CSF BlockLists

Here is a compiled list of CSF compatible block lists.  Replace the csf.blocklists file and modify as needed.

-----

# Name: ALIENVAULT_REPUTATION
# Category: reputation
# Maintainer: Alien Vault
# Maintainer URL: https://www.alienvault.com/
# Information: IP reputation database
#ALIENVAULT_REPUTATION|86400|0|https://reputation.alienvault.com/reputation.generic

# Name: ALTTOR
# Category: anonymizers
# Maintainer: Tor Network Status
# Maintainer URL: http://torstatus.blutmagie.de/
# Information: TOR Exit Nodes List
#ALTTOR|86400|0|http://torstatus.blutmagie.de/ip_list_exit.php/Tor_ip_list_EXIT.csv

# Name: AUTOSHUN
# Category: attacks
# Maintainer: Autoshun.org
# Maintainer URL: http://www.autoshun.org/
# Information: Autoshun Shun List
#AUTOSHUN|86400|0|http://www.autoshun.org/files/shunlist.csv

# Name: BAMBENEK_C2
# Category: malware
# Maintainer: Bambenek Consulting
# Maintainer URL: http://osint.bambenekconsulting.com/feeds/
# Information: Master feed of known, active and non-sinkholed C&Cs IP addresses
#BAMBENEK_C2|86400|0|http://osint.bambenekconsulting.com/feeds/c2-ipmasterlist.txt

# Name: BDE
# Category: attacks
# Maintainer: Blocklist.de
# Maintainer URL: https://www.blocklist.de
# Information: Blocklist.de attacking IP addresses (last hour)
#BDE|86400|0|https://api.blocklist.de/getlast.php?time=3600

# Name: BDEALL
# Category: attacks
# Maintainer: Blocklist.de
# Maintainer URL: https://www.blocklist.de
# Information: Blocklist.de attacking IP addresses (all)
#BDEALL|86400|0|http://lists.blocklist.de/lists/all.txt

# Name: BDS_ATIF
# Category: reputation
# Maintainer: Binary Defense Systems
# Maintainer URL: https://www.binarydefense.com/
# Information: Artillery Threat Intelligence Feed and Banlist Feed
#BDS_ATIF|172800|0|https://www.binarydefense.com/banlist.txt

# Name: BFB
# Category: attacks
# Maintainer: Daniel Gerzo
# Maintainer URL: http://danger.rulez.sk/index.php/bruteforceblocker/
# Information: BruteForceBlocker IP List
#BFB|86400|0|http://danger.rulez.sk/projects/bruteforceblocker/blist.php

# Name: BITCOIN_BLOCKCHAIN_INFO
# Category: reputation
# Maintainer: Blockchain.info
# Maintainer URL: https://blockchain.info/en/connected-nodes
# Information: Bitcoin nodes connected to Blockchain.info.
#BITCOIN_BLOCKCHAIN_INFO|86400|0|https://blockchain.info/en/connected-nodes

# Name: BI_ANY_2_1D
# Category: attacks
# Maintainer: BadIPs.com
# Maintainer URL: https://www.badips.com/
# Information: Bad IPs in category any with score above 2 and age less than 1d
#BI_ANY_2_1D|86400|0|https://www.badips.com/get/list/any/2?age=1d

# Name: BI_ANY_2_30D
# Category: attacks
# Maintainer: BadIPs.com
# Maintainer URL: https://www.badips.com/
# Information: Bad IPs in category any with score above 2 and age less than 30d
#BI_ANY_2_30D|172800|0|https://www.badips.com/get/list/any/2?age=30d

# Name: BI_ANY_2_7D
# Category: attacks
# Maintainer: BadIPs.com
# Maintainer URL: https://www.badips.com/
# Information: Bad IPs in category any with score above 2 and age less than 7d
#BI_ANY_2_7D|172800|0|https://www.badips.com/get/list/any/2?age=7d

# Name: BI_BRUTEFORCE_2_30D
# Category: attacks
# Maintainer: BadIPs.com
# Maintainer URL: https://www.badips.com/
# Information: Bad IPs in category bruteforce with score above 2 and age less than 30d
#BI_BRUTEFORCE_2_30D|172800|0|https://www.badips.com/get/list/bruteforce/2?age=30d

# Name: BI_FTP_2_30D
# Category: attacks
# Maintainer: BadIPs.com
# Maintainer URL: https://www.badips.com/
# Information: Bad IPs in category ftp with score above 2 and age less than 30d
#BI_FTP_2_30D|172800|0|https://www.badips.com/get/list/ftp/2?age=30d

