---
title: "Download Blocklist"
method: GET
path: "/blocklist/download/{filename}"
tags: ["blocklist"]
---

# Download Blocklist

`GET /blocklist/download/{filename}`

Download a specific blocklist file.

**Plan Access:**
- FREE: 10% sample (lite version)
- BASIC+: Full blocklist

**Filename pattern** (not an exhaustive list — combinations are generated):
- `blocklist-{type}-{variant}[-{format}].txt`
  - `type`: `ips` | `domains` | `urls` | `hashes`
  - `variant`: a severity level (`critical`, `high`, `medium`, `low`,
    `all`) or a category (`malware`, `phishing`, `spam`, `scam`, `fraud`,
    `botnet`, `ransomware`, `c2`, `ads`, `tracking`, `abuse`, `attack`,
    `proxy`, `suspicious`, `malicious`, `cryptomining`, `crypto`,
    `adware`, `privacy`, `bruteforce`, `exploit`, `tor`, `vpn`)
  - `format` (optional): `hosts` | `dnsmasq` | `adguard` (plain text when
    omitted)
- `blocklist-family-{slug}-{type}[-{format}].txt` for malware-family lists
  (e.g. `blocklist-family-emotet-hashes.txt`)

`GET /blocklist/stats` lists the level/category files currently generated.

## Path parameters

- `filename` string, required

## Response `200`

Blocklist file download (text/plain)

## Other responses

- `400` — Invalid blocklist filename
- `401` — Unauthorized - Missing or invalid API key
- `403` — Forbidden - Plan restriction
- `404` — Blocklist not found
- `429` — Too many requests - Rate limit exceeded
- `502` — Origin fetch failed

## Changes

- **2026-08-31** `9d9ef31d83e5` — 8 breaking, 2 info
  - the response property `message` became nullable for the status `401`
  - the response property `message` became nullable for the status `403`
  - the response property `message` became nullable for the status `404`
  - the response property `message` became nullable for the status `429`
  - …6 more

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/blocklist/download/:filename/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/edb544398108?raw)