Malicious IPs getting through/how to contribute to real-time IP blocklist

Hi @megseoh, thanks for reaching out with this query and it’s great news that you have an interest in helping us and the community with potentially malicious IPs.

We perform collection of malicious or compromized IP addresses automatically for the Wordfence Security Network and the Blocklist, so we don’t have submission forms to request further information from outside. We add and remove thousands of IPs from that list daily.

Even if an IP isn’t currently on that list, Wordfence will look at your settings and intent of the request(s) to decide whether it needs to be blocked at that moment, so even manually blocking these isn’t a strategy we recommend because there’s a great deal of management involved to keep on top of them. Attackers generally cycle through IPs quickly and tend not to reuse them. Attacking IPs often belong to victims with clean records.

Thanks,
Peter.