IDS

Blocklists for Suricata / IDS

Intrusion detection systems can read IP reputation lists as datasets.

5compatible lists
1supported formats
10categories
Browse lists Setup guide Official documentation

Adding a blocklist to Suricata / IDS 

curl -fsSL "https://www.team-cymru.org/Services/Bogons/fullbogons-ipv6.txt" -o /var/lib/suricata/data/blocklist.txt

Reference the file from a rule using a dataset:

alert ip [!$HOME_NET] any -> $HOME_NET any (msg:"Team Cymru Fullbogons (IPv6) match"; 
  ip.src; dataset:isset,blocklist, type string, load blocklist.txt; sid:1000001;)

The address shown above is an example. Every list in the directory has its own URL, which you can copy with one click.

By topic

Malware 55 Comprehensive 28 Ads 24 Privacy 21 Security 18 Phishing 10 Allowlist 5 Adult content 2 Annoyances 1 Cryptomining 1

All 5 lists for Suricata / IDS

Submit a list
5 lists < 7 days < 30 days older

Cloudflare IPv4 ranges

Cloudflare IPv4 ranges, meant as an allowlist.

Allowlist IP / CIDR
15 entries
±0 last change
updated
FHIPSMTWRTOPN+2
Details

Cloudflare IPv6 ranges

Cloudflare IPv6 ranges, meant as an allowlist.

Allowlist IP / CIDR
7 entries
±0 last change
updated
FHIPSMTWRTOPN+2
Details

pexcn China Whitelist

Filter list covering allowlist. Format: Socks5. See the project homepage for details and inclusion criteria.

Allowlist IP / CIDR
2,211 entries
+70 -70 last change
updated
FHIPSMTWRTOPN+3
Details

Shub’s Whitelist

by DevShubam

Filter list covering allowlist. Format: IPs (IPv4). Maintained by DevShubam. See the project homepage for details and inclusion criteria.

Allowlist IP / CIDR
114 entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

Syncthing Relay Server IPs

by Wu Tingfeng

Filter list covering allowlist. Format: IPs (IPv4). Maintained by Wu Tingfeng. See the project homepage for details and inclusion criteria.

Allowlist IP / CIDR
100 entries
+90 -90 last change
updated
FHIPSMTWRTOPN+3
Details
Scroll to Top