LIST · BLOCKLIST

Community blocklist (seed)

IPv4 + IPv6 ranges that should not be routing legitimate traffic, seeded from Spamhaus DROP / EDROP / DROPv6. Spamhaus tracks ranges hijacked by criminal organisations and known bulletproof-hosting allocations. **Credit: Spamhaus Project — https://www.spamhaus.org/drop/.** Refreshed hourly. Community submissions extend it via /submit; pending entries land in the mod queue.

Subscription URL

https://mikrotikfilters.com/api/lists/community-blocklist.rsc

Paste this URL into a RouterOS /tool fetchon a daily schedule. The header toggle picks v6 vs v7 syntax — the extension flips between .rscand .v6.rsc in place; the .jsonand .txt formats below are version-neutral.

Last builtEntries—Size—

02 · SIZE & HARDWARE

Will this fit your router?

Address lists live in RAM. A list that is comfortable on a CCR can panic-reboot a 64 MB hEX — that has happened before, to real people, with a list very much like these. Check the numbers below against your device before you paste the URL into a scheduler.

Entries
—
Download
—
On-router memory
—
Band
—

Loading sizing for this list…

Approximate. Download size is calculated from the measured rendered size of this list's .rsc output (measured 2026-08-12); the memory figure scales that against a real-world RouterOS measurement of a large address list. Your router's actual usage depends on RouterOS version and what else it is doing. How this is estimated, and what to do about a list that is too big →

One RouterOS quirk worth knowing. LeavingIP → Firewall → Address Lists open in WinBox on a large list makes WinBox re-fetch the whole table continuously — measurable bandwidth and CPU for as long as the tab is open. That is RouterOS behaviour, not a fault in the list; close the tab when you are done looking.

03 · QUICKSTART

Paste-and-go.

Three RouterOS commands: fetch the list, import it, schedule a daily refresh. Run them in a terminal, Webfig, or Winbox. The header toggle picks which RouterOS syntax flavour the snippet below targets — same shell, different embedded URL. For production, verify integrity from a workstation first (snippet below); the deeper-diveIntegrity section covers the CI-pinning shape.

Step 0 (recommended) · Verify integrity from a workstation

# Workstation-side verify (Linux / macOS / WSL).
# Out-of-band check — a router can't hash a multi-MB list.
curl -sSO https://mikrotikfilters.com/api/lists/community-blocklist.rsc
curl -sSO https://mikrotikfilters.com/api/lists/community-blocklist.rsc.sha512
sha512sum -c community-blocklist.rsc.sha512
# → community-blocklist.rsc: OK
mtkf-community-blocklist-quickstart.rscv715 lines · 749 bytes
# subscribe to mtkf-community-blocklist
# check-certificate=yes is NOT the RouterOS default — without it the
# router accepts any certificate. See /firewall/quickstart#check-certificate.
/tool/fetch mode=https check-certificate=yes \
  url="https://mikrotikfilters.com/api/lists/community-blocklist.rsc" \
  dst-path=mtkf-community-blocklist.rsc
/import file-name=mtkf-community-blocklist.rsc

# schedule daily refresh — set-and-forget
/system/scheduler add name=mtkf-community-blocklist-refresh interval=1d \
  on-event=":do { \
    /tool/fetch mode=https check-certificate=yes \
      url=\"https://mikrotikfilters.com/api/lists/community-blocklist.rsc\" dst-path=mtkf-community-blocklist.rsc; \
    /import mtkf-community-blocklist.rsc \
  }"
mtkf-community-blocklist-quickstart.rscv615 lines · 755 bytes
# subscribe to mtkf-community-blocklist
# check-certificate=yes is NOT the RouterOS default — without it the
# router accepts any certificate. See /firewall/quickstart#check-certificate.
/tool fetch mode=https check-certificate=yes \
  url="https://mikrotikfilters.com/api/lists/community-blocklist.v6.rsc" \
  dst-path=mtkf-community-blocklist.rsc
/import file-name=mtkf-community-blocklist.rsc