# Name: BI_HTTP_2_30D
# Category: attacks
# Maintainer: BadIPs.com
# Maintainer URL: https://www.badips.com/
# Information: Bad IPs in category http with score above 2 and age less than 30d
#BI_HTTP_2_30D|172800|0|https://www.badips.com/get/list/http/2?age=30d

# Name: BI_MAIL_2_30D
# Category: attacks
# Maintainer: BadIPs.com
# Maintainer URL: https://www.badips.com/
# Information: Bad IPs in category mail with score above 2 and age less than 30d
#BI_MAIL_2_30D|172800|0|https://www.badips.com/get/list/mail/2?age=30d

# Name: BI_PROXY_2_30D
# Category: attacks
# Maintainer: BadIPs.com
# Maintainer URL: https://www.badips.com/
# Information: Bad IPs in category proxy with score above 2 and age less than 30d
#BI_PROXY_2_30D|172800|0|https://www.badips.com/get/list/proxy/2?age=30d

# Name: BI_SQL_2_30D
# Category: attacks
# Maintainer: BadIPs.com
# Maintainer URL: https://www.badips.com/
# Information: Bad IPs in category sql with score above 2 and age less than 30d
#BI_SQL_2_30D|172800|0|https://www.badips.com/get/list/sql/2?age=30d

# Name: BI_SSH_2_30D
# Category: attacks
# Maintainer: BadIPs.com
# Maintainer URL: https://www.badips.com/
# Information: Bad IPs in category ssh with score above 2 and age less than 30d
#BI_SSH_2_30D|172800|0|https://www.badips.com/get/list/ssh/2?age=30d

# Name: BI_VOIP_2_30D
# Category: attacks
# Maintainer: BadIPs.com
# Maintainer URL: https://www.badips.com/
# Information: Bad IPs in category voip with score above 2 and age less than 30d
#BI_VOIP_2_30D|172800|0|https://www.badips.com/get/list/voip/2?age=30d

# Name: BLOCKLIST_DE
# Category: attacks
# Maintainer: Blocklist.de
# Maintainer URL: https://www.blocklist.de/
# Information: IPs that have been detected by fail2ban in the last 48 hours
#BLOCKLIST_DE|86400|0|http://lists.blocklist.de/lists/all.txt

# Name: BLOCKLIST_DE_APACHE
# Category: attacks
# Maintainer: Blocklist.de
# Maintainer URL: https://www.blocklist.de/
# Information: All IP addresses which have been reported within the last 48 hours as having run attacks on the service Apache,
# Apache-DDOS, RFI-Attacks.
#BLOCKLIST_DE_APACHE|86400|0|http://lists.blocklist.de/lists/apache.txt

# Name: BLOCKLIST_DE_BOTS
# Category: attacks
# Maintainer: Blocklist.de
# Maintainer URL: https://www.blocklist.de/
# Information: All IP addresses which have been reported within the last 48 hours as having run attacks on the RFI-Attacks, REG-Bots,
# IRC-Bots or BadBots (BadBots = he has posted a Spam-Comment on a open Forum or Wiki) .
#BLOCKLIST_DE_BOTS|86400|0|http://lists.blocklist.de/lists/bots.txt

# Name: BLOCKLIST_DE_BRUTEFORCE
# Category: attacks
# Maintainer: Blocklist.de
# Maintainer URL: https://www.blocklist.de/
# Information: All IPs which attacks Joomlas, Wordpress and other Web-Logins with Brute-Force Logins.
#BLOCKLIST_DE_BRUTEFORCE|86400|0|http://lists.blocklist.de/lists/bruteforcelogin.txt

# Name: BLOCKLIST_DE_FTP
# Category: attacks
# Maintainer: Blocklist.de
# Maintainer URL: https://www.blocklist.de/
# Information: All IP addresses which have been reported within the last 48 hours for attacks on the Service FTP.
#BLOCKLIST_DE_FTP|86400|0|http://lists.blocklist.de/lists/ftp.txt

# Name: BLOCKLIST_DE_IMAP
# Category: attacks
# Maintainer: Blocklist.de
# Maintainer URL: https://www.blocklist.de/
# Information: All IP addresses which have been reported within the last 48 hours for attacks on the Service imap, sasl, pop3, etc.
#BLOCKLIST_DE_IMAP|86400|0|http://lists.blocklist.de/lists/imap.txt

