Your server is being probed right now. Not maybe — definitely. Every public-facing IP on the internet gets hit by automated scanners, brute-force bots, and malware C2 callbacks within minutes of going live. The attackers aren’t targeting you specifically — they’re running scripts that sweep the entire IPv4 space on a loop, and your server is just one more address on the list.
The good news? The security community has been cataloguing these bad actors for years, and much of that intelligence is free. There are hundreds of thousands of known-malicious IPs, domains, URLs, and file hashes being shared publicly every day by organizations like abuse.ch, Spamhaus, and government agencies. You can pull those lists and start blocking before an attack even reaches your application layer.
This guide is for self-hosters, homelab operators, and sysadmins who want real protection without a commercial threat intel subscription. You’ll get working scripts, the best free feeds for every use case, and a clear picture of what you’re actually getting — including the limitations.
Prerequisites: A Linux server (Debian/Ubuntu or RHEL/CentOS family), root or sudo access, basic comfort with bash scripting, and optionally a Pi-hole or AdGuard Home instance for DNS blocking.
What Are Threat Intelligence Feeds?
Quick Answer: Threat intel feeds are regularly updated lists of known-bad IPs, domains, URLs, and file hashes you can use to block malicious traffic automatically.
A threat intelligence feed is a continuously updated stream of indicators of compromise — IOCs in the jargon — that tell you something specific is known to be malicious. The data comes from honeypots, malware sandboxes, abuse reports, government monitoring programs, and community submissions. The feed publisher aggregates all of that, strips out the noise as best they can, and publishes it in a machine-readable format so you can automate blocking.
IOCs come in several flavors:
- IP addresses — Scanners, brute-force bots, malware C2 servers, spam senders
- Domains — Malware delivery sites, phishing infrastructure, botnet command-and-control domains
- URLs — Specific malware download paths, phishing pages, exploit kit landing pages
- File hashes (MD5, SHA1, SHA256) — Fingerprints of known malware samples
- CVE identifiers — Known exploited vulnerabilities being actively targeted in the wild
Perfect for:
- Home lab operators who want firewall blocking that actually means something
- Small businesses running their own mail, web, or VPN servers
- Sysadmins managing VPS or dedicated servers without a dedicated security team
- Anyone running Pi-hole or AdGuard Home who wants to add a threat layer on top of ad blocking
- Teams running Suricata, Snort, or a SIEM who want free ruleset updates
Heads up — honest caveats before you dive in:
- False positives are real. Some feeds are more aggressive than others. An IP flagged for SSH scanning six months ago might now belong to a legitimate CDN. Always start with conservative threshold settings and tune from there.
- Feed quality varies enormously. The abuse.ch feeds and HaGeZi lists are well-maintained and well-documented. Some GitHub-hosted lists haven’t been touched in two years. Know your source.
- Update lag matters. A feed updated every 12 hours isn’t going to catch a zero-day campaign in hour one. Threat intel is defense-in-depth, not a silver bullet.
- Volume has limits. If you try to load 10 million IPs into iptables rules individually, you’ll crater your server. Use ipset. We’ll cover that.
IP Blocklist Feeds
Quick Answer: IPsum (GitHub, daily), Blocklist.de (every 30 min), and Spamhaus ZEN (DNSBL, real-time) are the three go-to free IP blocklists for self-hosters — pick based on your use case.
IP blocklists are the bluntest instrument in the threat intel toolkit, and also the most immediately useful. Drop a known-bad IP into ipset, and everything from that address gets silently dropped at the kernel level before it even touches your application. No processing, no logging overhead, no wasted connections.
Feed | Update Frequency | Format | License | Approx Size | Best For |
|---|---|---|---|---|---|
Daily | Plain text (IP + count) | MIT | ~5k–30k IPs (level 3+) | General firewall blocking | |
Every 30 minutes | Plain text (one IP per line) | Free (non-commercial) | ~30k IPs (all.txt) | SSH/mail/web server protection | |
Every 5 minutes | DNSBL (DNS query) | Free (non-commercial) | N/A (query-based) | Mail server connection checks |
IPsum
IPsum is the duct tape of IP blocklists — crude, effective, and absolutely everywhere in self-hosted security setups. Miroslav Stampar pulls from 30+ public blacklists daily, aggregates them, and scores each IP by how many source lists it appears on. The higher the score, the more confident you can be that the IP is genuinely bad.
The main file at https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt contains all IPs with their occurrence counts as tab-separated values. The levels/ subdirectory gives you pre-filtered files — levels/3.txt contains only IPs that appear on 3 or more source lists, which is the sweet spot for low false positives. You can also grab levels/5.txt or higher if you want to be even more conservative.
Blocklist.de
Blocklist.de is a volunteer-run service that aggregates real attack reports from servers worldwide. When a server in their network gets hit by an SSH brute-force, a mail relay attempt, or a web exploit, that IP gets added to the appropriate list within 30 minutes. Unlike IPsum’s daily cadence, Blocklist.de refreshes constantly.
The service offers category-specific lists at https://lists.blocklist.de/lists/:
all.txt— everything (~30k IPs)ssh.txt— SSH brute-force attackersmail.txt— mail server attackers (largest list)apache.txt— web server exploit attemptsimap.txt— IMAP brute-forcebots.txt— malicious bots and IRC bots
If you’re running a mail server, mail.txt alone is worth pulling. If you want everything, use all.txt.
Spamhaus ZEN
Spamhaus ZEN is different from the other two — it’s a DNSBL (DNS-based blackhole list), not a flat file you download. Instead of grabbing a list and loading it into ipset, you query the Spamhaus DNS servers at connection time. Your MTA sends a reverse-lookup query to zen.spamhaus.org for each incoming connection, and Spamhaus returns a response code indicating whether the IP is listed and why.