# schedule daily refresh — set-and-forget
/system scheduler add name=mtkf-community-blocklist-refresh interval=1d \
  on-event=":do { \
    /tool fetch mode=https check-certificate=yes \
      url=\"https://mikrotikfilters.com/api/lists/community-blocklist.v6.rsc\" dst-path=mtkf-community-blocklist.rsc; \
    /import mtkf-community-blocklist.rsc \
  }"

Rate-limit note — anonymous fetches are capped at 2 pulls per IP per day across all lists combined (PLAN §3.4) — enough to preview a list or two, not to subscribe a router. Sign infor 10/day per account, or become a supporter for 200/day + the bundle builder (one URL containing many lists).

04 · FORMATS

Other formats.

Same content, five outputs: .rsc (v7-syntax, the default) flips to .v6.rsc when the header toggle is on v6, plus .json, .txt, and an .rss feed of the newest entries — all version-neutral. Each link opens in a new tab.

RouterOSRouterOS v6JSONPlain textCSVRSS
Category
blocklist
Default action
drop
RouterOS compat
v6 + v7
Address-list name
mtkf-community-blocklist

05 · INTEGRITY

Verify the body matches.

Every format has a sibling .sha512 URL that serves a one-line coreutils manifest. Pin it in CI / Ansible / a wrapper script to fail loudly if the upstream body changes unexpectedly. This is an out-of-bandcheck for CI, mirrors and humans: it runs on the workstation that pushes the body to the router, not on the router. A router cannot verify a list this way — hashing on-router requires reading the file into a script variable, and RouterOS caps variable size far below a multi-megabyte list. On the router, integrity comes from TLS withcheck-certificate=yes.

sha512 manifest URL

https://mikrotikfilters.com/api/lists/community-blocklist.rsc.sha512

The header toggle flips this URL between.rsc.sha512 (v7-syntax body) and.v6.rsc.sha512 (v6-syntax body) — pair the manifest with the body of the same flavour.

Manifests for every format
  • https://mikrotikfilters.com/api/lists/community-blocklist.rsc.sha512
  • https://mikrotikfilters.com/api/lists/community-blocklist.v6.rsc.sha512
  • https://mikrotikfilters.com/api/lists/community-blocklist.v7.rsc.sha512
  • https://mikrotikfilters.com/api/lists/community-blocklist.json.sha512
  • https://mikrotikfilters.com/api/lists/community-blocklist.txt.sha512

Verify on a workstation:

# On your workstation (Linux / macOS / WSL). This is an
# out-of-band check: verify here, then deploy the verified body
# to your router via your usual flow. On the router itself,
# integrity comes from TLS (check-certificate=yes), not this file.
curl -sSO https://mikrotikfilters.com/api/lists/community-blocklist.rsc
curl -sSO https://mikrotikfilters.com/api/lists/community-blocklist.rsc.sha512
sha512sum -c community-blocklist.rsc.sha512
# → community-blocklist.rsc: OK

# Pin in CI: exit non-zero if the upstream body changed without
# you bumping the expected digest.
sha512sum --status -c community-blocklist.rsc.sha512 \
  && echo "verified, safe to /import" \
  || echo "DIGEST MISMATCH — refuse to deploy"

Heads-up — the digest covers the rendered body including the self-identifying header (generated_at, entries, etc.). That timestamp advances on every request, so two consecutive pulls of the same list produce different digests by design. Fetch the body and manifest as a pair (within seconds) for the check to succeed — the manifest is a point-in-time integrity pin, not a long-lived content hash.

06 · ENTRIES

What's in the list.

The first 100 approved entries, alphabetised by address. Filter by address, comment, or source — the filter scans the full list, not just the rendered page, and re-renders the table with every match (capped at 10k entries for very large lists). For a bulk export, use one of the format downloads above — the same data, paginated only by download size.

Live data loading…
AddressFam.TagSourceAddedComment

07 · SOURCES

Where the entries came from.

Each list aggregates one or more upstream sources. We mirror raw upstream input on every successful fetch so the list keeps working if a source goes offline.

  • Loading source attribution…