IP Block Lists

IP Block Lists allows CSF/LFD to periodically download lists of IP addresses and CIDRs from published block lists. It is controlled by the file /etc/csf/csf.blocklists. Uncomment the line starting with the rule name to use it, then restart CSF and then LFD.

• After making any changes to /etc/csf/csf.blocklists you must restart CSF and then LFD.
• If you want to re-download a blocklist you must first delete /var/lib/csf/csf.block.NAME and then restart CSF and then LFD.
• Each URL is scanned for an IPv4/CIDR address per line and if found is blocked.

Format

NAME|INTERVAL|MAX|URL
Parameter Description
NAME List name with all uppercase alphabetic characters with no spaces and a maximum of 25 characters - this will be used as the iptables chain name.
INTERVAL Refresh interval to download the list, must be a minimum of 3600. seconds (an hour), but 86400 (a day) should be more than enough.
MAX This is the maximum number of IP addresses to use from the list, a value of 0 means all IPs.
URL The URL to download the list from.

• Some of these lists are very long (thousands of IP addresses) and could cause serious network and/or performance issues, so setting a value for the MAX field should be considered.
• These lists are not under the control of Danami and could have false positives.

Blocklists

Name Category Maintainer Description
ALIENVAULT_REPUTATION reputation Alien Vault IP reputation database
BDE attacks Blocklist.de Blocklist.de attacking IP addresses (last hour)
BDEALL attacks Blocklist.de Blocklist.de attacking IP addresses (all)
BDS_ATIF reputation Binary Defense Systems Artillery Threat Intelligence Feed and Banlist Feed
BFB attacks Daniel Gerzo BruteForceBlocker IP List
BLOCKLIST_DE attacks Blocklist.de IPs that have been detected by fail2ban in the last 48 hours
BLOCKLIST_DE_APACHE attacks Blocklist.de All IP addresses which have been reported within the last 48 hours as having run attacks on the service Apache, Apache-DDOS, RFI-Attacks.
BLOCKLIST_DE_BOTS attacks Blocklist.de All IP addresses which have been reported within the last 48 hours as having run attacks on the RFI-Attacks, REG-Bots, IRC-Bots or BadBots (BadBots = he has posted a Spam-Comment on a open Forum or Wiki) .
BLOCKLIST_DE_BRUTEFORCE attacks Blocklist.de All IPs which attacks Joomlas, Wordpress and other Web-Logins with Brute-Force Logins.
BLOCKLIST_DE_FTP attacks Blocklist.de All IP addresses which have been reported within the last 48 hours for attacks on the Service FTP.
BLOCKLIST_DE_IMAP attacks Blocklist.de All IP addresses which have been reported within the last 48 hours for attacks on the Service imap, sasl, pop3, etc.
BLOCKLIST_DE_MAIL attacks Blocklist.de All IP addresses which have been reported within the last 48 hours as having run attacks on the service Mail, Postfix.
BLOCKLIST_DE_SIP attacks Blocklist.de All IP addresses that tried to login in a SIP, VOIP or Asterisk Server and are included in the IPs list from infiltrated.net
BLOCKLIST_DE_SSH attacks Blocklist.de All IP addresses which have been reported within the last 48 hours as having run attacks on the service SSH.
BLOCKLIST_DE_STRONGIPS attacks Blocklist.de All IPs which are older then 2 month and have more then 5.000 attacks.
BLOCKLIST_NET_UA abuse blocklist.net.ua The BlockList project was created to become protection against negative influence of the harmful and potentially dangerous events on the Internet. First of all this service will help internet and hosting providers to protect subscribers sites from being hacked. BlockList will help to stop receiving a large amount of spam from dubious SMTP relays or from attempts of brute force passwords to servers and network equipment.
BM_TOR anonymizers torstatus.blutmagie.de List of all TOR network servers
BOGON unroutable Team Cymru Private and reserved addresses defined by RFC 1918, RFC 5735, and RFC 6598 and netblocks that have not been allocated to a regional internet registry
BOTSCOUT abuse BotScout.com Helps prevent automated web scripts, known as bots, from registering on forums, polluting databases, spreading spam, and abusing forms on web sites. They do this by tracking the names, IPs, and email addresses that bots use and logging them as unique signatures for future reference. They also provide a simple yet powerful API that you can use to test forms when they're submitted on your site. This list is composed of the most recently-caught bots.
BRUTEFORCEBLOCKER attacks danger.rulez.sk (fail2ban alternative for SSH on OpenBSD) . This is an automatically generated list from users reporting failed authentication attempts. An IP seems to be included if 3 or more users report it. Its retention pocily seems 30 days.