This real-time model means you always get current data without any local storage or update scripts. The catch: Spamhaus’s free tier is for non-commercial use only, and if your query volume exceeds their limits, they’ll start returning errors. For commercial use, you need a Data Query Service subscription. If you’re running a busy mail server for a business, budget for it.
Malware, URL, and Phishing Feeds
Quick Answer: The abuse.ch suite (URLhaus, ThreatFox, Feodo Tracker) plus OpenPhish covers malware URLs, C2 infrastructure, and phishing pages — all free, all well-maintained.
Beyond raw IP blocking, you need feeds that cover the malware delivery chain: the URLs hosting malware droppers, the C2 infrastructure malware phones home to, and the phishing pages harvesting credentials. These feeds are more specialized than IP blocklists and require different integration approaches.
Feed | Update Frequency | Format | Auth Required | IOC Types | Suricata Rules? |
|---|---|---|---|---|---|
Every 5 minutes | CSV, JSON API | Optional (API key for submissions) | Malware download URLs | No | |
Real-time | JSON, CSV, MISP | Yes (free API key) | IPs, domains, URLs, hashes | Yes | |
Every 5 minutes | Plain text, CSV, JSON | No | Botnet C2 IPs | Yes | |
Every 12 hours (free) | Plain text | No | Phishing URLs | No |
The abuse.ch Suite
The abuse.ch crew maintains several feeds that are basically required reading for anyone serious about threat intel. They’re not separate independent projects — they’re a family of complementary services run by the same Swiss nonprofit, each targeting a different part of the malware ecosystem.
URLhaus focuses on active malware distribution sites. When a URL is confirmed to be serving malware, it goes in. The bulk CSV is available at https://urlhaus.abuse.ch/downloads/csv_online/ (currently active URLs only) and is regenerated every 5 minutes. The API at https://urlhaus-api.abuse.ch/v1/ lets you query individual URLs or pull recent submissions.
ThreatFox is the broadest of the three — it covers IPs, domains, URLs, and file hashes associated with specific malware families. You need a free API key from auth.abuse.ch, and then you can query recent IOCs via POST requests to https://threatfox-api.abuse.ch/api/v1/ with a JSON payload. ThreatFox also publishes Suricata rules for network-level detection.
Feodo Tracker is the most focused: it tracks active botnet C2 servers for specific malware families (Dridex, QakBot, BazarLoader, and others). The plain-text IP list at https://feodotracker.abuse.ch/downloads/ipblocklist.txt requires no auth and contains only currently active C2 IPs. The Suricata rulesets at https://feodotracker.abuse.ch/downloads/feodotracker.rules are regenerated every 5 minutes — one of the fastest-updating free rulesets available.
OpenPhish
OpenPhish‘s free community feed at https://openphish.com/feed.txt is a plain-text list of active phishing URLs updated every 12 hours. It’s narrowly focused — you won’t use this for firewall blocking, but it’s useful for web proxies, mail filters, and SIEM enrichment. The premium tier updates every 5 minutes with additional metadata (targeted brand, country, industry), but for homelab use the free feed covers the basics.
DNS Blocklist Feeds
Quick Answer: HaGeZi’s tiered DNS blocklists are the best free DNS-level threat protection available — start with Normal/Pro and upgrade tiers as needed based on false positive tolerance.
DNS blocking is arguably the most efficient security control you can run. Block a malicious domain at the resolver level and nothing on your network can reach it — no matter what application, device, or protocol tries. Pi-hole and AdGuard Home make this dead simple, and HaGeZi’s DNS blocklists are the gold standard for free, well-maintained, actively curated DNS threat feeds.
HaGeZi publishes a tiered system where each level adds more blocked domains with a corresponding increase in false positive risk. The lists are updated daily and published in multiple formats (Adblock, Pi-hole, hosts, dnsmasq, Unbound, and more).
Tier | Blocked Domains (approx) | False Positive Risk | Best For |
|---|---|---|---|
Light | ~100k | Very low | Shared networks, production servers, cautious users |
Normal | ~700k | Low | Most home/homelab setups — the sensible default |
Pro | ~1.2M | Low-medium | Homelabs wanting broader coverage, recommended by HaGeZi |
Pro++ | ~1.7M | Medium | Security-focused setups willing to tune exceptions |
Ultimate | ~2.5M+ | Medium-high | Aggressive blocking; expect to maintain a whitelist |
TIF (Threat Intelligence Feeds) | ~5M+ | Low (security-focused) | Specifically malware, phishing, and C2 domains — stack with any tier |
The Pi-hole and AdGuard Home import URLs for each tier (adblock format):
- Light:
https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/light.txt - Normal:
https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/multi.txt - Pro:
https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/pro.txt - Pro++:
https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/pro.plus.txt - Ultimate:
https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/ultimate.txt - TIF:
https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/tif.txt
The TIF list deserves special attention. It’s not a general ad/tracker blocker — it’s specifically focused on threat intelligence: malware domains, phishing infrastructure, botnet C2 domains, and active exploit hosts. You can run TIF alongside any other HaGeZi tier and it won’t conflict. If you’re only adding one security-focused DNS list, make it TIF.
AdGuard Home users can add all of the same URLs through Settings > Filters > DNS blocklists. The adblock format works natively in both Pi-hole v5+ and AdGuard Home.
OSINT and Community Feeds
Quick Answer: AlienVault OTX (19M+ indicators/day, free API), GreyNoise Community (noise classification, 50 lookups/week free), and Shadowserver (daily scans, org application required) round out the free community intelligence landscape.
Beyond the purpose-built blocklists, a layer of OSINT and community intelligence helps you understand what you’re dealing with — context that raw IP lists don’t provide.
