Import 28+ threat intelligence feeds into CrowdSec with automatic deduplication, normalization, and real-time sync.
crowdsec-blocklist-import is a Python tool that fetches, normalizes, and imports IP threat intelligence from over 28 free public feeds into CrowdSec's Local API. It solves the problem of stale blocklists by ensuring fresh threat data is available within minutes and automatically removes expired entries, keeping your security stack up-to-date with active threats.
System administrators, DevOps engineers, and security professionals running CrowdSec who want to enhance their threat detection with aggregated, real-time blocklists from multiple public intelligence sources.
Developers choose crowdsec-blocklist-import because it provides a centralized, automated way to integrate 28+ threat feeds with CrowdSec, featuring built-in deduplication, normalization, and real-time sync to eliminate stale data—offering 10-20x more blocks than default setups.
10-20x more blocks for your CrowdSec bouncers — 120k+ IPs from 36 free threat feeds
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Pulls from over 28 free public sources like IPsum, Spamhaus, and Abuse.ch, providing broad threat coverage without additional cost, as detailed in the supported blocklists section.
Ensures threat IPs are updated within minutes and expired entries are automatically removed, solving the stale blocklist problem highlighted in the README's philosophy.
Features a daemon mode with configurable intervals, eliminating the need for external cron jobs, and includes webhook notifications and Prometheus metrics for monitoring.
Checks IPs against existing CrowdSec decisions to avoid redundant imports and standardizes CIDR formats across all feeds, reducing API overhead and errors.
Relies on public feeds with varying update schedules and accuracy, which can lead to false positives or missed threats, as admitted with feeds like Tor nodes that may cause false positives.
Requires configuring CrowdSec LAPI credentials, machine IDs, and bouncer keys, adding overhead for users not already familiar with CrowdSec's authentication system.
Direct API integrations like AbuseIPDB have free tier restrictions (e.g., 5 checks per day), limiting data freshness unless a paid key is used, as noted in the configuration.