CIARMY reputation Collective Intelligence Network Security IPs with poor Rogue Packet score that have not yet been identified as malicious by the community
CLEANMX_VIRUSES spam Clean-MX.de IPs with viruses
CRUZIT_WEB_ATTACKS attacks CruzIt.com IPs of compromised machines scanning for vulnerabilities and DDOS attacks
DARKLIST_DE attacks darklist.de Ssh fail2ban reporting
DSHIELD attacks DShield.org Top 20 attacking class C (/24) subnets over the last three days
ET_BLOCK attacks Emerging Threats Default blacklist (at the time of writing includes spamhaus DROP, dshield and abuse.ch trackers, which are available separately too - prefer to use the direct ipsets instead of this, they seem to lag a bit in updates)
ET_BOTCC reputation Emerging Threats These IPs are updates every 24 hours and should be considered VERY highly reliable indications that a host is communicating with a known and active Bot or Malware command and control server - (although they say this includes abuse.ch trackers, it does not - check its overlaps)
ET_COMPROMISED attacks Emerging Threats Compromised hosts
ET_DSHIELD attacks Emerging Threats Dshield blocklist
ET_SPAMHAUS attacks Emerging Threats Spamhaus blocklist
ET_TOR anonymizers Emerging Threats Of TOR network IPs
FEODO malware Abuse.ch Trojan includes IPs which are being used by Feodo (also known as Cridex or Bugat) which commits ebanking fraud
GREENSNOW attacks GreenSnow.co Is a team harvesting a large number of IPs from different computers located around the world. GreenSnow is comparable with SpamHaus.org for attacks of any kind except for spam. Their list is updated automatically and you can withdraw at any time your IP address if it has been listed. Attacks / bruteforce that are monitored are: Scan Port, FTP, POP3, mod_security, IMAP, SMTP, SSH, cPanel, etc.
HONEYPOT attacks Project Honeypot Project Honey Pot Directory of Dictionary Attacker IPs
LASHBACK_UBL spam The LashBack Unsubscribe Blacklist The Unsubscribe Blacklist (UBL) is a real-time blacklist of IP addresses which are sending email to names harvested from suppression files (this is a big list, more than 500.000 IPs)
MALC0DE malware malc0de.com Malicious IPs of the last 30 days
MAXMIND anonymizers Maxmind MaxMind GeoIP Anonymous Proxies
MYIP abuse MyIP.ms IPs identified as web bots in the last 10 days, using several sites that require human action
PHP_COMMENTERS spam ProjectHoneypot.org Comment spammers (this list is composed using an RSS feed)
PHP_DICTIONARY spam ProjectHoneypot.org Directory attackers (this list is composed using an RSS feed)
PHP_HARVESTERS spam ProjectHoneypot.org Harvesters (IPs that surf the internet looking for email addresses) (this list is composed using an RSS feed)
PHP_SPAMMERS spam ProjectHoneypot.org Spam servers (IPs used by spammers to send messages) (this list is composed using an RSS feed)
SBLAM abuse sblam.com IPs used by web form spammers, during the last month
SHUNLIST attacks AutoShun.org IPs identified as hostile by correlating logs from distributed snort installations running the autoshun plugin
SNORT_IPFILTER attacks Snort.org Labs Supplied IP blacklist (this list seems to be updated frequently, but we found no information about it)
SPAMDROP spam Spamhaus Do not Route Or Peer List (DROP)
SPAMEDROP spam Spamhaus Spamhaus Extended DROP List (EDROP)
STOPFORUMSPAM abuse StopForumSpam.com Banned IPs used by forum spammers
STOPFORUMSPAM_180D abuse StopForumSpam.com IPs used by forum spammers (last 180 days)
STOPFORUMSPAM_1D abuse StopForumSpam.com IPs used by forum spammers in the last 24 hours
STOPFORUMSPAM_30D abuse StopForumSpam.com IPs used by forum spammers (last 30 days)
STOPFORUMSPAM_365D abuse StopForumSpam.com IPs used by forum spammers (last 365 days)
STOPFORUMSPAM_7D abuse StopForumSpam.com IPs used by forum spammers (last 7 days)
STOPFORUMSPAM_90D abuse StopForumSpam.com IPs used by forum spammers (last 90 days)
STOPFORUMSPAM_TOXIC abuse StopForumSpam.com Networks that have large amounts of spambots and are flagged as toxic. Toxic IP ranges are infrequently changed.
TOR anonymizers Torproject TOR Exit Nodes List
TOR_EXITS anonymizers TorProject.org List of all current TOR exit points (TorDNSEL)
VOIPBL attacks VoIPBL.org A distributed VoIP blacklist that is aimed to protects against VoIP Fraud and minimizing abuse for network that have publicly accessible PBX's. Several algorithms, external sources and manual confirmation are used before they categorize something as an attack and determine the threat level.

References

A special thanks goes to the folks at iplists.firehol.org for all their hard work compiling the origional IP Feeds.

Related Files

File Description
/etc/csf/csf.conf LF_BOGON_SKIP URLGET configuration options
/etc/csf/csf.blocklists This file contains definitions to IP BLOCK lists.