover Measure how long malicious IP indicators remain actionable in your firewall pipeline and compare that window to the churn rate of the traffic you actually see.
• Prioritise observed-malicious telemetry over static reputation Use sensor-derived intelligence or other primary-source feeds where the control decision depends on current activity rather than historical confidence scores.
• Validate dynamic list provisioning end to end Test the full path from query creation to firewall ingestion, including refresh intervals, authentication method, and failure handling when the list stops updating.
• Scope blocklists to the traffic you can defend Use vendor tags, CVE filters, and known infrastructure boundaries to keep lists small enough to ingest while still targeting the most relevant malicious activity.

Key takeaways

• Static IP blocklists can leave most live attacker infrastructure unaddressed when curation cannot keep pace with churn.
• The article shows that coverage gaps are not marginal, with widely used feeds catching only a small fraction of observed malicious sources.
• Defenders should govern blocklists as a freshness-sensitive control and supplement them with continuously observed intelligence.

Key terms

• Dynamic Blocklist: A dynamic blocklist is a security control that updates automatically from current intelligence rather than remaining fixed after manual curation. In practice, it is only as effective as the freshness, quality, and enforcement path of the underlying feed.
• Primary-Source Intelligence: Primary-source intelligence is threat data observed directly by the collecting sensor or platform, not inferred from third-party reputation or aggregation. It is stronger for blocking decisions because it ties the indicator to evidence of current malicious behavior.
• Non-Spoofable IP: A non-spoofable IP is a source address that can be tied to observed activity with confidence, rather than a forged address that appears in reflection or amplification traffic. This distinction matters because defensive lists are more reliable when they represent real, accountable sources.
• Freshness: Freshness is the measure of how recently a known condition has been rechecked against the current environment. A conclusion can remain strongly supported by evidence while becoming stale, so freshness is what tells teams whether a prior decision is still safe to reuse.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect access control, lifecycle management, and governance across human and non-human identities.