AlienVault OTX
AlienVault OTX (now operated by LevelBlue) is one of the largest open threat intelligence communities in existence, with over 19 million threat indicators generated daily by researchers worldwide. Free registration gets you an API key and access to the full indicator database.
OTX organizes intelligence into “pulses” — curated collections of related IOCs around a specific threat campaign or malware family. You can subscribe to pulses from specific researchers, pull indicators by tag or malware family, or query the reputation of specific IPs, domains, and file hashes against the entire OTX corpus.
The API base URL is https://otx.alienvault.com/api/v1/ with authentication via the X-OTX-API-Key header. The OTXv2 Python SDK (pip install OTXv2) makes bulk operations much cleaner than raw curl — you’ll see both approaches in the scripts section.
GreyNoise Community
GreyNoise works differently from every other feed here. Rather than cataloguing “known-bad” IPs, GreyNoise catalogues “background noise” — all the automated scanning and opportunistic probing that hits the entire internet constantly. Their sensor network observes this traffic and classifies IPs as noise (mass scanners, benign researchers), malicious (targeted attack tools), or unknown.
The Community API at https://api.greynoise.io/v3/community/{ip} is free with no authentication required (up to about 10 lookups/day unauthenticated, or 50 searches/week with a free account). It tells you whether an IP is “noise” (background scanning that’s hitting everyone, not just you) versus “malicious” (targeted activity). This context is gold for alert triage — if your SIEM is firing on an IP that GreyNoise classifies as mass-scanning noise, that’s a different response priority than a targeted attack IP.
Shadowserver
Shadowserver scans the entire public IPv4 space 42 times per day across hundreds of ports and services. They’re the world’s largest provider of free daily network threat intelligence — sending custom remediation reports to over 9,000 vetted subscribers across 173 countries.
The catch: Shadowserver is not self-serve. You have to apply for access and demonstrate you’re a legitimate network defender organization — a CSIRT, ISP, government body, or similar. If you qualify (and many self-hosted business operators do), the daily CSV feeds covering vulnerable systems, malware infections, and active exploit activity on your IP ranges are genuinely exceptional. If you’re just running a personal homelab, you probably won’t qualify — look at the other feeds.
Government and Enterprise Feeds
Quick Answer: CISA AIS is free STIX 2.1/TAXII 2.1 threat intel from the US government, but requires a formal participation agreement and PKI certificate — it’s serious infrastructure, not a weekend project.
Government threat intelligence feeds exist and some of them are genuinely excellent. The main one worth knowing about is CISA AIS.
CISA Automated Indicator Sharing (AIS)
CISA AIS is the US Cybersecurity and Infrastructure Security Agency’s real-time indicator sharing program. It publishes IOCs in STIX 2.1 format over a TAXII 2.1 server — the two dominant open standards for structured threat intelligence exchange.
Quick translation: STIX (Structured Threat Information Expression) is a JSON-based data format that describes threat actors, campaigns, malware, attack patterns, and indicators in a standardized schema. TAXII (Trusted Automated Exchange of Intelligence Information) is the transport protocol — think of it as the API layer for requesting and receiving STIX bundles. Together they’re the plumbing of enterprise threat intelligence. They sound like members of a 70s prog rock band, but they’re actually the reason different threat intel platforms can talk to each other.
To participate in AIS, you need to:
- Contact CISA and agree to their Terms of Use (non-federal) or MISA (federal)
- Acquire a STIX/TAXII-capable client (several open source options exist)
- Get a PKI certificate from a Federal Bridge Certificate Authority
- Sign an Interconnection Agreement and provide your IP to CISA
This is real paperwork and real infrastructure overhead. For a Fortune 500 company or government agency, it’s absolutely worth it. For a homelab operator or small business — honestly? It’s overkill. Your time is better spent getting IPsum and HaGeZi TIF running properly. Mention it to your boss if you’re a sysadmin at a mid-size company that might actually qualify.
Feed Aggregators and Directories
Quick Answer: MISP is the open-source platform for aggregating and sharing threat intel; threatfeeds.io and Bert-JanP’s GitHub list are the best directories for discovering new feeds.
Once you’re pulling more than a couple of feeds, you’ll want infrastructure to manage them. And before you can manage them, you need to find them.
MISP
MISP (Malware Information Sharing Platform) is the open-source backbone of professional threat intelligence operations. It’s a full platform for ingesting, enriching, correlating, and sharing IOCs across organizations. MISP connects to dozens of feed sources automatically, normalizes data to a common format, and lets you push indicators directly to firewalls, SIEMs, and endpoint tools via its API.
It’s Docker-deployable and genuinely powerful — but it’s also a significant operational commitment. If you’re at the point where you need to manage multiple feeds, correlate indicators, and share intel with other orgs, MISP is the right tool. If you just want to block bad IPs on a VPS, it’s like buying a commercial dishwasher for a studio apartment.
Feed Directories
- threatfeeds.io — A searchable directory of public threat intelligence feeds. Filter by type (IP, domain, URL, hash), format, and update frequency. Good starting point when you’re looking for a feed that covers a specific use case.
- threat-intel.xyz — Community-maintained list of free threat intel sources with direct links and format documentation.
- github.com/Bert-JanP/Open-Source-Threat-Intel-Feeds — The most comprehensive curated list available, with 145+ feeds organized by IOC type (IP, DNS, URL, MD5, SHA256, CVE, and more). Includes KQL hunting queries for Microsoft Sentinel integration. Actively maintained and arguably the best single reference for discovering free feeds.
Consuming Feeds with iptables and ipset
Quick Answer: Use ipset with atomic set swapping to load threat intel IP lists into your firewall — it’s kernel-fast and updates without any connection interruption.
