PARC Security — verified and normalised IP feeds for your Magento hosting infrastructure

For our Magento architecture and many other platforms — free for the community

The IP feeds are platform-independent. You can use them anywhere — in front of a Magento shop just as well as Shopware, WooCommerce, Joomla, WordPress, forums or any other web software, on an OPNsense or pfSense, in the SafeLine WAF or any other web application firewall. Whenever you want to steer crawler, bot or threat traffic at the firewall, WAF or reverse-proxy level, you can use these lists for it.

We make them available to the community for free — in the hope of contributing to fewer wasted resources and more security on the web. When fewer servers have to process unnecessary bot traffic and malicious IPs aren’t let through in the first place, everyone wins in the end — depending on the bot and blacklist profile, traffic savings of between 50 and 70 % are not uncommon.

We also provide tools for creating the lists in OPNsense and SafeLine, so you don’t have to wire them up manually. Importing them, however, is up to you — or you leave that to us. If you already use an OPNsense or SafeLine — or would like to — we can set up the complete security stack for you: installation, configuration, feed integration, ongoing operation.

Contact us

PARC Security is not a classic blacklist filter in the narrow sense. More precisely, it’s about IP lists — or more precisely still: IP groups. We continuously research lists of all kinds: blacklists, bots, SEO tools, AI crawlers and more.

Two ways to a list

Sometimes it’s simple: providers such as Google publish a ready-made JSON that we can use directly. If the information is available in another format instead (HTML table, CSV, forum post or similar), we normalise the source and publish it as JSON. And if nothing exists at all — for instance because a bot operator doesn’t disclose its ranges — we research, collect and maintain the list ourselves and likewise make it available as a public JSON.

How we research a list

The process begins with IP addresses that we pull from various sources (forums, databases, community lists) for the respective bot — in around 40 languages. The reason: every country has its own bot and crawler landscape, and regional crawlers are documented first in regional forums and communities. Anyone tapping only English-language sources systematically misses everything from China, Russia, Brazil, Korea and many other regions. Then:

• Deduplication of all collected IPs.
• Forward and reverse DNS resolution — we check whether the DNS name matches the provider’s documented crawler syntax (FCrDNS verification).
• ASN determination: for the valid IPs, we determine the provider’s Autonomous System Number and the associated IP ranges.
• Range sweep: we test the entire identified ASN range for matching crawler/bot DNS names.

The result is a very comprehensive, verified list of all active IPs of the respective bot. We repeat this full research process at regular intervals.

Daily validation

Every day we re-check the IP entries of our own PARC feeds via forward and reverse DNS resolution: does the IP still belong to the respective bot, or has it moved on elsewhere in the meantime? That keeps them fresh by the day. The official JSONs (e.g. from Google, Apple or Spamhaus) are kept up to date by the respective provider — we link to them directly instead of duplicating them.

Our stance: neutral — except for the malicious ones

We are fundamentally neutral towards the lists. It’s your decision whom you let in or block — the Googlebot is welcome on most shops, a competitor’s price scraper rather less so. We make an exception only for the malicious lists: those should definitely be blocked. And not only inbound, but also outbound — in case someone internally has been compromised, the communication to the outside should be stopped as well.

OPNsense: the whole catalog in one click

For OPNsense we provide the complete catalog as ready-made alias bundles — no need to wire up the feeds one by one. Import under Firewall → Aliases via the upload button at the bottom right. Each feed becomes one alias (type urljson, IPv4 and IPv6 together; blacklists as urltable), consistently named by category — ps_seo_…, ps_ai_…, ps_search_… etc.

Note: On re-import an alias is overwritten by its name, not created twice. So you can re-import the bundles anytime to update to the latest state.

Complete bundle (all categories, 73 aliases): ps_all_aliases.json

Or per category: the OPNsense import button sits right at each category in the catalog below, next to the provider buttons.

The aliases are just the IP groups — what you allow or block with them is up to your own firewall rules.

IP feed categories

AI Crawler

Show feeds (6 sources · 10 feeds)

Blacklists

There are very many blacklists — and many overlap. Some are based on others or are derived and combined from multiple sources. We regularly review the available free blacklists and platforms, check whether they are actively maintained, observe them over longer periods, and then make a selection that deliberately covers different security categories — brute-force attackers on services (SSH, mail, web), cybercrime and C2 infrastructure, hijacked or criminal network ranges, as well as IPs generally reported as malicious. This produces coverage across the essential threat classes. The lists below overlap, but also complement each other well — in the OPNsense firewall this is no problem: if you combine several lists as a nested network group, the underlying PF table (FreeBSD) stores each entry only once — so overlaps cause no extra overhead.

Our recommendation for use: Malicious lists should be blocked both inbound and outbound — inbound against attackers, outbound against data exfiltration through a planted backdoor that would communicate with known C2 servers. Important: before the block rule, you should explicitly allow the wanted and legitimate IPs, because every now and then IPs of legitimate bots or services also end up on blacklists — without an upstream allow list this would lead to false blocks.

Show feeds (8 sources · 11 feeds)

CDN

Show feeds (3 sources · 3 feeds)

Internet scanners

Show feeds (41 sources · 41 feeds)

Marketplaces

Official server IPs of online marketplaces that communicate with the connected shop (push notifications, file downloads, outbound API calls), normalized from each operator's official docs. Show feeds (2 sources · 2 feeds)

Payment providers

Official IP ranges of payment providers (webhook/API servers), normalized from each provider's official source. Plain IP data — how to use it is up to the operator. Show feeds (11 sources · 11 feeds)

Privacy & consent

Official scanner/server IPs of consent-management and privacy services that scan or query the shop from outside, from each provider's official docs. Show feeds (1 sources · 1 feeds)

Proxy & anonymizers

Show feeds (2 sources · 2 feeds)

Search engines

Show feeds (18 sources · 25 feeds)

SEO tools

Show feeds (12 sources · 12 feeds)

Shop extensions

Official server IPs of Magento extensions/services that communicate with the shop (cron/API/webhooks), normalized from each provider's official docs. Show feeds (1 sources · 1 feeds)

Social Media

Show feeds (5 sources · 5 feeds)