Report attacks & block worldwide
The Attack Defense Network is a community network in both directions: your servers report attacks (SSH brute-force, IMAP, web attacks - 109 service types) automatically via fail2ban to a central list. At the same time, you automatically block reported attackers on your own servers and firewalls - set up in 2 minutes.
Guest mode: limited usage. Register for free for unlimited usage, history & statistics.
Register freeReport attacks.
Block them worldwide.
The Attack Defense Network is a network in both directions: report attacks from your servers via fail2ban, CrowdSec or API - and automatically block reported attackers via fail2ban. Free, no account, GDPR compliant.
Live Check
sample data possible1. Server reports
fail2ban bans an attacker and reports the IP to us automatically via HTTP API.
2. We score
One report reaches the watchlist, two independent reports list the IP - critical categories list immediately. Scoring, confidence and reporter reputation determine severity and expiry.
3. World blocks automatically
Other admins automatically receive reported attackers in their fail2ban block jail (synced every 5 minutes). The DNS zones are used to check individual IPs - and the responsible provider is notified anonymously.
Set up fail2ban (2 minutes)
One command, done: the installer script installs fail2ban if needed, backs up existing configs, sets up reporting AND automatic blocking of reported attackers and restarts the service. Use the "Report only" toggle to disable blocking. With a free account you additionally get report tokens.
curl -sS https://reports.provider.tools/api/v1/abuse/fail2ban-install | sudo bashYour server automatically blocks reported attackers.
API Reference
One endpoint for your server automation. Full documentation in the Knowledge Base.
POST https://reports.provider.tools/api/v1/abuse/report
Content-Type: application/json
{ "ip": "203.0.113.7", "service": "ssh", "port": 22 }
Service examples: ssh, imap, smtp-auth, http, mysql, wordpress, minecraft, ddos, sqli, malware, portscan - 100+ supportedWhen does an IP get listed?
A single report (with token or anonymous - every report counts equally) only reaches the watchlist. Two independent reports soft-list the IP (the check zone returns a block code), further reports hard-list it. Critical categories (malware, botnet) list with a single report. Entries expire automatically without new reports (7 days).
Read the scoring modelAnonymous & GDPR compliant
No reporter identity: reports are processed anonymously, no reporter IPs, no log contents.
Minimal evidence: publicly visible are only category, score, service and the hour of the signal.
Automatic decay: scores decay exponentially, entries disappear automatically without new activity.
Hosted in Germany, no transfer to third countries.
Frequently Asked Questions
When does an IP get listed?
A single report (with token or anonymous - every report counts equally) only reaches the watchlist. Two independent reports soft-list the IP (the check zone returns a block code), further reports hard-list it. Critical categories (malware, botnet) list with a single report. Entries expire automatically without new reports (7 days).
How are false positives avoided?
Five protection layers: listing requires two independent reports (a single report - with or without token - only reaches the watchlist), reporter reputation dampens unreliable sources, an internal whitelist protects your own infrastructure, dnswl.org whitelisting reduces weight for trusted mail servers, and tor exits are flagged instead of being reported to abuse desks.
What happens to tor exit nodes?
Tor exits are still scored (the attacks are real) but flagged with tor-exit in the evidence. Admins can allow or block them via firewall rules. Abuse notifications are not sent for tor exits.
Which DNS zones are available?
Each of the 109 services has its own check zone: <service>.attacks.provider.tools (e.g. ssh., imap., smtp-auth.), plus the base zone attacks.provider.tools for all. Automatic blocking uses the HTTP export - the text list is synced every 5 minutes.
Is the service really free?
Yes. Reporting, DNS queries and IP checks are free and work without an account. There are no hidden limits for basic operation.
How it works
1. Server reports
fail2ban bans an attacker and reports the IP automatically via API.
2. We score
Every report is a signal - category, confidence and reputation determine the score.
3. Everyone blocks automatically
Reported attackers are banned worldwide via the block jail (5-minute sync).
Features in detail
fail2ban integration
One command installs reporting + automatic blocking in 2 minutes.
109 service types
SSH, IMAP, SMTP, web attacks, databases, game servers and more.
Worldwide blocking
Attackers are blocked everywhere, not just where they were caught.
Firewall integration
Ready-made scripts for iptables, nftables, ufw, pf and Windows Firewall.
Cautious principle
1 report = watchlist, listed after 2 independent reports - no arbitrary blocks.
Anonymous & GDPR
No reporter identity, no log contents, hosted in Germany.
Frequently asked questions
How do I install Attack Defense?
With one command: curl -sS https://reports.provider.tools/api/v1/abuse/fail2ban-install | sudo bash - installs fail2ban, sets up reporting and automatic blocking.
When does an IP get listed?
A single report (with or without token) only reaches the watchlist. Two independent reports list the IP; critical categories (malware, botnet) list immediately. Entries expire after 7 days without new reports.
Can I report without blocking?
Yes - with the "Report only" toggle or &block=0 in the install command.
Does it work without fail2ban?
Yes - the reporting API is open to any system (CrowdSec, custom scripts), and for blocking there are firewall scripts for iptables, nftables, pf & Windows.
What does Attack Defense cost?
Nothing. Reporting, blocking and IP checks are free. A free account only unlocks report tokens for personal server statistics.