Skip to content
Install MCP

Threat feed

Blocklist.de All

Last fetched

General Blacklists · refreshed hourly · last verified

Blocklist.de All is a General Blacklists threat-intelligence feed, refreshed hourly, indexed by WhisperGraph.

Live data for this page is temporarily unavailable.

The graph returned an error for this lookup. Refresh in a moment to retry — fresh data is fetched on the next visit.

What is Blocklist.de All

Blocklist.de All is the union view of every IP reported by participating fail2ban operators to the German Blocklist.de network. The combined feed covers attacks against SSH, mail, IMAP, FTP, web applications, and brute-force authentication endpoints; individual category feeds (Mail, SSH, etc.) are also published separately. Reports are aggregated from thousands of administrator-installed fail2ban sensors and exposed through a free public API, making this one of the larger volunteer-driven IP reputation feeds available without a commercial license. It is indexed here because it is a frequent citation in DDoS and credential-stuffing post-mortems.

Source
https://www.blocklist.de/
Refresh cadence
hourly

Indicators currently listed

Related pages

Pivot from Blocklist.de All into the indicators it lists.

Queries

Resolves the feed's categories.


MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categories
Run yourself →

The indicator-kind rollup and sample listed above.


MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESC
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.