Skip to content
Install MCP

Threat feed

Blocklist.de SSH

Last fetched

Brute Force · refreshed hourly · last verified

Blocklist.de SSH is a Brute Force threat-intelligence feed, refreshed hourly, indexed by WhisperGraph.

Live data for this page is temporarily unavailable.

The graph returned an error for this lookup. Refresh in a moment to retry — fresh data is fetched on the next visit.

What is Blocklist.de SSH

Blocklist.de SSH is the SSH-targeting subset of the Blocklist.de fail2ban federation. It aggregates IPs reported by participating administrators as having attempted SSH brute-force or password-spray attacks against their hosts; entries arrive in near-real-time and roll off the list when reports stop. The feed is widely used by individual server operators as a free deny-list for cloud and on-premises SSH gateways, frequently in combination with cloud-provider native firewalls. It is indexed here as a record because SSH brute force is one of the most commonly cited threat categories in incident reports.

Source
https://www.blocklist.de/en/lists.html
Refresh cadence
hourly

Indicators currently listed

Related pages

Pivot from Blocklist.de SSH into the indicators it lists.

Queries

Resolves the feed's categories.


MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categories
Run yourself →

The indicator-kind rollup and sample listed above.


MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESC
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.