What is this?
A continuously updated set of IP blocklists aggregating AbuseIPDB's worst IPv4 and IPv6 offenders (~99% confidence), plus other free public threat sources, meant to be loaded straight into a firewall to block malicious traffic.
A continuously updated set of IP blocklists aggregating AbuseIPDB's worst IPv4 and IPv6 offenders (~99% confidence), plus other free public threat sources, meant to be loaded straight into a firewall to block malicious traffic.Is this a tool I run, or just data files?It's not software you run, it's plain-text IP lists formatted for ipset/iptables/netfilter, built from AbuseIPDB's data plus other free public sources.
It's not software you run, it's plain-text IP lists formatted for ipset/iptables/netfilter, built from AbuseIPDB's data plus other free public sources.How do I actually use these lists to block IPs?Pull the list files from the repo and load them into ipset/iptables (or any firewall that accepts plain IP lists); since the lists are refreshed multiple times a day, you'd typically re-download them on a schedule.
Pull the list files from the repo and load them into ipset/iptables (or any firewall that accepts plain IP lists); since the lists are refreshed multiple times a day, you'd typically re-download them on a schedule.Do I need an AbuseIPDB account or API key to use these lists?No, the lists are already aggregated and published in this repo for free. You just need a firewall capable of reading ipset/iptables formatted IP lists.
No, the lists are already aggregated and published in this repo for free. You just need a firewall capable of reading ipset/iptables formatted IP lists.Any pitfalls I should know before blocking on these lists?Don't use the abuseipdb-s100-all.ipv4 file, it's for statistics only; keep retention to 30 days or less to avoid false positives; and IPv6 blocking is mostly pointless since SLAAC privacy extensions make hosts change their IPv6 address over time.
Don't use the abuseipdb-s100-all.ipv4 file, it's for statistics only; keep retention to 30 days or less to avoid false positives; and IPv6 blocking is mostly pointless since SLAAC privacy extensions make hosts change their IPv6 address over time.What is the 'Hall of Shame' list?A special list of aggressive /24 subnets, detected via smart heuristics, so you can block an entire offending subnet instead of individual IPs.
A special list of aggressive /24 subnets, detected via smart heuristics, so you can block an entire offending subnet instead of individual IPs.What's the honeypot integration for?A self-hosted honeypot feeds verified abuse reports into the dataset to catch the lower-confidence (~90%) offenders that AbuseIPDB's main ~99%-confidence feed misses.
A self-hosted honeypot feeds verified abuse reports into the dataset to catch the lower-confidence (~90%) offenders that AbuseIPDB's main ~99%-confidence feed misses.How is the ASN data used?Every IP in the lists is enriched with ASN metadata from ipinfo.io, so you can see which network or provider an offending IP belongs to.
Every IP in the lists is enriched with ASN metadata from ipinfo.io, so you can see which network or provider an offending IP belongs to.Is this run by AbuseIPDB itself?No, it's a community project that aggregates AbuseIPDB data (with their permission) on the free-tier plan, combined with other free public threat-intel sources, with full credit given to AbuseIPDB.
No, it's a community project that aggregates AbuseIPDB data (with their permission) on the free-tier plan, combined with other free public threat-intel sources, with full credit given to AbuseIPDB.What are similar projects?awesome-threat-intelligence, dns-blocklists, awesome-honeypots, opensnitch, awesome-hacker-search-engines, xdp-dns-evadeproxy, OSINT-Framework, crowdsec
awesome-threat-intelligence, dns-blocklists, awesome-honeypots, opensnitch, awesome-hacker-search-engines, xdp-dns-evadeproxy, OSINT-Framework, crowdsecWhich topics is it in?blocklist, ipv4, ipv6, threat-intelligence, malware, config, firewall, data, network-security, osint, cybersecurity, security-tools
blocklist, ipv4, ipv6, threat-intelligence, malware, config, firewall, data, network-security, osint, cybersecurity, security-tools