IDS

Blocklists for Suricata / IDS

Intrusion detection systems can read IP reputation lists as datasets.

55compatible lists
1supported formats
10categories
Browse lists Setup guide Official documentation

Adding a blocklist to Suricata / IDS 

curl -fsSL "https://www.team-cymru.org/Services/Bogons/fullbogons-ipv6.txt" -o /var/lib/suricata/data/blocklist.txt

Reference the file from a rule using a dataset:

alert ip [!$HOME_NET] any -> $HOME_NET any (msg:"Team Cymru Fullbogons (IPv6) match"; 
  ip.src; dataset:isset,blocklist, type string, load blocklist.txt; sid:1000001;)

The address shown above is an example. Every list in the directory has its own URL, which you can copy with one click.

By topic

Malware 55 Comprehensive 28 Ads 24 Privacy 21 Security 18 Phishing 10 Allowlist 5 Adult content 2 Annoyances 1 Cryptomining 1

All 55 lists for Suricata / IDS

Submit a list
55 lists < 7 days < 30 days older

hpHosts FSA (IPs)

Filter list covering malware. Format: IPs (IPv4).

Malware IP / CIDR
24.8k entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

IPsum Level 4

Filter list covering malware. Format: IPs (IPv4). See the project homepage for details and inclusion criteria.

Malware IP / CIDR
7,743 entries
+3,447 -2,188 last change
updated
FHIPSMTWRTOPN+3
Details

IPsum Level 5

Filter list covering malware. Format: IPs (IPv4). See the project homepage for details and inclusion criteria.

Malware IP / CIDR
3,353 entries
+1,460 -774 last change
updated
FHIPSMTWRTOPN+3
Details

IPsum Level 6

Filter list covering malware. Format: IPs (IPv4). See the project homepage for details and inclusion criteria.

Malware IP / CIDR
864 entries
+539 -308 last change
updated
FHIPSMTWRTOPN+3
Details

ISX Solutions Blocklist

Filter list covering malware. Format: IPs (IPv4). See the project homepage for details and inclusion criteria.

Malware IP / CIDR
53 entries
+9 -24 last change
updated
FHIPSMTWRTOPN+3
Details

Krisk Intel – Malicious IP List

Filter list covering malware. Format: IPs (IPv4). See the project homepage for details and inclusion criteria.

Malware IP / CIDR
- entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

Malc0de IP Blacklist

Filter list covering malware. Format: IPs (IPv4). See the project homepage for details and inclusion criteria.

Malware IP / CIDR
- entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

MalSilo IPv4 Feed

by MalSilo

Filter list covering malware. Format: IPs (IPv4). Maintained by MalSilo. See the project homepage for details and inclusion criteria.

Malware IP / CIDR
8 entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

Maltrail – Parking sites

Filter list covering malware. Format: IPs (IPv4). See the project homepage for details and inclusion criteria.

Malware IP / CIDR
- entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

Malware Domain List (IPs)

by Malware Domain List Community

Filter list covering malware. Format: IPs (IPv4). Maintained by Malware Domain List Community. See the project homepage for details and […]

Malware IP / CIDR
- entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

Mirai Tracker

Filter list covering malware. Format: IPs (IPv4). See the project homepage for details and inclusion criteria.

Malware IP / CIDR
- entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

MyIP Blacklist

Filter list covering malware. Format: IPs (IPv4). See the project homepage for details and inclusion criteria.

Malware IP / CIDR
1,252 entries
+180 -64 last change
updated
FHIPSMTWRTOPN+3
Details

NETMOUNTAINS IP Blocklist

by NETMOUNTAINS® Group GmbH

Filter list covering malware. Format: IPs (IPv4). Maintained by NETMOUNTAINS® Group GmbH. See the project homepage for details and inclusion […]

Malware IP / CIDR
- entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

noads.online AdGuard Home Megalist (DNS)

by deletescape

Filter list covering ads, privacy, malware. Format: DNS servers. Maintained by deletescape. See the project homepage for details and inclusion […]

Ads Malware Privacy IP / CIDR
- entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

pfBlockerNG – MS-1

by BBcan177

Filter list covering malware. Format: IPs (IPv4). Maintained by BBcan177. See the project homepage for details and inclusion criteria.

Malware IP / CIDR
2,782 entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

pfBlockerNG – MS-3

by BBcan177

Filter list covering malware. Format: IPs (IPv4). Maintained by BBcan177. See the project homepage for details and inclusion criteria.

Malware IP / CIDR
1,384 entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

ShadowWhisperer – Malware Browser

by ShadowWhisperer

Filter list covering malware. Format: IPs (IPv4). Maintained by ShadowWhisperer. See the project homepage for details and inclusion criteria.

Malware IP / CIDR
- entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

ShadowWhisperer – Malware Hackers

by ShadowWhisperer

Filter list covering malware. Format: IPs (IPv4). Maintained by ShadowWhisperer. See the project homepage for details and inclusion criteria.

Malware IP / CIDR
- entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

ShadowWhisperer – Malware Hackers_Old

by ShadowWhisperer

Filter list covering malware. Format: IPs (IPv4). Maintained by ShadowWhisperer. See the project homepage for details and inclusion criteria.

Malware IP / CIDR
- entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

ShadowWhisperer – Malware Hosting

by ShadowWhisperer

Filter list covering malware. Format: IPs (IPv4). Maintained by ShadowWhisperer. See the project homepage for details and inclusion criteria.

Malware IP / CIDR
- entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

Spamhaus Don’t Route Or Peer List (DROP)

Filter list covering malware. Format: CIDRs (IPv4). See the project homepage for details and inclusion criteria.

Malware IP / CIDR
989 entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details
Page 2 of 3
Scroll to Top