Award Winning Content Management and Security Solutions

Non-subscribers Download Area

Download for Free

Non-subscribers are limited to the 7-day versions of our blacklist. Lists are updated once per day and are typically up to 3 days old.

We add approximately 3000 new addresses daily, so subscribers get approximately 9000 more recent and currently active intruders. Subscribers also get additional formats plus 3, 7, and 14 day blacklists updated every 15 minutes.
Raw Format Including Netblocks
This list contains IP addresses and netblocks. It can be used wherever a specific format is not required.
Netblocks are used when our algorithm determines we can block whole ranges safely.

List Address:

https://blackhole.myblack.zone/download/cbhp.txt
Raw Format
This list contains only IP addresses. It can be used wherever a specific format is not required.

List address:

https://blackhole.myblack.zone/download/raw-bhp.txt.gz

Uncompressed:

https://blackhole.myblack.zone/download/raw-bhp.txt
Raw Format as Unsigned Integers
This list contains IP addresses in Network Byte Order Unsigned Integer format. It can be used wherever this specific format is required.

List address:

https://blackhole.myblack.zone/download/rawint-bhp.txt.gz
FortiGate Format
This list contains only IP addresses. FortiGate cannot use the compressed version of the lists.

Fortigate Use Instructions:
Under the menu:
  • Security Fabric/External Connectors click "Create New"
  • From the Threat Feed section choose "IP Address"
  • Fill in the fields:
  • Name: 27 Labs Blacklist
  • URL: https://blackhole.myblack.zone/download/raw-bhp.txt
  • HTTP Basic Authentication: off
  • Refresh Rate: Set to "daily" or 1440 minutes
  • Click OK.

Add list to DNS Filter Profile
Under the menu:
  • Security Profiles / DNS Filter select an existing filter or create a new filter.
  • In the "Static Domain Filter" section enable the option "External IP Block Lists"
  • In the box to the right of the External IP Block List click the '+' button and choose "27 Labs Blacklist"
  • Click OK to safe

List URL
https://blackhole.myblack.zone/download/raw-bhp.txt
Microsoft IIS (web.config) Format

We provide a XML version of our list specially formatted to be included in the websites web.config file.

To use, first change the configuration for the web server.

Edit the file c:\Windows\system32\inetsrv\config\applicationHost.config and change the following line:

From < section name="ipSecurity" overrideModeDefault="Deny" / >

To < section name="ipSecurity" overrideModeDefault="Allow" / >

Then change your web.config as follows:

<location path="Default Web Site"?>
<system.webServer>
<security>
<ipSecurity configSource="webconfig-bhp.xml"/>
</security>
</system.webServer>
</location>

List address:

http://blackhole.myblack.zone/webconfig-bhp.xml.gz

We also provide a small utility console application to manage the download and decompression silently from a Scheduled Event. It handles everything for you and downloads the appropriate version of the list to a directory you specify.

Download utility:
https://downloads.27labs.com/bhdliis.zip

Usage:
BHDLIIS.EXE http://blackhole.myblack.zone/webconfig-bhp.xml.gz DestinationFolder<br

Example:
BHDLIIS.EXE http://blackhole.myblack.zone/webconfig-bhp.xml.gz C:\inetpub\MyWebSite\

Apache .htaccess Format
Apache web servers and other types of servers use an .htaccess file to control what addresses are allowed to access particular content. .htaccess files are usually located in the root directory of your website.

List address:

https://blackhole.myblack.zone/download/htaccess-bhp.txt.gz
Nginx Format
Nginx web servers allow you to specify addresses to block in website configuration files. Here is one way to use it:

Create a directory under /etc/nginx/ called blackhole.

Create a cron job to wget the link below at an interval you select. Lists are updated once per day.

List address:

https://blackhole.myblack.zone/download/nginx-bhp.conf.gz

Example:

wget -q https://blackhole.myblack.zone/download/nginx-bhp.conf.gz -O /etc/nginx/blackhole/nginx-bhp.conf.gz && gunzip /etc/nginx/blackhole/nginx-bhp.conf.gz

In your .conf file for the server, add this line in the server block.

server{
server_name example.com
include /etc/nginx/blackhole/nginx-bhp.conf
}
pfSense Format
Zero-hour Blacklist blocking is implemented through pfBlockerNG. You will need to install this plugin if you haven't already.

List address:

https://blackhole.myblack.zone/download/raw-bhp.txt.gz

There are several different versions of pfSense and pfBlockerNG in production so we suggest you consult the documentation for your versions for instructions on using blacklists.
iptables Format
iptables is a relatively complicated way to block access to your server. We recommend you use ipset to manage the list.

List address:

https://blackhole.myblack.zone/download/iptables-bhp.txt.gz
Cisco ACL
Standard Cisco Access Control List format.

List address:

https:/blackhole.myblack.zone/download/cisco-bhp.txt.gz
MicroTic
Formatted for MicroTic routers and firewalls.

List address:

https://blackhole.myblack.zone/download/microtic-bhp.txt.gz
SMTP Mail Servers

This list is a little different than normal spam blacklists. It contains only the IP addresses of abusers who have been observed trying to gain access to one or more of our network of fake SMTP servers.

Sorry, this blacklist is only available to subscribers.