# OpenDBL

> OpenDBL aggregates public IP threat-intelligence feeds (Spamhaus, ThreatFox, Feodo Tracker, Blocklist.de, DShield, GreenSnow, Tor exit nodes, and more) into scored, deduplicated blocklists for firewalls, SIEMs, and security tooling.

## Blocklists

- [OpenDBL Darknet Sensor](https://opendbl.net/lists/opendbl-darknet.list): Real-time threat feed generated directly from OpenDBL's passive darknet sensor network.
- [Emerging Threats](https://opendbl.net/lists/etknown.list): Compiled from multiple sources containing active, severely infected, and hostile hosts.
- [TOR Exit Nodes](https://opendbl.net/lists/tor-exit.list): Real-time updated list of known TOR network exit nodes.
- [BruteforceBlocker](https://opendbl.net/lists/bruteforce.list): IP addresses reporting high volumes of SSH/service brute-force attack attempts.
- [Blocklist.de All](https://opendbl.net/lists/blocklistde-all.list): Attacking IP addresses detected across customer systems within the last 48 hours.
- [DShield](https://opendbl.net/lists/dshield-expanded.list): Top recommended attack sources from SANS Internet Storm Center DShield.
- [OpenDBL High-Confidence](https://opendbl.net/lists/high-confidence.list): Ultra-strict threat feed requiring multi-sensor correlation (2+ independent feeds) or a hit on an externally-vetted threat-intelligence feed (ThreatFox, Feodo Tracker, Spamhaus DROP) (13,100 CIDR blocks blocking 17,715 verified IPs). Engineered for zero-touch automated blocking with very low false positive risk.
- [OpenDBL Broad-Coverage](https://opendbl.net/lists/broad-coverage.list): Wide-spectrum threat feed combining active web scanners, brute-force bots, and malware hosts (32,541 CIDR blocks blocking 50,059 unique IPs). Darknet-sensor-only sightings must be corroborated by another feed or persist across 2+ distinct days; TOR exit nodes are excluded. Suited for production firewalls.
- [OpenDBL Full-Spectrum](https://opendbl.net/lists/all-threats.list): Complete union of all active external threat feeds (34,731 CIDR blocks blocking 55,894 unique IPs), including TOR exit nodes and single-report scanners with no corroboration or scoring threshold - except single-day-only sightings from our own darknet sensor pending corroboration. High false-positive risk — best suited for SIEM correlation and honeypots, not direct inbound blocking.
- [IPSum Level 3](https://opendbl.net/lists/ipsum.list): Aggregated threat list consisting of malicious IPs present in 3 or more blocklists.
- [Feodo Tracker C2](https://opendbl.net/lists/feodotracker.list): Active Command & Control (C2) servers for botnets, ransomware, and banking trojans (Dridex, TrickBot, QakBot).
- [GreenSnow Blocklist](https://opendbl.net/lists/greensnow.list): Real-time list of IP addresses carrying out brute-force attacks, port scans, and web exploits.
- [ThreatFox C2 & Payload](https://opendbl.net/lists/threatfox.list): Real-time Indicators of Compromise (IOCs) for malware C2 and payload delivery infrastructure from abuse.ch.
- [Spamhaus DROP](https://opendbl.net/lists/spamhaus-drop.list): Advisory list of hijacked or leased IP netblocks controlled entirely by cybercriminals.

## Firewall & Platform Integration Guides

- [Palo Alto Networks](https://opendbl.net/paloalto.html): Import OpenDBL feeds into PAN-OS as External Dynamic Lists (EDL).
- [Check Point](https://opendbl.net/checkpoint.html): Import via SmartConsole Network Feeds or Expert Mode scripts (R77/R80/R81/R82).
- [Fortinet FortiOS](https://opendbl.net/fortinet.html): Import OpenDBL feeds into FortiOS as Fabric Connectors.
- [Cisco Firepower](https://opendbl.net/cisco.html): Import OpenDBL feeds into Cisco Firepower Threat Defense (FTD) and FMC.
- [F5 BIG-IP AFM](https://opendbl.net/f5.html): Enrich F5 BIG-IP Advanced Firewall Manager with OpenDBL threat intelligence.
- [Sophos Firewall & UTM](https://opendbl.net/sophos.html): Import OpenDBL feeds into Sophos Firewall (SFOS / XGS) and Sophos UTM 9.
- [MikroTik RouterOS](https://opendbl.net/mikrotik.html): Fetch OpenDBL feeds into RouterOS IP Firewall Address Lists.
- [Ubiquiti UniFi & EdgeRouter](https://opendbl.net/ubiquiti.html): Import OpenDBL feeds into UniFi firewall categories and EdgeOS address groups.
- [pfSense](https://opendbl.net/pfsense.html): Configure OpenDBL feeds as custom IPv4 threat intelligence lists via pfBlockerNG.
- [OPNsense](https://opendbl.net/opnsense.html): Create external URL Table Aliases in OPNsense populated by OpenDBL lists.
- [Cloudflare](https://opendbl.net/cloudflare.html): Import OpenDBL feeds into Cloudflare Account IP Lists and WAF Custom Rules.
- [AWS WAF](https://opendbl.net/awswaf.html): Populate and synchronize AWS WAF IP Sets with OpenDBL threat intelligence feeds.

## More

- [About](https://opendbl.net/about.html): Project background and data sourcing.
- [News](https://opendbl.net/news.html): Changelog and service announcements.
- [Stats](https://opendbl.net/stats.html): Live dataset statistics and country breakdowns.