IDS

Blocklists for Suricata / IDS

Intrusion detection systems can read IP reputation lists as datasets.

10compatible lists
1supported formats
10categories
Browse lists Setup guide Official documentation

Adding a blocklist to Suricata / IDS 

curl -fsSL "https://www.team-cymru.org/Services/Bogons/fullbogons-ipv6.txt" -o /var/lib/suricata/data/blocklist.txt

Reference the file from a rule using a dataset:

alert ip [!$HOME_NET] any -> $HOME_NET any (msg:"Team Cymru Fullbogons (IPv6) match"; 
  ip.src; dataset:isset,blocklist, type string, load blocklist.txt; sid:1000001;)

The address shown above is an example. Every list in the directory has its own URL, which you can copy with one click.

By topic

Malware 55 Comprehensive 28 Ads 24 Privacy 21 Security 18 Phishing 10 Allowlist 5 Adult content 2 Annoyances 1 Cryptomining 1

All 10 lists for Suricata / IDS

Submit a list
10 lists < 7 days < 30 days older

BlockConvert (IPs)

Filter list covering crypto, ads, privacy, malware, phishing. Format: IPs (IPv4). See the project homepage for details and inclusion criteria.

Ads Cryptomining Malware IP / CIDR
- entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

ChongLuaDao Phishing Blocklist (IPs)

by Wu Tingfeng

Filter list covering phishing. Format: IPs (IPv4). Maintained by Wu Tingfeng. See the project homepage for details and inclusion criteria.

Phishing IP / CIDR
4 entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

Dandelion Sprout’s and other adblocker lists’ IPs

by Imre Kristoffer Eilertsen

Filter list covering ads, phishing. Format: IPs (IPv4). Maintained by Imre Kristoffer Eilertsen. See the project homepage for details and […]

Ads Phishing IP / CIDR
879 entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

Dandelion Sprout’s Official DNS Server

by Imre Kristoffer Eilertsen

Filter list covering ads, malware, phishing, cookies, push-notes. Format: DNS servers. Maintained by Imre Kristoffer Eilertsen. See the project homepage […]

Ads Annoyances Malware IP / CIDR
- entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

hpHosts GRM (IPs)

Filter list covering phishing. Format: IPs (IPv4).

Phishing IP / CIDR
293 entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

hpHosts PHA (IPs)

Filter list covering phishing. Format: IPs (IPv4).

Phishing IP / CIDR
2,474 entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

phishing-filter (dnscrypt-proxy IPs)

by Ming Di Leom

Filter list covering phishing. Format: IPs (IPv4). Maintained by Ming Di Leom. See the project homepage for details and inclusion […]

Phishing IP / CIDR
42 entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details

TR-PhishingList IP List

Filter list covering phishing. Format: IPs (IPv4). See the project homepage for details and inclusion criteria.

Phishing IP / CIDR
96.0k entries
±0 last change
updated
FHIPSMTWRTOPN+3
Details
Scroll to Top