Raw iptables rules don’t scale to tens of thousands of IPs. Adding 30,000 individual DROP rules means every packet gets checked against 30,000 entries sequentially — that’ll impact performance on anything but the beefiest hardware. ipset solves this by storing IPs in a kernel-level hash table. Lookup is O(1) regardless of list size. You can comfortably block 500,000+ IPs with minimal overhead.
The atomic swap pattern is the key technique. Instead of modifying a live ipset in place (which creates a window where either old or partial-new rules are active), you build the new set under a temporary name, then swap it with the active set in a single atomic kernel operation. Zero downtime, zero gaps. Here’s how it works in practice:
Script 1: IPsum ipset atomic swap block script
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 |
#!/bin/bash # ipsum-block.sh — Download IPsum level 3+ feed and load into ipset with atomic swap # Usage: sudo bash ipsum-block.sh # Recommended: run daily via cron (see Script 3) set -euo pipefail IPSET_NAME="ipsum_blocklist" IPSET_TMP="${IPSET_NAME}_tmp" IPSUM_URL="https://raw.githubusercontent.com/stamparm/ipsum/master/levels/3.txt" IPSUM_FILE="/tmp/ipsum_level3.txt" IPTABLES_CHAIN="INPUT" LOG_FILE="/var/log/ipsum-block.log" log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE" } log "Starting IPsum blocklist update" # Download the level 3+ feed (IPs appearing on 3+ source lists) if ! curl -sSf --max-time 60 "$IPSUM_URL" -o "$IPSUM_FILE"; then log "ERROR: Failed to download IPsum feed" exit 1 fi IP_COUNT=$(wc -l < "$IPSUM_FILE") log "Downloaded ${IP_COUNT} IPs from IPsum level 3" # Create the temporary ipset ipset create "$IPSET_TMP" hash:ip hashsize 65536 maxelem 1000000 -exist # Flush the temp set in case it existed from a failed previous run ipset flush "$IPSET_TMP" # Load IPs into the temporary set (file contains one IP per line, no comments) while IFS= read -r ip; do [[ "$ip" =~ ^#.*$ ]] && continue # skip comment lines [[ -z "$ip" ]] && continue # skip blank lines ipset add "$IPSET_TMP" "$ip" -exist 2>/dev/null || true done < "$IPSUM_FILE" LOADED=$(ipset list "$IPSET_TMP" | grep -c "^[0-9]" || true) log "Loaded ${LOADED} IPs into temporary set" # If the live set doesn't exist yet, create it and add the iptables rule if ! ipset list "$IPSET_NAME" &>/dev/null; then ipset create "$IPSET_NAME" hash:ip hashsize 65536 maxelem 1000000 iptables -I "$IPTABLES_CHAIN" -m set --match-set "$IPSET_NAME" src -j DROP log "Created new ipset and added iptables DROP rule" fi # Atomic swap: replace live set with new set in a single kernel operation ipset swap "$IPSET_TMP" "$IPSET_NAME" ipset destroy "$IPSET_TMP" log "Atomic swap complete. IPsum blocklist is now active with ${LOADED} entries." rm -f "$IPSUM_FILE" |
Script 2: ipset persistence via systemd (survive reboots)
ipset rules live in kernel memory and don’t survive reboots by default. Save them to disk and restore on boot with a systemd service:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 |
#!/bin/bash # ipset-save.sh — Save current ipsets to disk for persistence across reboots # Place this script in /usr/local/bin/ipset-save.sh and make it executable IPSET_SAVE_FILE="/etc/ipset.conf" # Save all current ipset rules ipset save > "$IPSET_SAVE_FILE" echo "ipset rules saved to $IPSET_SAVE_FILE ($(wc -l < "$IPSET_SAVE_FILE") lines)" # --- systemd service unit --- # Save the following to /etc/systemd/system/ipset-restore.service # then run: systemctl enable ipset-restore.service # # [Unit] # Description=Restore ipset blocklists on boot # Before=network.target # Before=iptables.service # Before=nftables.service # # [Service] # Type=oneshot # ExecStart=/sbin/ipset restore -f /etc/ipset.conf # RemainAfterExit=yes # # [Install] # WantedBy=multi-user.target # # --- Enable and verify --- # sudo systemctl daemon-reload # sudo systemctl enable ipset-restore.service # sudo systemctl start ipset-restore.service # sudo systemctl status ipset-restore.service |
Script 3: Crontab entry for daily automation
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
#!/bin/bash # Add to root's crontab with: sudo crontab -e # This runs the IPsum update daily at 3:17 AM and saves ipsets at 3:30 AM # Using a non-round time avoids thundering-herd on feed servers at midnight/6AM # m h dom mon dow command 17 3 * * * /usr/local/bin/ipsum-block.sh >> /var/log/ipsum-block.log 2>&1 30 3 * * * /usr/local/bin/ipset-save.sh >> /var/log/ipset-save.log 2>&1 # Also add Blocklist.de all.txt — runs every 6 hours 0 */6 * * * curl -sSf https://lists.blocklist.de/lists/all.txt | \ awk '!/^#/' | \ while read ip; do ipset add ipsum_blocklist "$ip" -exist 2>/dev/null; done \ >> /var/log/blocklist-de.log 2>&1 |
Feodo Tracker C2 Blocking
Quick Answer: Feodo Tracker’s C2 IP list targets active botnet infrastructure specifically — run it as a separate ipset alongside your general blocklist for targeted malware C2 blocking.
Feodo Tracker is worth running as its own separate ipset rather than merging it into your general IPsum list. The distinction matters: IPsum casts a wide net, while Feodo Tracker is surgical — every IP in that list is a currently active command-and-control server for specific named malware families. If any host on your network connects to one of those IPs, that’s a high-confidence malware infection alert, not a false positive.
