This project provides aggregated IP blocklists for inbound and outbound traffic, updated every 2 hours. It includes exclusions for major public DNS resolvers to prevent legitimate services from being blocked.

These are standard text files and can be used with most modern firewalls, ad-blockers, and security tools.

• What it is: A list of IPs/networks with a bad reputation for initiating malicious connections. This includes sources of spam, scanning, brute-force attacks (SSH, RDP), and web exploits.
• Use Case: Protect your public-facing servers and services (web servers, mail servers, game servers, etc.).
• How to use: Apply this list to your firewall's WAN IN or INPUT chain to DROP or REJECT all incoming traffic from these sources.

• What it is: A list of known malicious destination IPs. This includes C2 (Command & Control) servers, botnet controllers, malware drop sites, and phishing hosts.
• Use Case: Prevent compromised devices on your internal network (like a laptop or IoT device) from contacting malicious servers.
• How to use: Apply this list to your firewall's LAN OUT or OUTPUT chain to BLOCK or LOG all outgoing traffic to these destinations.

The update.yml workflow takes a long time to complete. I run it on a self-hosted runner. If you fork this repo and want to use the same workflow, set up a self-hosted runner: Setup Self-hosted runners

🪨 borestad • foundational blocklists 🚀 Code contributions

• David
• Garrett Laman

❤️ Our sponsors • making this project possible

• mraxu
• Hareen
• Alexandru Balmus
• blockstreamtechnologies.llc

The source code (including update_tables.py) is licensed under the MIT License. See LICENSE for details.

The aggregated blocklists (inbound.txt, outbound.txt, etc.) are derivative works containing data from multiple sources.

Usage of these lists is subject to the licenses of the original data providers. Many sources (e.g., Spamhaus) prohibit commercial use of their data without a separate agreement.

Therefore, the aggregated data in this repository is provided under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0) license.

Attribution: This project relies on data from:

• borestad/blocklist-abuseipdb
• borestad/firehol-mirror
• duggytuxy/Data-Shield_IPv4_Blocklist
• stamparm/ipsum (via bitwire-it/ipsum-clean)
• ShadowWhisperer/IPs
• romainmarcoux/malicious-ip
• romainmarcoux/malicious-outgoing-ip
• elliotwutingfeng/ThreatFox-IOC-IPs
• CriticalPathSecurity/Public-Intelligence-Feeds
• T145/black-mirror
• drb-ra/C2IntelFeeds
• SecOps-Institute/Tor-IP-Addresses
• mitchellkrogza/nginx-ultimate-bad-bot-blocker
• hagezi/dns-blocklists
• malware-filter/malware-filter (botnet-filter)
• binarydefense.com
• bruteforceblocker.com
• darklist.de
• Emerging Threats
• Spamhaus DROP
• CINSscore / CINSArmy
• dataplane.org
• greensnow.co
• vxvault.net
• blackip.ustc.edu.cn
• sblam.com
• stopforumspam.com
• multiproxy.org
• myip.ms
• AlienVault OTX
• Rutgers DROP
• Checkpoint TOR list
• opendbl.net
• turris.cz