# Name: BLOCKLIST_DE_MAIL
# Category: attacks
# Maintainer: Blocklist.de
# Maintainer URL: https://www.blocklist.de/
# Information: All IP addresses which have been reported within the last 48 hours as having run attacks on the service Mail, Postfix.
#BLOCKLIST_DE_MAIL|86400|0|http://lists.blocklist.de/lists/mail.txt

# Name: BLOCKLIST_DE_SIP
# Category: attacks
# Maintainer: Blocklist.de
# Maintainer URL: https://www.blocklist.de/
# Information: All IP addresses that tried to login in a SIP, VOIP or Asterisk Server and are included in the IPs list from
# infiltrated.net
#BLOCKLIST_DE_SIP|86400|0|http://lists.blocklist.de/lists/sip.txt

# Name: BLOCKLIST_DE_SSH
# Category: attacks
# Maintainer: Blocklist.de
# Maintainer URL: https://www.blocklist.de/
# Information: All IP addresses which have been reported within the last 48 hours as having run attacks on the service SSH.
#BLOCKLIST_DE_SSH|86400|0|http://lists.blocklist.de/lists/ssh.txt

# Name: BLOCKLIST_DE_STRONGIPS
# Category: attacks
# Maintainer: Blocklist.de
# Maintainer URL: https://www.blocklist.de/
# Information: All IPs which are older then 2 month and have more then 5.000 attacks.
#BLOCKLIST_DE_STRONGIPS|86400|0|http://lists.blocklist.de/lists/strongips.txt

# Name: BLOCKLIST_NET_UA
# Category: abuse
# Maintainer: blocklist.net.ua
# Maintainer URL: https://blocklist.net.ua
# Information: The BlockList project was created to become protection against negative influence of the harmful and potentially
# dangerous events on the Internet. First of all this service will help internet and hosting providers to protect
# subscribers sites from being hacked. BlockList will help to stop receiving a large amount of spam from dubious SMTP
# relays or from attempts of brute force passwords to servers and network equipment.
#BLOCKLIST_NET_UA|86400|0|https://blocklist.net.ua/blocklist.csv

# Name: BM_TOR
# Category: anonymizers
# Maintainer: torstatus.blutmagie.de
# Maintainer URL: https://torstatus.blutmagie.de/
# Information: List of all TOR network servers
#BM_TOR|86400|0|https://torstatus.blutmagie.de/ip_list_all.php/Tor_ip_list_ALL.csv

# Name: BOGON
# Category: unroutable
# Maintainer: Team Cymru
# Maintainer URL: http://www.team-cymru.org/Services/Bogons/
# Information: Private and reserved addresses defined by RFC 1918, RFC 5735, and RFC 6598 and netblocks that have not been allocated to
# a regional internet registry
#BOGON|86400|0|http://www.cymru.com/Documents/bogon-bn-agg.txt

# Name: BOTSCOUT
# Category: abuse
# Maintainer: BotScout.com
# Maintainer URL: http://botscout.com/
# Information: Helps prevent automated web scripts, known as bots, from registering on forums, polluting databases, spreading spam, and
# abusing forms on web sites. They do this by tracking the names, IPs, and email addresses that bots use and logging them
# as unique signatures for future reference. They also provide a simple yet powerful API that you can use to test forms
# when they're submitted on your site. This list is composed of the most recently-caught bots.
#BOTSCOUT|86400|0|http://botscout.com/last_caught_cache.htm

# Name: BRUTEFORCEBLOCKER
# Category: attacks
# Maintainer: danger.rulez.sk
# Maintainer URL: http://danger.rulez.sk/index.php/bruteforceblocker/
# Information: (fail2ban alternative for SSH on OpenBSD) . This is an automatically generated list from users reporting failed
# authentication attempts. An IP seems to be included if 3 or more users report it. Its retention pocily seems 30 days.
#BRUTEFORCEBLOCKER|86400|0|http://danger.rulez.sk/projects/bruteforceblocker/blist.php

# Name: CHAOSREIGNS_IPREP
# Category: spam
# Maintainer: ChaosReigns.com
# Maintainer URL: http://www.chaosreigns.com/iprep
# Information: The iprep0 list includes all IPs that sent only spam emails. This is an automated, free, public email IP reputation
# system.
#CHAOSREIGNS_IPREP|86400|0|http://www.chaosreigns.com/iprep/iprep.txt

# Name: CIARMY
# Category: reputation
# Maintainer: Collective Intelligence Network Security
# Maintainer URL: http://ciarmy.com/
# Information: IPs with poor Rogue Packet score that have not yet been identified as malicious by the community
#CIARMY|86400|0|http://cinsscore.com/list/ci-badguys.txt