Script 4: Feodo Tracker C2 ipset block script
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 |
#!/bin/bash # feodo-block.sh — Load Feodo Tracker C2 IPs into a dedicated ipset # Run every 15-30 minutes for best coverage (feed updates every 5 minutes) # Usage: sudo bash feodo-block.sh set -euo pipefail IPSET_NAME="feodo_c2" IPSET_TMP="${IPSET_NAME}_tmp" FEODO_URL="https://feodotracker.abuse.ch/downloads/ipblocklist.txt" FEODO_FILE="/tmp/feodo_ipblocklist.txt" LOG_FILE="/var/log/feodo-block.log" log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE" } log "Fetching Feodo Tracker C2 blocklist" if ! curl -sSf --max-time 30 "$FEODO_URL" -o "$FEODO_FILE"; then log "ERROR: Failed to download Feodo Tracker feed" exit 1 fi # Create temp ipset ipset create "$IPSET_TMP" hash:ip hashsize 4096 maxelem 100000 -exist ipset flush "$IPSET_TMP" # Parse IPs — Feodo plain text has comment lines starting with # loaded=0 while IFS= read -r line; do [[ "$line" =~ ^#.*$ ]] && continue [[ -z "$line" ]] && continue # Feodo blocklist.txt contains IP:port entries — extract just the IP ip="${line%%:*}" if [[ "$ip" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then ipset add "$IPSET_TMP" "$ip" -exist 2>/dev/null && ((loaded++)) || true fi done < "$FEODO_FILE" log "Loaded ${loaded} C2 IPs into temporary set" # Create live set and iptables rule if they don't exist if ! ipset list "$IPSET_NAME" &>/dev/null; then ipset create "$IPSET_NAME" hash:ip hashsize 4096 maxelem 100000 # Block both incoming connections FROM C2 IPs and outgoing connections TO C2 IPs iptables -I INPUT -m set --match-set "$IPSET_NAME" src -j DROP iptables -I OUTPUT -m set --match-set "$IPSET_NAME" dst -j DROP log "Created feodo_c2 ipset and added iptables rules (INPUT + OUTPUT)" fi # Atomic swap ipset swap "$IPSET_TMP" "$IPSET_NAME" ipset destroy "$IPSET_TMP" log "Feodo C2 blocklist updated. Active entries: ${loaded}" rm -f "$FEODO_FILE" # Add to crontab (every 30 minutes): # */30 * * * * /usr/local/bin/feodo-block.sh >> /var/log/feodo-block.log 2>&1 |
Note the OUTPUT chain rule — that’s intentional. Blocking outbound connections to Feodo C2 IPs means that even if a host on your network gets infected, it can’t phone home to receive instructions. This is especially useful if you’re running the script on a gateway or router that sees traffic from multiple hosts.
DNS Blocking with Pi-hole and AdGuard Home
Quick Answer: Pi-hole CLI lets you add blocklist URLs and trigger gravity rebuilds from bash scripts; AdGuard Home uses a web UI that takes 60 seconds to configure with any HaGeZi URL.
DNS blocking is where the homelab crowd really shines. If you’ve already got Pi-hole or AdGuard Home running, you’re two commands away from blocking millions of malware and phishing domains.
Script 5: Pi-hole CLI feed import and gravity update
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 |
#!/bin/bash # pihole-threat-feeds.sh — Add HaGeZi threat intelligence feeds to Pi-hole # and rebuild gravity database # Usage: sudo bash pihole-threat-feeds.sh # Requires Pi-hole v5+ (uses SQLite gravity database) set -euo pipefail PIHOLE_DB="/etc/pihole/gravity.db" LOG_FILE="/var/log/pihole-threat-feeds.log" log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE" } # Threat intelligence feed URLs to add declare -A FEEDS=( ["HaGeZi Pro"]="https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/pro.txt" ["HaGeZi TIF"]="https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/tif.txt" ["HaGeZi Light"]="https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/light.txt" ) # Check Pi-hole is installed if ! command -v pihole &>/dev/null; then log "ERROR: pihole command not found. Is Pi-hole installed?" exit 1 fi log "Adding threat intelligence blocklists to Pi-hole" # Add each feed to the gravity database via SQLite # Pi-hole v5+ stores adlists in the gravity.db SQLite database for name in "${!FEEDS[@]}"; do url="${FEEDS[$name]}" log "Adding: $name -> $url" # Insert into adlist table (ignore if already exists) sqlite3 "$PIHOLE_DB" \ "INSERT OR IGNORE INTO adlist (address, enabled, comment) VALUES ('$url', 1, '$name - Added by threat-feeds script');" \ && log " Added successfully" \ || log " WARNING: Failed to add (may already exist)" done # Rebuild gravity database with new lists log "Running pihole -g to rebuild gravity database (this may take a few minutes)..." pihole -g >> "$LOG_FILE" 2>&1 log "Pi-hole gravity rebuild complete." log "Run 'pihole -q DOMAIN' to test blocking of specific domains." # To verify blocklist was loaded: # pihole -q -adlist hagezi # sqlite3 /etc/pihole/gravity.db "SELECT address, enabled FROM adlist WHERE address LIKE '%hagezi%';" |
Adding feeds in AdGuard Home (no script needed):
- Open AdGuard Home at
http://YOUR-ADGUARD-IP:3000 - Navigate to Filters > DNS blocklists
- Click Add blocklist > Add a custom list
- Give it a name (e.g., “HaGeZi TIF”) and paste the URL from the tier table above
- Click Save — AdGuard Home downloads and applies the list immediately
- Repeat for any additional tiers
AdGuard Home shows blocked query counts per list in real time, which makes it easy to see how much each feed is actually doing. The TIF list in particular tends to rack up a surprising number of blocks if you’ve got IoT devices or game consoles on the network pinging home.
