IPbandit is a tool that protects you against malicious IP addresses and CIDR blocks (IPv4/IPv6). These blocklists are designed to stop threats before they reach your network and are continuously updated to strengthen your firewall and WAF instances.

IPbandit aggregates multiple community-generated blacklists. You can select, add, or remove lists, and even create your own blacklists—for instance, to block entire countries.

You can easily integrate our malicious IP lists into your firewalls. Examples include: Fortinet, Palo Alto, Cisco, Checkpoint, F5, Sophos, Juniper, Mikrotik, pfSense, OPNsense, UFW, Firewalld, Iptables, NFtables, etc. Aggregation of lists of malicious IP addresses such as scanners and bruteforce, therefore ONLY to be blocked in the WAN > LAN/DMZ direction

Designed to enhance the security of your critical infrastructure (servers, VPS, containers, websites, WordPress, Apache, Nginx, Caddy, exposed infrastructure, APIs, etc.) across macOS, BSD, and Linux (RedHat, AlmaLinux, Rocky Linux, Debian, Ubuntu, etc.).

Thank you to all the people and communities who are participating in the security project and sharing their lists for the good of all.

This version is 1.1.1 Alpha
For production see the latest stable version ici: https://github.com/cl3m4x1l/IPbandit/releases

IPbandit is free and open-source software licensed under the GNU General Public License v3.0 (GPLv3).
You are free to use, modify, and distribute this software in compliance with the license terms. See the LICENSE file for more details.

• 2026-01 Init project, share on github
• 2026-02 Add IPv6, add custom config file
• 2026-03 Add Fail2ban extras option, version Nightly
• 2026-04 Version 1.0 Beta
• 2026-05 Version 1.0 Release Candidate
• 2026-06 Version 1.0 Stable
• 2026-07 Version 1.1 Stable
• In progress, extras option Ipset / Nftables and more

V 1.1.0

• Rename file: Subnet to CIDR
• Convert IPv6 only CIDR/64
• Add white list file
• Removal of IPs already covered by CIDRs

V 1.0.0

• Init project
• Aggregator block lists and fail2ban jail host

You can use our lists, generated directly from our infrastructure, without any installation.
Download the following files directly.

The unified file containing all IP addresses :

• https://raw.githubusercontent.com/cl3m4x1l/IPbandit/refs/heads/main/list.d/IPbandit_all.txt

or the separate files :

• https://raw.githubusercontent.com/cl3m4x1l/IPbandit/refs/heads/main/list.d/IPbandit_ipv4.txt
• https://raw.githubusercontent.com/cl3m4x1l/IPbandit/refs/heads/main/list.d/IPbandit_ipv4_cidr.txt
• https://raw.githubusercontent.com/cl3m4x1l/IPbandit/refs/heads/main/list.d/IPbandit_ipv6_cidr.txt

You must have curl, sipcacl, grepcidr to install. Examples:

Update repositories and install all three tools :

sudo apt update
sudo apt install -y curl sipcalc grepcidr

Install curl and grepcidr

sudo dnf install -y curl grepcidr

Install sipcalc

sudo dnf install -y sipcalc

If sipcalc is not available, activate the EPEL repository :

sudo dnf install -y epel-release
sudo dnf install -y sipcalc

Install all three tools :

brew install curl sipcalc grepcidr

mkdir /opt/clemaxil
cd /opt/clemaxil/
git clone https://github.com/cl3m4x1l/IPbandit.git

mkdir /opt/clemaxil
cd /opt/clemaxil/
wget https://github.com/cl3m4x1l/IPbandit/archive/refs/heads/main.zip
unzip main.zip 
mv IPbandit-main IPbandit

Navigate to the parent directory

chown -R root:root /opt/clemaxil/IPbandit
cd /opt/clemaxil/IPbandit
chmod +x IPbandit.sh extras/aggregator.sh extras/fail2ban.sh

cd /opt/clemaxil/IPbandit/
./IPbandit.sh --aggregator

crontab -e

Add this line, and adjust time

30 05 * * * nice -n 10 /opt/clemaxil/IPbandit/IPbandit.sh --aggregator >/dev/null 2>&1

nano /etc/crond.d/IPbandit

Add this line, and adjust time

30 05 * * * root nice -n 10 /opt/clemaxil/IPbandit/IPbandit.sh --aggregator >/dev/null 2>&1

With full options (see extras section)

30 05 * * * root nice -n 10 /opt/clemaxil/IPbandit/IPbandit.sh --fail2ban --aggregator >/dev/null 2>&1

After execution, you will find the generated files in IPbandit/list.d directory, which you can then use for your services.

• IPbandit_all.txt
• IPbandit_ipv4.txt
• IPbandit_ipv4_cidr.txt
• IPbandit_ipv6_cidr.txt
• IPbandit_whitelist.txt

Note: IPdeny offers free downloads of GEO IP address blocks by country. You can add a list of IP addresses from a country to this directory. https://www.ipdeny.com/ipblocks/

You can add your own lists to the extras/list.d directory. Important ! Name your files with the .list extension.

You can choose which lists to download by editing the IPbandit_custom.txt file.

You can retrieve the list of IPs detected by fail2ban on your machine.

The Ips will be written in the files extras/list.d/myfail2ban.list.\ This file will then be imported directly by IPbandit.

You can run the scriptextras/fail2ban.sh separately

cd /opt/clemaxil/IPbandit/extras/
./fail2ban.sh 

or with the IPbandit options.

cd /opt/clemaxil/IPbandit/
./IPbandit.sh --fail2ban