Is an IP blacklist that uses multiple sensors to identify network attacks (e.g. SSH brute force) and spam incidents. All reports are evaluated and in case of too many incidents the responsible IP holder is informed to solve the problem.
P.S.: If you have some idle servers or can sponsor us a server, please mail us at [email protected]
đźš« ALL IPs:
https://ip.blackhole.monster/blackhole
đźš« TODAY IPs:
https://ip.blackhole.monster/blackhole-today
How to use?
To get a fresh and ready-to-deploy auto-ban list of “bad IPs” you can run:
sudo su
apt-get -qq install iptables ipset
ipset -q flush blackhole
ipset -q create blackhole hash:net
for ip in $(curl --compressed https://ip.blackhole.monster/blackhole-today 2>/dev/null | grep -v "#" | grep -v -E "\s[1-2]$" | cut -f 1); do ipset add blackhole $ip; done
iptables -D INPUT -m set --match-set blackhole src -j DROP 2>/dev/null
iptables -I INPUT -m set --match-set blackhole src -j DROP
I just have a question. Will it conflict with CSF or any WAF? How does it recognise abusing IP? and if we can put it over Virtualization host to protect a whole set of VMs?
what we provide is just 2 lists of IPs (All and today) and how you gonna use it is up to you (you can parse the IPs and reformat the list as you wish if you need to import it for example to some other software).
the first post is just a sample of ipset how to run it if you dont wanna spend more time.
we listening on various ports and let malicious IPs to login and play on our honeypots.
Edit CSF blocklist file:
nano /etc/csf/csf.blocklists
Navigate to the end of the file and append the following:
# IP.blackhole.monster blacklist
IPBLACKHOLE|3600|0|https://ip.blackhole.monster/blackhole-today
After you finish editing the file, save it and restart CSF and lfd using:
csf -ra
Check the log file to ensure that the blacklist was added correctly:
cat /var/log/lfd.log