Querying AlienVault OTX API
Quick Answer: OTX’s API at otx.alienvault.com/api/v1/ gives you per-IP reputation lookups via curl and bulk pulse/indicator pulls via the OTXv2 Python SDK — both free with a registered API key.
OTX is most useful when you need context, not just block/allow decisions. Before you decide how to respond to an IP in your logs, you can check whether that IP is associated with known threat campaigns, what malware families have been seen using it, and how recently it was observed doing bad things.
Script 6: OTX API curl single-IP reputation check
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 |
#!/bin/bash # otx-ip-check.sh — Query AlienVault OTX API for IPv4 reputation # Usage: bash otx-ip-check.sh 1.2.3.4 # Requires: curl, jq # Get your free OTX API key at: https://otx.alienvault.com/ OTX_API_KEY="${OTX_API_KEY:-YOUR_OTX_API_KEY_HERE}" OTX_BASE_URL="https://otx.alienvault.com/api/v1" if [[ -z "$1" ]]; then echo "Usage: $0 <ip_address>" echo "Set OTX_API_KEY env var or edit the script to add your key" exit 1 fi IP="$1" # Validate basic IP format if ! [[ "$IP" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then echo "ERROR: '$IP' does not look like a valid IPv4 address" exit 1 fi echo "Querying OTX for IP: $IP" echo "---" # Query the general endpoint for pulse count and basic reputation RESPONSE=$(curl -sSf \ -H "X-OTX-API-Key: $OTX_API_KEY" \ "${OTX_BASE_URL}/indicators/IPv4/${IP}/general") if [[ $? -ne 0 ]]; then echo "ERROR: API request failed. Check your API key and network connection." exit 1 fi # Parse response with jq PULSE_COUNT=$(echo "$RESPONSE" | jq -r '.pulse_info.count // 0') COUNTRY=$(echo "$RESPONSE" | jq -r '.country_name // "Unknown"') ASN=$(echo "$RESPONSE" | jq -r '.asn // "Unknown"') REPUTATION=$(echo "$RESPONSE" | jq -r '.reputation // 0') echo "IP Address: $IP" echo "Country: $COUNTRY" echo "ASN: $ASN" echo "OTX Pulses: $PULSE_COUNT (number of threat intel reports mentioning this IP)" echo "Reputation: $REPUTATION (negative = malicious activity)" echo "" if [[ "$PULSE_COUNT" -gt 0 ]]; then echo "WARNING: This IP appears in ${PULSE_COUNT} OTX pulse(s). Likely malicious." # Show the names of the first 3 pulses echo "Recent pulses:" echo "$RESPONSE" | jq -r '.pulse_info.pulses[:3][].name' | sed 's/^/ - /' else echo "INFO: No OTX pulses found for this IP. Not in community threat reports." fi</ip_address> |
Script 7: OTX SDK bulk pulse pull and IPv4 extraction
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 |
#!/usr/bin/env python3 """ otx-bulk-pull.py — Pull subscribed OTX pulses and extract unique IPv4 IOCs Outputs a flat IP list suitable for loading into ipset or a SIEM Requirements: pip install OTXv2 Usage: OTX_API_KEY=your_key python3 otx-bulk-pull.py > otx_ips.txt """ import os import sys from datetime import datetime, timedelta try: from OTXv2 import OTXv2, IndicatorTypes except ImportError: print("ERROR: OTXv2 not installed. Run: pip install OTXv2", file=sys.stderr) sys.exit(1) # Configuration API_KEY = os.environ.get("OTX_API_KEY", "YOUR_OTX_API_KEY_HERE") OTX_SERVER = "https://otx.alienvault.com" # Only pull pulses modified in the last N days to keep the list manageable LOOKBACK_DAYS = 7 def main(): if API_KEY == "YOUR_OTX_API_KEY_HERE": print("ERROR: Set OTX_API_KEY environment variable", file=sys.stderr) sys.exit(1) print(f"# OTX IPv4 IOCs extracted {datetime.utcnow().isoformat()}Z", file=sys.stderr) print(f"# Pulling pulses from last {LOOKBACK_DAYS} days", file=sys.stderr) otx = OTXv2(API_KEY, server=OTX_SERVER) # Get all subscribed pulses modified since lookback window since = (datetime.utcnow() - timedelta(days=LOOKBACK_DAYS)).strftime("%Y-%m-%dT%H:%M:%S") try: pulses = otx.getsince(since) except Exception as e: print(f"ERROR: Failed to fetch pulses: {e}", file=sys.stderr) sys.exit(1) unique_ips = set() pulse_count = 0 for pulse in pulses: pulse_count += 1 indicators = pulse.get("indicators", []) for indicator in indicators: if indicator.get("type") == "IPv4": ip = indicator.get("indicator", "").strip() # Basic validation — skip CIDR notation for plain ipset if ip and "/" not in ip: unique_ips.add(ip) print(f"# Processed {pulse_count} pulses, found {len(unique_ips)} unique IPv4 IOCs", file=sys.stderr) # Output one IP per line (stdout) — pipe to file or ipset for ip in sorted(unique_ips): print(ip) if __name__ == "__main__": main() # Usage examples: # python3 otx-bulk-pull.py > /tmp/otx_ips.txt # Then load into ipset: # while read ip; do ipset add ipsum_blocklist "$ip" -exist 2>/dev/null; done < /tmp/otx_ips.txt |
SIEM and IDS/IPS Integration
Quick Answer: Feed Feodo Tracker and ThreatFox Suricata rules into Suricata with a single script; use python-stix2 and taxii2-client for STIX/TAXII feeds; Elastic and Splunk have native abuse.ch integrations.