# Name: CLEANMX_VIRUSES
# Category: spam
# Maintainer: Clean-MX.de
# Maintainer URL: http://support.clean-mx.de/clean-mx/viruses.php
# Information: IPs with viruses
#CLEANMX_VIRUSES|86400|0|http://support.clean-mx.de/clean-mx/xmlviruses.php?response=alive&fields=ip

# Name: CRUZIT_WEB_ATTACKS
# Category: attacks
# Maintainer: CruzIt.com
# Maintainer URL: http://www.cruzit.com/wbl.php
# Information: IPs of compromised machines scanning for vulnerabilities and DDOS attacks
#CRUZIT_WEB_ATTACKS|86400|0|http://www.cruzit.com/xwbl2txt.php

# Name: CTA_CRYPTOWALL
# Category: malware
# Maintainer: Cyber Threat Alliance
# Maintainer URL: http://www.cyberthreatalliance.org/cryptowall-dashboard.html
# Information: Cyber Threat Alliance CryptoWall is one of the most lucrative and broad-reaching ransomware campaigns affecting Internet
# users today. Sharing intelligence and analysis resources, the CTA profiled the latest version of CryptoWall, which
# impacted hundreds of thousands of users, resulting in over US $325 million in damages worldwide.
#CTA_CRYPTOWALL|86400|0|https://public.tableau.com/views/CTAOnlineViz/DashboardData.csv?:embed=y&:showVizHome=no&:showTabs=y&:display_count=y&:display_static_image=y&:bootstrapWhenNotified=true

# Name: DARKLIST_DE
# Category: attacks
# Maintainer: darklist.de
# Maintainer URL: http://www.darklist.de/
# Information: Ssh fail2ban reporting
#DARKLIST_DE|172800|0|http://www.darklist.de/raw.php

# Name: DRAGON_HTTP
# Category: attacks
# Maintainer: Dragon Research Group (DRG)
# Maintainer URL: http://www.dragonresearchgroup.org/
# Information: IPs that have been seen sending HTTP requests to Dragon Research Pods in the last 7 days. This report lists hosts that
# are highly suspicious and are likely conducting malicious HTTP attacks. LEGITIMATE SEARCH ENGINE BOTS MAY BE IN THIS
# LIST. This report is informational.  It is not a blacklist, but some operators may choose to use it to help protect
# their networks and hosts in the forms of automated reporting and mitigation services.
#DRAGON_HTTP|86400|0|http://www.dragonresearchgroup.org/insight/http-report.txt

# Name: DRAGON_SSHPAUTH
# Category: attacks
# Maintainer: Dragon Research Group (DRG)
# Maintainer URL: http://www.dragonresearchgroup.org/
# Information: IP address that has been seen attempting to remotely login to a host using SSH password authentication, in the last 7
# days. This report lists hosts that are highly suspicious and are likely conducting malicious SSH password authentication
# attacks.
#DRAGON_SSHPAUTH|86400|0|https://www.dragonresearchgroup.org/insight/sshpwauth.txt

# Name: DRAGON_VNCPROBE
# Category: attacks
# Maintainer: Dragon Research Group (DRG)
# Maintainer URL: http://www.dragonresearchgroup.org/
# Information: IP address that has been seen attempting to remotely connect to a host running the VNC application service, in the last
# 7 days. This report lists hosts that are highly suspicious and are likely conducting malicious VNC probes or VNC brute
# force attacks.
#DRAGON_VNCPROBE|86400|0|https://www.dragonresearchgroup.org/insight/vncprobe.txt

# Name: DSHIELD
# Category: attacks
# Maintainer: DShield.org
# Maintainer URL: https://dshield.org/
# Information: Top 20 attacking class C (/24) subnets over the last three days
#DSHIELD|86400|0|http://feeds.dshield.org/block.txt

# Name: ET_BLOCK
# Category: attacks
# Maintainer: Emerging Threats
# Maintainer URL: http://www.emergingthreats.net/
# Information: Default blacklist (at the time of writing includes spamhaus DROP, dshield and abuse.ch trackers, which are available
# separately too - prefer to use the direct ipsets instead of this, they seem to lag a bit in updates)
#ET_BLOCK|86400|0|http://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt

# Name: ET_BOTCC
# Category: reputation
# Maintainer: Emerging Threats
# Maintainer URL: http://www.emergingthreats.net/
# Information: These IPs are updates every 24 hours and should be considered VERY highly reliable indications that a host is
# communicating with a known and active Bot or Malware command and control server - (although they say this includes
# abuse.ch trackers, it does not - check its overlaps)
#ET_BOTCC|86400|0|http://rules.emergingthreats.net/fwrules/emerging-PIX-CC.rules

# Name: ET_COMPROMISED
# Category: attacks
# Maintainer: Emerging Threats
# Maintainer URL: http://www.emergingthreats.net/
# Information: Compromised hosts
#ET_COMPROMISED|86400|0|http://rules.emergingthreats.net/blockrules/compromised-ips.txt

# Name: ET_DSHIELD
# Category: attacks
# Maintainer: Emerging Threats
# Maintainer URL: http://www.emergingthreats.net/
# Information: Dshield blocklist
#ET_DSHIELD|86400|0|http://rules.emergingthreats.net/fwrules/emerging-PIX-DSHIELD.rules

# Name: ET_SPAMHAUS
# Category: attacks
# Maintainer: Emerging Threats
# Maintainer URL: http://www.emergingthreats.net/
# Information: Spamhaus blocklist
#ET_SPAMHAUS|86400|0|http://rules.emergingthreats.net/fwrules/emerging-PIX-DROP.rules

# Name: ET_TOR
# Category: anonymizers
# Maintainer: Emerging Threats
# Maintainer URL: http://www.emergingthreats.net/
# Information: Of TOR network IPs
#ET_TOR|86400|0|http://rules.emergingthreats.net/blockrules/emerging-tor.rules

# Name: FEODO
# Category: malware
# Maintainer: Abuse.ch
# Maintainer URL: https://feodotracker.abuse.ch/
# Information: Trojan includes IPs which are being used by Feodo (also known as Cridex or Bugat) which commits ebanking fraud
#FEODO|86400|0|https://feodotracker.abuse.ch/blocklist/?download=ipblocklist

# Name: GREENSNOW
# Category: attacks
# Maintainer: GreenSnow.co
# Maintainer URL: https://greensnow.co/
# Information: Is a team harvesting a large number of IPs from different computers located around the world. GreenSnow is comparable
# with SpamHaus.org for attacks of any kind except for spam. Their list is updated automatically and you can withdraw at
# any time your IP address if it has been listed. Attacks / bruteforce that are monitored are: Scan Port, FTP, POP3,
# mod_security, IMAP, SMTP, SSH, cPanel, etc.
#GREENSNOW|86400|0|http://blocklist.greensnow.co/greensnow.txt

# Name: HONEYPOT
# Category: attacks
# Maintainer: Project Honeypot
# Maintainer URL: http://www.projecthoneypot.org
# Information: Project Honey Pot Directory of Dictionary Attacker IPs
#HONEYPOT|86400|0|http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1

# Name: IW_SPAMLIST
# Category: spam
# Maintainer: ImproWare Antispam
# Maintainer URL: http://antispam.imp.ch/
# Information: IPs sending spam, in the last 3 days
#IW_SPAMLIST|86400|0|http://antispam.imp.ch/spamlist

# Name: IW_WORMLIST
# Category: spam
# Maintainer: ImproWare Antispam
# Maintainer URL: http://antispam.imp.ch/
# Information: IPs sending emails with viruses or worms, in the last 3 days
#IW_WORMLIST|86400|0|http://antispam.imp.ch/wormlist

# Name: LASHBACK_UBL
# Category: spam
# Maintainer: The LashBack Unsubscribe Blacklist
# Maintainer URL: http://blacklist.lashback.com/
# Information: The Unsubscribe Blacklist (UBL)  is a real-time blacklist of IP addresses which are sending email to names harvested
# from suppression files (this is a big list, more than 500.000 IPs)
#LASHBACK_UBL|172800|0|http://www.unsubscore.com/blacklist.txt

# Name: MALC0DE
# Category: malware
# Maintainer: malc0de.com
# Maintainer URL: http://malc0de.com/
# Information: Malicious IPs of the last 30 days
#MALC0DE|172800|0|http://malc0de.com/bl/IP_Blacklist.txt

# Name: MALWAREDOMAINLIST
# Category: malware
# Maintainer: MalwareDomainList.com
# Maintainer URL: http://www.malwaredomainlist.com/
# Information: List of malware active ip addresses
#MALWAREDOMAINLIST|86400|0|http://www.malwaredomainlist.com/hostslist/ip.txt

# Name: MAXMIND
# Category: anonymizers
# Maintainer: Maxmind
# Maintainer URL: https://www.maxmind.com/en/anonymous_proxies
# Information: MaxMind GeoIP Anonymous Proxies
#MAXMIND|86400|0|https://www.maxmind.com/en/anonymous_proxies

