Threat feed

Blocklist.de SSH

Last fetched Thu, 22 Oct 2026 00:29:47 GMT

Brute Force · refreshed hourly · last verified 2026-09-28

Blocklist.de SSH is a Brute Force threat-intelligence feed, refreshed hourly, indexed by WhisperGraph. WhisperGraph currently records 14,285 indicators listed by it.

What is Blocklist.de SSH

Blocklist.de SSH is the SSH-targeting subset of the Blocklist.de fail2ban federation. It aggregates IPs reported by participating administrators as having attempted SSH brute-force or password-spray attacks against their hosts; entries arrive in near-real-time and roll off the list when reports stop. The feed is widely used by individual server operators as a free deny-list for cloud and on-premises SSH gateways, frequently in combination with cloud-provider native firewalls. It is indexed here as a record because SSH brute force is one of the most commonly cited threat categories in incident reports.

Source: https://www.blocklist.de/en/lists.html
Refresh cadence: hourly

Category drift. The curated category for this feed is Brute Force, while WhisperGraph currently files it under bruteforce.

Indicators currently listed

14,285 indicators across 3 node types.

IPV4 · 14,253

PREFIX · 25

IPV6 · 7

2a04:2180:5656:2:0:0:0:25
2001:41d0:303:6e59:0:0:0:1
2001:41d0:303:f2a3:0:0:0:0
2001:41d0:2:b20b:0:0:0:1
2001:df6:c880:0:0:0:0:14

Pivot from Blocklist.de SSH into the indicators it lists.

Queries

Resolves the feed's categories.


MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categories

Run yourself →

The indicator-kind rollup and sample listed above.


MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESC