The www.blocklist.de Fail2Ban-Reporting Service BlockList.de is an IP-based blocklist (or blacklist) that lists servers reported via services like Fail2Ban for engaging in attacks such as SSH, mail-login, and FTP, with IPs being automatically removed from the blacklist after 48 hours.
The www.blocklist.de Fail2Ban-Reporting Service BlockList.de is a real-time IP-based DNS blocklist (blacklist) that lists IP addresses that have engaged in attacks on various services. This blacklist is populated by reports from users running Fail2Ban or DenyHost on their servers. The policy is to list attackers for 48 hours, after which they are automatically delisted. It's used by system administrators to block connections from known malicious sources, protecting services like email servers, web servers, and FTP servers. When an administrator uses this list, they are responsible for any refusals or blocks that result.
Technically, the blocklist (bl.blocklist.de) logs IP addresses that have participated in attacks against specific services. The service monitors for a wide variety of attack types:
To improve accuracy and reduce false positives, the service cross-references IPs with whitelists from dnswl.org and Spamhaus, and a blacklist from the Tor project.
This service is a free, voluntary project run by a fraud and abuse specialist. The founder's own servers were frequently attacked, which inspired the creation of this blocklist. The mission is to report all attacks to the abuse departments of the networks where the attacking servers are hosted. This allows providers to notify their customers of compromises and take action against the attackers.
The platform reports tens of thousands of attacks every 12 hours. These reports are sent in a machine-readable format (X-Arf) to abuse contacts found via Whois, the Ripe-Abuse-Finder, and other contact databases. The service is comparable to SpamCop, but its focus is on all types of network attacks rather than just spam. It is a community-driven effort with thousands of partners who contribute attack data from their own servers.
Before requesting removal from any blacklist, you must first identify and resolve the issue that caused the listing. This could involve securing a compromised server, fixing a misconfiguration, or stopping a spam outbreak. Once the underlying problem is fixed, you can seek delisting.
Listings on this blocklist expire automatically after 48 hours. If you have resolved the issue and need faster removal, you can use the removal form on their website. Once you submit a removal request, the change is typically processed within 60 minutes when the lists are next generated.
The impact of being on this blacklist is generally considered low. It is not as widely used as major blocklists like those from Spamhaus or SpamCop. However, any listing can cause deliverability problems. The impact depends entirely on whether your recipients' mail servers use this specific blacklist. If they do, your emails to them may be blocked, or your server's connection may be refused. Beyond email, this blocklist is also used to block forum spam and malicious bots, so a listing could affect other types of web traffic as well.
19 resources
What are examples of insignificant or ineffective email blocklists?
What are the best blocklist monitoring services that offer timely alerts and customization options?
What common blocklists or services cause 'message rejected as spam' errors for ESPs?
What does a 'timeout after end of message' error from blocklist.de mean and how do I fix it?
Why is a Google IP address blocklisted by Spamhaus?
Why is my IP repeatedly blocklisted by Spamhaus XBL?