# Name: MYIP
# Category: abuse
# Maintainer: MyIP.ms
# Maintainer URL: http://myip.ms/
# Information: IPs identified as web bots in the last 10 days, using several sites that require human action
#MYIP|172800|0|http://www.myip.ms/files/blacklist/csf/latest_blacklist.txt

# Name: NT_MALWARE_DNS
# Category: attacks
# Maintainer: NoThink.org
# Maintainer URL: http://www.nothink.org/
# Information: Malware DNS (the original list includes hostnames and domains, which are ignored)
#NT_MALWARE_DNS|86400|0|http://www.nothink.org/blacklist/blacklist_malware_dns.txt

# Name: NT_MALWARE_HTTP
# Category: attacks
# Maintainer: NoThink.org
# Maintainer URL: http://www.nothink.org/
# Information: Malware HTTP
#NT_MALWARE_HTTP|86400|0|http://www.nothink.org/blacklist/blacklist_malware_http.txt

# Name: NT_MALWARE_IRC
# Category: attacks
# Maintainer: NoThink.org
# Maintainer URL: http://www.nothink.org/
# Information: Malware IRC
#NT_MALWARE_IRC|86400|0|http://www.nothink.org/blacklist/blacklist_malware_irc.txt

# Name: NT_SSH_7D
# Category: attacks
# Maintainer: NoThink.org
# Maintainer URL: http://www.nothink.org/
# Information: Last 7 days SSH attacks
#NT_SSH_7D|86400|0|http://www.nothink.org/blacklist/blacklist_ssh_week.txt

# Name: OPENBL
# Category: attacks
# Maintainer: OpenBL.org
# Maintainer URL: https://www.openbl.org
# Information: OpenBL.org 30 day List
#OPENBL|86400|0|https://www.openbl.org/lists/base_30days.txt

# Name: OPENBL_180D
# Category: attacks
# Maintainer: OpenBL.org
# Maintainer URL: http://www.openbl.org/
# Information: Last 180 days IPs.  OpenBL.org is detecting, logging and reporting various types of internet abuse.
#OPENBL_180D|86400|0|http://www.openbl.org/lists/base_180days.txt

# Name: OPENBL_1D
# Category: attacks
# Maintainer: OpenBL.org
# Maintainer URL: http://www.openbl.org/
# Information: Last 24 hours IPs.  OpenBL.org is detecting, logging and reporting various types of internet abuse.
#OPENBL_1D|86400|0|http://www.openbl.org/lists/base_1days.txt

# Name: OPENBL_30D
# Category: attacks
# Maintainer: OpenBL.org
# Maintainer URL: http://www.openbl.org/
# Information: Last 30 days IPs.  OpenBL.org is detecting, logging and reporting various types of internet abuse.
#OPENBL_30D|86400|0|http://www.openbl.org/lists/base_30days.txt

# Name: OPENBL_360D
# Category: attacks
# Maintainer: OpenBL.org
# Maintainer URL: http://www.openbl.org/
# Information: Last 360 days IPs.  OpenBL.org is detecting, logging and reporting various types of internet abuse.
#OPENBL_360D|86400|0|http://www.openbl.org/lists/base_360days.txt

# Name: OPENBL_60D
# Category: attacks
# Maintainer: OpenBL.org
# Maintainer URL: http://www.openbl.org/
# Information: Last 60 days IPs.  OpenBL.org is detecting, logging and reporting various types of internet abuse.
#OPENBL_60D|86400|0|http://www.openbl.org/lists/base_60days.txt

# Name: OPENBL_7D
# Category: attacks
# Maintainer: OpenBL.org
# Maintainer URL: http://www.openbl.org/
# Information: Last 7 days IPs.  OpenBL.org is detecting, logging and reporting various types of internet abuse.
#OPENBL_7D|86400|0|http://www.openbl.org/lists/base_7days.txt

# Name: OPENBL_90D
# Category: attacks
# Maintainer: OpenBL.org
# Maintainer URL: http://www.openbl.org/
# Information: Last 90 days IPs.  OpenBL.org is detecting, logging and reporting various types of internet abuse.
#OPENBL_90D|86400|0|http://www.openbl.org/lists/base_90days.txt

# Name: OPENBL_ALL
# Category: attacks
# Maintainer: OpenBL.org
# Maintainer URL: http://www.openbl.org/
# Information: Last all IPs.  OpenBL.org is detecting, logging and reporting various types of internet abuse.
#OPENBL_ALL|86400|0|http://www.openbl.org/lists/base_all.txt

