Warning
IMPORTANT: BRANCH CHANGE
To prevent massive repository bloat, all generated blocklists are now published to the release branch instead of main.
If you are using raw GitHub URLs in your firewalls or scripts, you must update your URLs to point to the release branch.
A collection of freely available, regularly updated IP blacklists for use in firewalls, bunkerweb, apache waf, fail2ban, IDS/IPS, network security solutions, or threat hunting.
| File | Description | Source |
|---|---|---|
blocklist_net_ua.list |
Malicious IPs according to blocklist.net.ua | Link |
dm_tor.list |
Active TOR exit and relay nodes | Link |
et_block.list |
Known malicious IPs from Emerging Threats | Link |
firehol-level4.list |
General malicious IPs – low risk | Link |
firehol_webserver.list |
Compromised or dangerous web servers | Link |
greensnow.list |
Attackers with suspicious behavior | Link |
iblocklist_ciarmy_malicious.list |
IPs with confirmed malicious behavior | Link |
spamhaus_drop.list |
Spamhaus DROP – known cybercrime networks | Link |
spamhaus_edrop.list |
Spamhaus eDROP – extended cybercrime IP list | Link |
stopforumspam.list |
IPs that have been flagged for forum spam | Link |
For easy integration into firewalls or network analyses, a consolidated blacklist is available that combines all of the above sources:
AIO blacklist:
https://raw.githubusercontent.com/zenfokus/blacklists/refs/heads/release/aio/aio_blacklist.list
This list is updated regularly and is ideal for productive use if only one central file is to be used.
All lists come from publicly available sources. Please note the respective terms of use of the original sources. This collection is intended solely for research and security analysis.