The Problem
Firewall administrators need current, actionable IP reputation data to block malicious inbound traffic (scanners, brute-forcers) and outbound connections to C2 servers and malware infrastructure. Maintaining such lists by hand is impractical — sources change constantly, and aggregating them without blocking legitimate services (like public DNS resolvers) requires ongoing curation.
What This Does
This repo publishes two plaintext blocklists — inbound.txt and outbound.txt — regenerated every 2 hours by GitHub Actions. inbound.txt targets sources of attacks against your infrastructure; outbound.txt targets known malicious destinations your internal devices might contact.
The stats/ directory holds 2,414 JSON snapshot files tracking list composition over time, and generate_history.py processes those snapshots. The tables/ directory contains 10 additional files supporting the stats dashboard.
How It Is Wired
Two workflows drive the repository. .github/workflows/update.yml runs the aggregation pipeline on a 2-hour schedule, producing inbound.txt and outbound.txt at the repo root. .github/workflows/stats.yml runs separately to snapshot list statistics into stats/archived/ as timestamped JSON files.
generate_history.py is the only Python entry point visible in the root, consuming the archived stats snapshots. requirements.txt declares its dependencies. The README notes the update workflow "takes a long time to complete" and recommends a self-hosted runner for forks — a practical constraint for anyone replicating this pipeline.
The internal call graph beyond this is not mapped in the available analysis, so the precise control flow inside the update workflow (which functions aggregate which sources) is not documented here.
How To Use It
No build step is needed to consume the lists. Download them directly:
curl -O https://raw.githubusercontent.com/moses-y/ipblocklist/main/inbound.txt
curl -O https://raw.githubusercontent.com/moses-y/ipblocklist/main/outbound.txtApply inbound.txt to your firewall's WAN IN/INPUT chain to drop traffic from listed sources, and outbound.txt to LAN OUT/OUTPUT to block egress to malicious destinations.
To fork and run the pipeline yourself:
git clone https://github.com/moses-y/ipblocklist
cd ipblocklist
pip install -r requirements.txtThe README advises setting up a self-hosted GitHub Actions runner for the update workflow due to runtime. Licensing is split: code is MIT, but the aggregated data is CC BY-NC-SA 4.0, and upstream providers (e.g., Spamhaus) may prohibit commercial use — a material constraint for production deployments.
Real-World Use
A small hosting provider applies inbound.txt to edge firewalls protecting customer VPSes, cutting SSH brute-force noise. A school district loads outbound.txt into its DNS/firewall layer to block compromised student devices from reaching known C2 endpoints.
Code Health & Issues
Static analysis found one low-severity issue:
Low— Dependencies declared without a lockfile; builds are non-reproducible —requirements.txt
The repo has one test file and two documentation files. The fork relationship to bitwire-it/ipblocklist (776 stars) means this copy carries the upstream architecture but has no independent community signal yet.
The Bottom Line
A useful, low-effort security resource if you need regularly refreshed IP blocklists and accept the non-commercial data license. The pipeline is simple and the output format is trivially consumable by firewalls and security tools. For production commercial use, verify upstream data licensing first — that constraint, not the code, is the real limitation.