IP blocklists: are your controls keeping up with edge attacks?

TL;DR: On May 14, 2026, 119,842 malicious, non-spoofable IPs targeted edge infrastructure, according to GreyNoise, yet eleven widely used OSINT and commercial feeds averaged only 2.0% coverage and the strongest feed missed more than 95% of the gap. Static curation now leaves defenders blind to fast-changing infrastructure.

Editorial analysis by NHI Mgmt Group, based on content published by GreyNoise: “The Coverage Gap: Why Your Blocklist Is Missing 119,000 Malicious IPs Today”.

By the numbers:

• On a single day, May 14, 2026, the GreyNoise Global Observation Grid recorded 119,842 malicious, non-spoofable IPs targeting edge infrastructure.
• The average coverage across eleven widely deployed OSINT and commercial IP feeds was 2.0%.

Key questions

Q: What breaks when IP blocklists are updated too slowly for current attack traffic?

A: They stop reflecting the infrastructure attackers are actually using, so defenders end up blocking yesterday’s scanners while today’s sources pass through.

Q: Why do static reputation feeds miss so much malicious edge traffic?

A: Static feeds rely on manual curation, confidence thresholds, and delayed refresh cycles, while attackers rotate cloud, proxy, and residential infrastructure continuously.

Q: How can security teams tell whether their blocklist control is actually working?

A: Look for evidence that the list reflects current malicious activity, not just a large count of historical indicators.

Practitioner guidance

• Audit blocklist freshness against attacker turnover Measure how long malicious IP indicators remain actionable in your firewall pipeline and compare that window to the churn rate of the traffic you actually see.
• Prioritise observed-malicious telemetry over static reputation Use sensor-derived intelligence or other primary-source feeds where the control decision depends on current activity rather than historical confidence scores.
• Validate dynamic list provisioning end to end Test the full path from query creation to firewall ingestion, including refresh intervals, authentication method, and failure handling when the list stops updating.

Bottom line: Static IP blocklists can leave most live attacker infrastructure unaddressed when curation cannot keep pace with churn.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →