Skip to content

Aggregated AbuseIPDB blocklists with worst IPv4 & IPv6 offenders (~100% confidence)

Notifications You must be signed in to change notification settings

borestad/blocklist-abuseipdb

Folders and files

NameName
Last commit message
Last commit date

Latest commit

c3f3a5e · Mar 16, 2025

History

1 Commit
Mar 16, 2025
Mar 16, 2025
Mar 16, 2025
Mar 16, 2025
Mar 16, 2025
Mar 16, 2025
Mar 16, 2025
Mar 16, 2025
Mar 16, 2025
Mar 16, 2025
Mar 16, 2025
Mar 16, 2025
Mar 16, 2025
Mar 16, 2025
Mar 16, 2025
Mar 16, 2025
Mar 16, 2025
Mar 16, 2025
Mar 16, 2025
Mar 16, 2025

Repository files navigation

blocklist-abuseipdb

GitHub Workflow Status GitHub repo size Visitors

Lists with worst IPv4 & IPv6 offenders (~100% confidence), provided by AbuseIPDB (with permission).

  • Lists are updated multiple times per day.
  • The repository is continously squashed to keep down size.

Extra Features

  • Statistics
  • Hall of Shame ip lists with aggressive /24 subnets - i.e 1 2 3
  • ASN Database from ipinfo.io is used to decorate all IPs with metadata
  • Selfhosted honeypot integration with verified abuse score (to get those pesky ~99% confidence offenders)

Disclaimer:

#1 This repository is using the "free forever" plan (5 fetches per day + 1000 ip lookups), but also aggregates the data from multiple publicly free & legal sources (also with free plan) to create a larger iplist.

#2 All credits goes to AbuseIPDB. Please support them. Seriously!

#3 Use ip-blocking with caution. Firewalls should preferably use rules on the incoming WAN side

#4 Recommended usage is the maximum 30 days or less to avoid false positives.

#5 Do not use the abuseipdb-s100-all.ipv4. It is only exposed for statistical usage.

#6 Regarding naming: s100 means ~100% confidence lists.

#7 IPv6 blocking is almost useless.

Public IPv6 addresses may implement the SLAAC privacy extension. With this, the interface identifier is randomly generated. The SLAAC privacy extension also implements a time out, which is configurable, so that the IPv6 interface addresses will be discarded and a new interface identifier is generated.

Source: AbuseIPDB

Last check: 2025-03-16 - 22:34:41 (UTC)

❯ abuseipdb-s100-1d (74326 ips)
❯ abuseipdb-s100-3d (82088 ips)
❯ abuseipdb-s100-7d (108312 ips)
❯ abuseipdb-s100-14d (148390 ips)
❯ abuseipdb-s100-30d (232990 ips)
❯ abuseipdb-s100-60d (319739 ips)
❯ abuseipdb-s100-90d (403026 ips)
❯ abuseipdb-s100-120d (436485 ips)
❯ abuseipdb-s100-180d (501868 ips)
❯ abuseipdb-s100-365d (649086 ips)
❯ abuseipdb-s100-all (1111592 ips)