# Name: PACKETMAIL
# Category: reputation
# Maintainer: PacketMail.net
# Maintainer URL: https://www.packetmail.net/iprep.txt
# Information: IP addresses have been detected performing TCP SYN to 206.82.85.196/30 to a non-listening service or daemon. No
# assertion is made, nor implied, that any of the below listed IP addresses are accurate, malicious, hostile, or engaged
# in nefarious acts. Use this list at your own risk.
#PACKETMAIL|86400|0|https://www.packetmail.net/iprep.txt

# Name: PHP_COMMENTERS
# Category: spam
# Maintainer: ProjectHoneypot.org
# Maintainer URL: http://www.projecthoneypot.org/
# Information: Comment spammers (this list is composed using an RSS feed)
#PHP_COMMENTERS|86400|0|http://www.projecthoneypot.org/list_of_ips.php?t=c&rss=1

# Name: PHP_DICTIONARY
# Category: spam
# Maintainer: ProjectHoneypot.org
# Maintainer URL: http://www.projecthoneypot.org/
# Information: Directory attackers (this list is composed using an RSS feed)
#PHP_DICTIONARY|86400|0|http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1

# Name: PHP_HARVESTERS
# Category: spam
# Maintainer: ProjectHoneypot.org
# Maintainer URL: http://www.projecthoneypot.org/
# Information: Harvesters (IPs that surf the internet looking for email addresses)  (this list is composed using an RSS feed)
#PHP_HARVESTERS|86400|0|http://www.projecthoneypot.org/list_of_ips.php?t=h&rss=1

# Name: PHP_SPAMMERS
# Category: spam
# Maintainer: ProjectHoneypot.org
# Maintainer URL: http://www.projecthoneypot.org/
# Information: Spam servers (IPs used by spammers to send messages)  (this list is composed using an RSS feed)
#PHP_SPAMMERS|86400|0|http://www.projecthoneypot.org/list_of_ips.php?t=s&rss=1

# Name: PROXYLISTS
# Category: anonymizers
# Maintainer: ProxyLists.net
# Maintainer URL: http://www.proxylists.net/
# Information: Open proxies (this list is composed using an RSS feed)
#PROXYLISTS|86400|0|http://www.proxylists.net/proxylists.xml

# Name: PROXYSPY
# Category: anonymizers
# Maintainer: ProxySpy (spys.ru)
# Maintainer URL: http://spys.ru/en/
# Information: Open proxies (updated hourly)
#PROXYSPY|86400|0|http://txt.proxyspy.net/proxy.txt

# Name: SBLAM
# Category: abuse
# Maintainer: sblam.com
# Maintainer URL: http://sblam.com/
# Information: IPs used by web form spammers, during the last month
#SBLAM|172800|0|http://sblam.com/blacklist.txt

# Name: SHUNLIST
# Category: attacks
# Maintainer: AutoShun.org
# Maintainer URL: http://autoshun.org/
# Information: IPs identified as hostile by correlating logs from distributed snort installations running the autoshun plugin
#SHUNLIST|86400|0|http://www.autoshun.org/files/shunlist.csv

# Name: SNORT_IPFILTER
# Category: attacks
# Maintainer: Snort.org Labs
# Maintainer URL: https://labs.snort.org/
# Information: Supplied IP blacklist (this list seems to be updated frequently, but we found no information about it)
#SNORT_IPFILTER|86400|0|http://labs.snort.org/feeds/ip-filter.blf

# Name: SPAMDROP
# Category: spam
# Maintainer: Spamhaus
# Maintainer URL: http://www.spamhaus.org/drop/
# Information: Do not Route Or Peer List (DROP)
#SPAMDROP|86400|0|http://www.spamhaus.org/drop/drop.lasso

# Name: SPAMEDROP
# Category: spam
# Maintainer: Spamhaus
# Maintainer URL: http://www.spamhaus.org/drop/
# Information: Spamhaus Extended DROP List (EDROP)
#SPAMEDROP|86400|0|http://www.spamhaus.org/drop/edrop.lasso

# Name: SSLBL
# Category: malware
# Maintainer: Abuse.ch
# Maintainer URL: https://sslbl.abuse.ch/
# Information: Bad SSL traffic related to malware or botnet activities
#SSLBL|86400|0|https://sslbl.abuse.ch/blacklist/sslipblacklist.csv

