Middleware-Assisted Dynamic IP Blacklisting for MikroTik RouterOS Using Flask and AbuseIPDB: A Single-Site Operational Case Study

Abstract

This single-site technical case study examined a middleware-based integration pattern for consuming IP-reputation intelligence on an Internet-facing MikroTik RouterOS router without requiring the router to process the provider API directly. A Python Flask service retrieved AbuseIPDB blacklist records using a minimum abuse confidence score of 90, retained valid IPv4 addresses in process memory, and exposed newline-delimited pages containing at most 100 entries. A scheduled RouterOS script retrieved the pages, repeated IPv4 validation, avoided duplicate insertion, and populated an address list used by input- and forward-chain drop rules. Operational observations were derived from archived aggregate dashboard plots covering 29 April-5 May and 8-14 May 2026. The raw event export and original dashboard aggregation configuration were unavailable; therefore no causal effect or time-normalized attack rate was estimated. In the baseline plot, API/admin combinations represented 71.1% of recorded activity, the highest displayed aggregation bin was approximately 16,000 events, and one source exceeded 100,000 cumulative interactions. In the post-deployment plot, the previously dominant API/admin pattern was absent, most displayed bins were approximately 200-450 events, the largest was about 1,400, and the most active source was about 1,200. These changes were temporally associated with deployment but may also reflect external variation in Internet attack activity. The engineering contribution is a RouterOS-oriented integration pattern that isolates the provider credential, transforms the reputation feed into an ingestible plaintext representation, and bounds router-side processing through pagination and defensive validation. The evidence supports technical feasibility at one site, not causal effectiveness, resource savings, or generalizability.