If you’re running an IDS/IPS like Suricata or Snort, threat intelligence feeds become even more powerful — instead of just blocking known-bad IPs, you’re detecting malicious patterns in traffic content, catching C2 callbacks by network signature, and alerting on exploit attempts in real time.
Script 8: Suricata rules download and reload
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 |
#!/bin/bash # suricata-threat-rules.sh — Download ThreatFox + Feodo Tracker Suricata rules # and reload Suricata's ruleset without restart # Usage: sudo bash suricata-threat-rules.sh # Run every 15-30 minutes for best C2 detection coverage set -euo pipefail RULES_DIR="/etc/suricata/rules" SURICATA_SOCKET="/var/run/suricata/suricata-command.socket" LOG_FILE="/var/log/suricata-threat-rules.log" # Rule source URLs FEODO_RULES_URL="https://feodotracker.abuse.ch/downloads/feodotracker.rules" FEODO_AGGRESSIVE_URL="https://feodotracker.abuse.ch/downloads/feodotracker_aggressive.rules" # ThreatFox Suricata rules require a free API key from auth.abuse.ch # Replace with your actual ThreatFox export URL after registering THREATFOX_RULES_URL="https://threatfox.abuse.ch/export/suricata/ipport/full/" log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE" } # Ensure rules directory exists mkdir -p "$RULES_DIR" log "Downloading Feodo Tracker standard C2 ruleset" if curl -sSf --max-time 30 "$FEODO_RULES_URL" \ -o "${RULES_DIR}/feodotracker.rules"; then RULE_COUNT=$(grep -c "^alert\|^drop" "${RULES_DIR}/feodotracker.rules" 2>/dev/null || echo "0") log "Feodo Tracker rules: ${RULE_COUNT} rules loaded" else log "WARNING: Failed to download Feodo Tracker rules" fi log "Downloading Feodo Tracker aggressive ruleset" if curl -sSf --max-time 30 "$FEODO_AGGRESSIVE_URL" \ -o "${RULES_DIR}/feodotracker_aggressive.rules"; then RULE_COUNT=$(grep -c "^alert\|^drop" "${RULES_DIR}/feodotracker_aggressive.rules" 2>/dev/null || echo "0") log "Feodo Tracker aggressive rules: ${RULE_COUNT} rules loaded" else log "WARNING: Failed to download Feodo Tracker aggressive rules" fi # Reload Suricata rules without full restart (requires suricatasc) if command -v suricatasc &>/dev/null && [[ -S "$SURICATA_SOCKET" ]]; then log "Reloading Suricata rules via suricatasc" suricatasc -c reload-rules log "Suricata rules reloaded successfully" elif command -v suricatasc &>/dev/null; then log "WARNING: Suricata socket not found at $SURICATA_SOCKET" log "If Suricata is running, check socket path in /etc/suricata/suricata.yaml" log "Falling back to SIGHUP reload" pkill -HUP suricata && log "Sent SIGHUP to Suricata" || log "WARNING: Could not signal Suricata" else log "WARNING: suricatasc not found. Rules downloaded but not reloaded." log "Install suricatasc or reload Suricata manually: sudo systemctl restart suricata" fi log "Rule update complete" # Ensure these rule files are listed in /etc/suricata/suricata.yaml under rule-files: # - /etc/suricata/rules/feodotracker.rules # - /etc/suricata/rules/feodotracker_aggressive.rules # Add to crontab: */30 * * * * /usr/local/bin/suricata-threat-rules.sh |
STIX/TAXII Tooling
If you’re integrating with STIX/TAXII sources (including CISA AIS if you qualify), the Python ecosystem has you covered:
- python-stix2 — The OASIS-maintained Python library for creating, parsing, and manipulating STIX 2.x objects.
pip install stix2. - taxii2-client — Python TAXII 2.x client for querying TAXII servers.
pip install taxii2-client. Pair this with python-stix2 to pull indicators from any TAXII 2.1 server.
SIEM Integration
Elastic Security has a native abuse.ch integration that ingests URLhaus, ThreatFox, and Feodo Tracker data directly into your Elasticsearch cluster — no custom scripts needed. Splunk has the Threat Intelligence Framework add-on which supports STIX/TAXII sources and several abuse.ch feeds via the Splunkbase marketplace. If you’re already running either platform, check their respective app stores before writing your own ingestion code.
Choosing the Right Feed for Your Setup
Quick Answer: Match the feed to your enforcement point — IP blocklists for firewalls, DNS lists for resolvers, Suricata rules for IDS, and OTX API for SIEM enrichment.
Use Case | Recommended Feed | Format | Update Freq | Complexity | Notes |
|---|---|---|---|---|---|
iptables/nftables blocking | IPsum (level 3+) + Blocklist.de | Plain text IP | Daily / 30 min | Low | Use ipset for performance; atomic swap for zero-downtime updates |
Pi-hole / AdGuard Home | HaGeZi Pro + HaGeZi TIF | Adblock | Daily | Very low | TIF is the security-focused tier; Pro covers ads + threats together |
pfSense / OPNsense | IPsum + Feodo Tracker | Plain text IP | Daily / 5 min | Low | Both platforms have built-in alias/blocklist update schedulers |
Suricata / Snort IDS | Feodo Tracker rules + ThreatFox rules | Suricata rules | 5 min / real-time | Medium | Use suricatasc reload-rules for live updates; no restart required |
SIEM ingestion / enrichment | AlienVault OTX + ThreatFox API | JSON API | Real-time | Medium-high | OTX for context/enrichment; ThreatFox for structured IOC ingestion |
Web server (nginx/Apache) | IPsum level 5+ for precision | Plain text IP | Daily | Low-medium | Higher threshold reduces false positives for legitimate user traffic |
Mail server (Postfix/Exim) | Spamhaus ZEN (DNSBL) + Blocklist.de mail.txt | DNSBL + plain text | 5 min / 30 min | Low | ZEN for connection-time checks; blocklist.de for ipset-level blocking |
FAQ
What’s the difference between a threat intelligence feed and a simple IP blocklist?