# Name: SSLBL_AGGRESSIVE
# Category: malware
# Maintainer: Abuse.ch
# Maintainer URL: https://sslbl.abuse.ch/
# Information: The aggressive version of the SSL IP Blacklist contains all IPs that SSLBL ever detected being associated with a
# malicious SSL certificate. Since IP addresses can be reused (e.g. when the customer changes) , this blacklist may cause
# false positives.
#SSLBL_AGGRESSIVE|86400|0|https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.csv

# Name: TALOSINTEL_IPFILTER
# Category: attacks
# Maintainer: TalosIntel.com
# Maintainer URL: http://talosintel.com/
# Information: List of known malicious network threats
#TALOSINTEL_IPFILTER|86400|0|http://talosintel.com/feeds/ip-filter.blf

# Name: TOR
# Category: anonymizers
# Maintainer: Torproject
# Maintainer URL: https://trac.torproject.org/projects/tor/wiki/doc/TorDNSExitList
# Information: TOR Exit Nodes List
#TOR|86400|0|https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=1.2.3.4

# Name: TOR_EXITS
# Category: anonymizers
# Maintainer: TorProject.org
# Maintainer URL: https://www.torproject.org/
# Information: List of all current TOR exit points (TorDNSEL)
#TOR_EXITS|86400|0|https://check.torproject.org/exit-addresses

# Name: TRUSTEDSEC_ATIF
# Category: reputation
# Maintainer: TrustedSec
# Maintainer URL: https://www.trustedsec.com/
# Information: Artillery Threat Intelligence Feed and Banlist Feed
#TRUSTEDSEC_ATIF|172800|0|https://www.trustedsec.com/banlist.txt

# Name: VIRBL
# Category: spam
# Maintainer: VirBL.bit.nl
# Maintainer URL: http://virbl.bit.nl/
# Information: Is a project of which the idea was born during the RIPE-48 meeting. The plan was to get reports of virusscanning
# mailservers, and put the IP-addresses that were reported to send viruses on a blacklist.
#VIRBL|86400|0|http://virbl.bit.nl/download/virbl.dnsbl.bit.nl.txt

# Name: VOIPBL
# Category: attacks
# Maintainer: VoIPBL.org
# Maintainer URL: http://www.voipbl.org/
# Information: A distributed VoIP blacklist that is aimed to protects against VoIP Fraud and minimizing abuse for network that have
# publicly accessible PBX's. Several algorithms, external sources and manual confirmation are used before they categorize
# something as an attack and determine the threat level.
#VOIPBL|86400|0|http://www.voipbl.org/update/

# Name: XROXY
# Category: anonymizers
# Maintainer: Xroxy.com
# Maintainer URL: http://www.xroxy.com/
# Information: Open proxies (this list is composed using an RSS feed)
#XROXY|86400|0|http://www.xroxy.com/proxyrss.xml

# Name: ZEUS
# Category: malware
# Maintainer: Abuse.ch
# Maintainer URL: https://zeustracker.abuse.ch/
# Information: Standard, contains the same data as the ZeuS IP blocklist (zeus_badips)  but with the slight difference that it do not
# exclude hijacked websites (level 2)  and free web hosting providers (level 3) . This means that this blocklist contains
# all IPv4 addresses associated with ZeuS C&Cs which are currently being tracked by ZeuS Tracker. Hence this blocklist
# will likely cause some false positives.
#ZEUS|86400|0|https://zeustracker.abuse.ch/blocklist.php?download=ipblocklist

# Name: ZEUS_BADIPS
# Category: malware
# Maintainer: Abuse.ch
# Maintainer URL: https://zeustracker.abuse.ch/
# Information: Badips includes IPv4 addresses that are used by the ZeuS trojan. It is the recommened blocklist if you want to block
# only ZeuS IPs. It excludes IP addresses that ZeuS Tracker believes to be hijacked (level 2)  or belong to a free web
# hosting provider (level 3) . Hence the false postive rate should be much lower compared to the standard ZeuS IP
# blocklist.
#ZEUS_BADIPS|86400|0|https://zeustracker.abuse.ch/blocklist.php?download=badips
  • Firewall, CSF
  • 1 Users Found This Useful
Was this answer helpful?

Related Articles

How to protect your website's images from an external website?

External Website can use < img /> tag to display an image from your site somewhere else on...

How to disable directory browsing using .htaccess?

For security purposes, we recommend that you to disable directory browsing on your website so no...

How to protect your .htaccess file?

For security purpose we recommended you to prevent access to your .htaccess file from...

How to restrict directory access by IP address?

In order to secure your admin area from hackers, we recommended you to allow access only from...

How to ban any IP Address via .htaccess?

If someone is trying to hack your website or you want to block their IP Address, you can add this...