Threat feed
Blocklist.de All
Last fetched
General Blacklists · refreshed hourly · last verified
Blocklist.de All is a General Blacklists threat-intelligence feed, refreshed hourly, indexed by WhisperGraph. WhisperGraph currently records 45,475 indicators listed by it.
What is Blocklist.de All
Blocklist.de All is the union view of every IP reported by participating fail2ban operators to the German Blocklist.de network. The combined feed covers attacks against SSH, mail, IMAP, FTP, web applications, and brute-force authentication endpoints; individual category feeds (Mail, SSH, etc.) are also published separately. Reports are aggregated from thousands of administrator-installed fail2ban sensors and exposed through a free public API, making this one of the larger volunteer-driven IP reputation feeds available without a commercial license. It is indexed here because it is a frequent citation in DDoS and credential-stuffing post-mortems.
- Refresh cadence
- hourly
Category drift. The curated category for this feed is General Blacklists, while WhisperGraph currently files it under blacklists.
Indicators currently listed
45,475 indicators across 3 node types.
IPV6 · 46
- 2a02:2a8:1:40:0:0:0:491b
- 2a00:1911:1:77a4:5b2e:6040:992:7cb8
- 2a04:2180:5656:2:0:0:0:25
- 2a01:239:4e4:7e00:0:0:0:1
- 2a01:4f8:c012:9ffd:0:0:0:1
Related pages
Pivot from Blocklist.de All into the indicators it lists.
Queries
Resolves the feed's categories.
MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categoriesThe indicator-kind rollup and sample listed above.
MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESCOr query Whisper from your own LLM workflow via the Whisper MCP server.