An IP blocklist is a flat list of addresses to block — no context, no metadata. A threat intelligence feed includes structured information about why an IP or domain is bad: which malware family uses it, which campaigns have been seen, confidence scores, timestamps, and sometimes MITRE ATT&CK mapping. Feeds like ThreatFox give you IOC context; blocklists like IPsum give you raw blocking data. Both are useful; they serve different purposes.
How often should I update threat intelligence feeds?
It depends on the feed. Feodo Tracker and ThreatFox update every 5 minutes — you should pull those at least every 30 minutes for meaningful protection. IPsum updates daily, so once a day is fine. Blocklist.de refreshes every 30 minutes, so pulling every 1-2 hours is reasonable. DNS blocklists like HaGeZi update daily and Pi-hole handles scheduling automatically after the initial setup.
Will adding these IP blocklists break legitimate traffic?
It’s possible, especially with aggressive feeds or low threshold settings. Start with IPsum level 3+ and Blocklist.de for general blocking — both have relatively low false positive rates for their intended use cases. Monitor your logs for blocked connections you didn’t expect. If you start getting complaints about legitimate services being blocked, check the offending IPs against the feed source to understand why they were listed, then whitelist as needed.
Do I need to pay for Spamhaus feeds?
For personal, non-commercial use below their query thresholds, Spamhaus DNSBL is free. If you’re running a commercial mail server, processing mail for paying customers, or if your query volume exceeds the free tier limits, you need a Data Query Service subscription. For flat-file blocklists (BGPf, EDROP, etc.), Spamhaus has a separate commercial licensing model. Check the Spamhaus website for current terms — the rules have tightened over the years.
What is STIX and TAXII and do I need them?
STIX is a JSON-based data format for describing threat intelligence — actors, campaigns, malware, indicators. TAXII is the API transport protocol for exchanging STIX bundles between platforms. Together they’re the enterprise standard for structured threat intel sharing. For most self-hosters, you don’t need them — plain text IP lists, DNS blocklists, and Suricata rules cover 95% of homelab use cases. You’d care about STIX/TAXII if you’re integrating with CISA AIS, building a MISP deployment, or connecting to a commercial threat intel platform.
Can I use ipset with nftables instead of iptables?
Sort of, but the modern approach is to use nftables named sets directly instead of ipset. nftables has a native set concept built into the kernel — you can create a named set with nft add set ip filter blocklist { type ipv4_addr; } and bulk-load IPs into it, with the same O(1) lookup performance as ipset. The nftables wiki has a migration guide from ipset. If you’re on a fresh install (Debian 12+, Ubuntu 22.04+, RHEL 9+), nftables is the default and native sets are the right approach.
What’s the best single feed for a self-hoster who wants to set it up once?
For DNS blocking: add HaGeZi TIF to your Pi-hole or AdGuard Home. One URL, daily updates, specifically focused on malware and phishing — not ad blocking noise. For firewall blocking: IPsum level 3+ loaded via ipset with a daily cron job. Those two together cover the most ground for the least ongoing maintenance. If you have a mail server, add Spamhaus ZEN via your MTA’s DNSBL configuration as a third layer.
How do I check if an IP is in my current ipset block list?
Run ipset test ipsum_blocklist 1.2.3.4 — it’ll return “is in set” or “is NOT in set”. To see the full contents, use ipset list ipsum_blocklist though that’ll be a long output for large sets. For a count of current entries, ipset list ipsum_blocklist | grep -c "^[0-9]" works. You can also check iptables packet counters with iptables -L INPUT -v -n | grep ipsum to see how many packets have been blocked.
AlienVault OTX has millions of indicators — won’t pulling all of them crash my server?
Don’t pull all of them at once. The OTX API and OTXv2 SDK let you filter by time window — use the getsince method with a 7-day lookback as shown in the Python script above. That typically yields tens of thousands of unique IPv4 IOCs, not millions, which is very manageable. Loading even 500k IPs into ipset is fine on any modern server. If you do want broader coverage, batch the imports with sleep calls between API requests to stay within rate limits.
Are government feeds like CISA AIS worth it for small businesses?
Probably not for most small businesses. CISA AIS requires paperwork, a PKI certificate from a Federal Bridge CA, an Interconnection Agreement, and a STIX/TAXII-capable client. That’s real overhead. The intelligence quality is excellent, but you’d get 80% of the practical value from IPsum, HaGeZi TIF, and the abuse.ch suite — all of which are zero paperwork and available in five minutes. If you’re in a critical infrastructure sector, a financial institution, or a government contractor, the CISA AIS application is worth pursuing.
Can I combine multiple IP blocklists into one ipset?
Yes, and it’s often a good idea for general blocking. The ipset add -exist flag silently ignores duplicate entries, so you can load IPsum, Blocklist.de, and OTX IPs into the same set without any issues. The atomic swap pattern still works — build the combined set under a temp name, then swap. Just watch the maxelem setting on your ipset creation; the default can be too low for combined large feeds. Set it to 1000000 to be safe.
What is GreyNoise and why is it different from a regular blocklist?
GreyNoise catalogues internet background noise — all the automated mass-scanning that hits every public IP constantly. Instead of flagging IPs as “bad,” it classifies them as noise (mass scanners hitting everyone), malicious (targeted attack activity), or unknown. This context helps with alert triage: if your SIEM fires on an IP that GreyNoise marks as benign mass-scanning noise, that’s a much lower priority than an IP flagged as targeted malicious activity. You wouldn’t use GreyNoise as a blocklist; you’d use it to prioritize which alerts actually need investigation.
