https://cinsscore.com/list/ci-badguys.txt Open raw list Description
Filter list covering malware. Format: IPs (IPv4). See the project homepage for details and inclusion criteria.
Integration
- Go to Firewall → pfBlockerNG → DNSBL → DNSBL Groups (or IP for IP lists).
- Click Add, give the group a name and add the URL below as source (Format: Auto).
- Save, then run Update → Force Reload.
https://cinsscore.com/list/ci-badguys.txtAddress list per script
Fetch the list and import it into an address list called blocklist:
/tool fetch url="https://cinsscore.com/list/ci-badguys.txt" dst-path=blocklist.rsc
/import blocklist.rscIf the list is a plain text file with one address or CIDR per line, convert it first:
/tool fetch url="https://cinsscore.com/list/ci-badguys.txt" dst-path=blocklist.txt
:foreach line in=[/file get blocklist.txt contents] do={
/ip firewall address-list add list=blocklist address=$line comment="CINS Army Bad Guys"
}Use the list in the firewall
/ip firewall filter add chain=forward src-address-list=blocklist action=drop comment="CINS Army Bad Guys"
/ip firewall filter add chain=forward dst-address-list=blocklist action=drop comment="CINS Army Bad Guys"Schedule the fetch with /system scheduler to keep the list current. Very large lists consume RAM, so check the available memory of your device first.
banIP (recommended)
- Install the package:
opkg update && opkg install banip luci-app-banip - Open LuCI → Services → banIP → Feeds and add a custom feed with the URL below.
- Enable the feed and click Save & Apply.
https://cinsscore.com/list/ci-badguys.txtManual with nftables
wget -qO /tmp/blocklist.txt "https://cinsscore.com/list/ci-badguys.txt"
nft add set inet fw4 blocklist { type ipv4_addr; flags interval; }
nft -f - <<EOF
$(awk '!/^[#;]/ && NF {print "add element inet fw4 blocklist { " $1 " }"}' /tmp/blocklist.txt)
EOF
nft add rule inet fw4 forward ip saddr @blocklist dropipset create blocklist hash:net -exist
curl -fsSL "https://cinsscore.com/list/ci-badguys.txt" | grep -Eo '^[0-9]{1,3}(.[0-9]{1,3}){3}(/[0-9]{1,2})?' |
while read -r net; do ipset add blocklist "$net" -exist; done
iptables -I INPUT -m set --match-set blocklist src -j DROP
iptables -I FORWARD -m set --match-set blocklist src -j DROPPersist the set and re-run the download from cron to keep it current:
ipset save blocklist -f /etc/ipset.blocklist
# /etc/cron.daily/blocklist
Add the list as an ipset in /etc/firehol/firehol.conf:
ipset4 create blocklist hash:net
ipset4 addfile blocklist "https://cinsscore.com/list/ci-badguys.txt"
blacklist4 full inface any src ipset:blocklistReload with firehol try and confirm before making it permanent.
- Go to Firewall → Aliases and click +.
- Choose type URL Table (IPs), set a refresh interval (for example 1 day) and paste the URL below.
- Save and apply, then use the alias as source in a block rule under Firewall → Rules.
https://cinsscore.com/list/ci-badguys.txt- Go to Firewall → pfBlockerNG → IP → IPv4 and click Add.
- Paste the URL below as source, set State to ON and pick the action (Deny Both is the usual choice).
- Save, then run Update → Force Reload → IP.
https://cinsscore.com/list/ci-badguys.txtcurl -fsSL "https://cinsscore.com/list/ci-badguys.txt" -o /var/lib/suricata/data/blocklist.txtReference the file from a rule using a dataset:
alert ip [!$HOME_NET] any -> $HOME_NET any (msg:"CINS Army Bad Guys match";
ip.src; dataset:isset,blocklist, type string, load blocklist.txt; sid:1000001;)Recent changes
Recently added entries
- 1.117.58.215
- 1.168.172.140
- 1.177.162.2
- 1.193.57.156
- 1.215.138.43
- 1.24.16.106
- 1.24.16.112
- 1.24.16.119
- 1.24.16.122
- 1.24.16.132
- 1.24.16.133
- 1.24.16.153
- 1.24.16.177
- 1.24.16.184
- 1.24.16.2
- 1.24.16.21
- 1.24.16.28
- 1.24.16.32
- 1.24.16.43
- 1.24.16.46
- 1.24.16.61
- 1.24.16.67
- 1.24.16.71
- 1.24.16.8
- 1.24.16.93
Recently removed entries
- 1.117.68.141
- 1.15.14.29
- 1.192.129.106
- 1.193.63.62
- 1.215.43.201
- 1.236.254.202
- 1.24.16.104
- 1.24.16.107
- 1.24.16.142
- 1.24.16.157
- 1.24.16.165
- 1.24.16.167
- 1.24.16.18
- 1.24.16.180
- 1.24.16.23
- 1.24.16.41
- 1.24.16.59
- 1.24.16.72
- 1.24.16.76
- 1.24.16.94
- 1.24.16.96
- 1.24.229.156
- 1.24.230.113
- 1.54.60.88
- 1.83.125.15