Filter list from the public FilterLists directory. Format: CIDRs (IPv6). See the project homepage for details and inclusion criteria.
157.0k entries
+8 -2 last change
updated
FHIPSMTWRTOPN+3
IDS
Blocklists for Suricata / IDS
Intrusion detection systems can read IP reputation lists as datasets.
18compatible lists
1supported formats
10categories
Adding a blocklist to Suricata / IDS
curl -fsSL "https://www.team-cymru.org/Services/Bogons/fullbogons-ipv6.txt" -o /var/lib/suricata/data/blocklist.txtReference the file from a rule using a dataset:
alert ip [!$HOME_NET] any -> $HOME_NET any (msg:"Team Cymru Fullbogons (IPv6) match";
ip.src; dataset:isset,blocklist, type string, load blocklist.txt; sid:1000001;)The address shown above is an example. Every list in the directory has its own URL, which you can copy with one click.
Recommended lists for Suricata / IDS
By topic
All 18 lists for Suricata / IDS
Category
18 lists < 7 days < 30 days older
Only addresses rated at full confidence within the last 30 days.
150.7k entries
+155 -0 last change
updated
FHIPSMTWRTOPN+2
Filter list covering proxy. Format: DNS servers. See the project homepage for details and inclusion criteria.
- entries
±0 last change
updated
FHIPSMTWRTOPN+3
Address ranges belonging to data centres and hosting providers.
43.0k entries
±0 last change
updated
FHIPSMTWRTOPN+2
Filter list covering proxy. Format: DNS servers. See the project homepage for details and inclusion criteria.
- entries
±0 last change
updated
FHIPSMTWRTOPN+3
The networks attacking most right now, a very short list.
20 entries
±0 last change
updated
FHIPSMTWRTOPN+2
Filter list covering proxy. Format: Socks5. See the project homepage for details and inclusion criteria.
16.4k entries
±0 last change
updated
FHIPSMTWRTOPN+3
Filter list covering ads, proxy. Format: Socks5. See the project homepage for details and inclusion criteria.
17.9k entries
±0 last change
updated
FHIPSMTWRTOPN+3
Filter list covering proxy. Format: DNS servers.
- entries
±0 last change
updated
FHIPSMTWRTOPN+3
Filter list covering proxy. Format: Socks5. See the project homepage for details and inclusion criteria.
4,608 entries
+3 -0 last change
updated
FHIPSMTWRTOPN+3
Filter list covering proxy. Format: IPs (IPv4). See the project homepage for details and inclusion criteria.
400 entries
±0 last change
updated
FHIPSMTWRTOPN+3
Filter list covering proxy. Format: DNS servers. See the project homepage for details and inclusion criteria.
- entries
±0 last change
updated
FHIPSMTWRTOPN+3
Filter list covering ads, privacy, proxy. Format: Socks5.
- entries
±0 last change
updated
FHIPSMTWRTOPN+3
ShadowWhisperer – Other Tunnel
by ShadowWhisperer
Filter list covering proxy. Format: IPs (IPv4). Maintained by ShadowWhisperer. See the project homepage for details and inclusion criteria.
- entries
±0 last change
updated
FHIPSMTWRTOPN+3
Ranges that produce almost nothing but spam sign-ups.
60 entries
±0 last change
updated
FHIPSMTWRTOPN+2
The official list of Tor exit nodes, maintained by the Tor Project.
1,341 entries
±0 last change
updated
FHIPSMTWRTOPN+2
Filter list covering proxy. Format: IPs (IPv4). See the project homepage for details and inclusion criteria.
8,054 entries
±0 last change
updated
FHIPSMTWRTOPN+3
Filter list covering proxy. Format: IPs (IPv4). See the project homepage for details and inclusion criteria.
1,746 entries
±0 last change
updated
FHIPSMTWRTOPN+3
Every Tor node, not only the exits.
9,721 entries
+0 -7 last change
updated
FHIPSMTWRTOPN+2