SiberGuvenlik Baskanligi Blocklist API | Tağmaç - root@Tagoletta:~#

SiberGuvenlik Baskanligi Blocklist API

Exploit / Project Details

Python Mon Jul 20 2026

An open-source tool that mirrors Turkey's Cybersecurity Directorate (T.C. Siber Güvenlik Başkanlığı) threat-intelligence feeds as firewall-ready blocklists — five address types, time-windowed lists (30/60/90/120 days and full), refreshed hourly by GitHub Actions with no server required. Nearly 483,000 records ready to drop straight into pfSense, OPNsense, MikroTik, Pi-hole, ipset, and Squid.

Detailed Write-up

Project Overview

SiberGüvenlik Başkanlığı — Blocklist API is an open-source tool that pulls five address types (domain, url, ip, ip6, ip6net) from the public API of Turkey's Cybersecurity Directorate (siberguvenlik.gov.tr), stores each record with its original date, and regenerates time-windowed, firewall-ready blocklists on every run.

Note: This is an unofficial, community-maintained mirror of the T.C. Siber Güvenlik Başkanlığı feeds. All data is sourced from the official public API.

No server required. A GitHub Actions workflow runs hourly, commits the refreshed lists to data/, and your firewall consumes them directly from raw GitHub URLs.

Live Record Counts

The table below is regenerated automatically on every bot commit — it shows the real, post-filtering line counts of the published lists for each time window (30/60/90/120 days and full):

Type 30d 60d 90d 120d Full
🌐 Domain 4,571 8,761 14,325 19,520 460,771
🔗 URL 0 0 0 0 6,927
📡 IPv4 294 675 1,050 1,244 14,966
🧭 IPv6 0 0 0 0 6
🕸️ IPv6 Net 0 0 0 0 0
Total 4,865 9,436 15,375 20,764 482,670

Output Files

Each address type is kept in its own file, per time window (data/ directory):

Window Domains URLs IPv4 IPv6 IPv6 Nets
All time full-domains.txt full-urls.txt full-ips.txt full-ip6.txt full-ip6net.txt
Last 30 days days-30-domains.txt days-30-urls.txt days-30-ips.txt days-30-ip6.txt days-30-ip6net.txt
Last 60 days days-60-domains.txt days-60-urls.txt days-60-ips.txt days-60-ip6.txt days-60-ip6net.txt
Last 90 days days-90-domains.txt days-90-urls.txt days-90-ips.txt days-90-ip6.txt days-90-ip6net.txt
Last 120 days days-120-domains.txt days-120-urls.txt days-120-ips.txt days-120-ip6.txt days-120-ip6net.txt

One entry per line, no quotes, no surrounding whitespace, LF line endings. Domains sorted alphabetically, IPs sorted numerically. database-*.jsonl (split into 250,000-record shards) and _state.json are internal bookkeeping files; firewalls should ignore them.

Firewall Usage

Consume the lists straight from raw GitHub URLs:

https://raw.githubusercontent.com/Tagoletta/SiberGuvenlikBaskanligi-API/main/data/full-domains.txt
https://raw.githubusercontent.com/Tagoletta/SiberGuvenlikBaskanligi-API/main/data/days-30-domains.txt
https://raw.githubusercontent.com/Tagoletta/SiberGuvenlikBaskanligi-API/main/data/full-ips.txt
https://raw.githubusercontent.com/Tagoletta/SiberGuvenlikBaskanligi-API/main/data/full-urls.txt

Compatible with pfSense, OPNsense, MikroTik, ipset, Pi-hole, Squid, and similar systems.

How It Works

  • First run (no full lists present): a full crawl begins for all types. Each type is fetched with per-page=1000 (~481 pages total). At 5–12 s/page the initial seed completes in ~1–2 hours.
  • After the full crawl: each hourly run does a fast incremental update — only new pages per type are fetched — then the lists are regenerated.
  • Every 7 days: a full re-crawl runs to detect entries removed at the source. Removed records are appended to data/removed.log.

Ageing logic: Lists are derived from the database + current clock on every run. A record that turns 31 days old drops out of days-30-* but remains in days-60-*, days-90-*, days-120-*, and full-*. No entry is ever lost from the wider windows.

Configuration

Variable Default Description
MIN_DELAY / MAX_DELAY 5 / 12 Seconds between pages during the full crawl
INC_MIN_DELAY / INC_MAX_DELAY 2 / 6 Seconds between pages during incremental
TIME_BUDGET_SECONDS 18000 Checkpoint the full crawl after this many seconds
FULL_RESYNC_DAYS 7 Re-crawl everything this often to detect removals (0 = off)
INCREMENTAL_MAX_PAGES 50 Safety cap for incremental pages per type per run
PER_PAGE 1000 Records per API page (max supported by the API)
DATA_DIR data Output directory
USER_AGENT Chrome/138 Request User-Agent

Installation & Running

Docker (optional) — not needed if you use GitHub Actions. To run on your own server:

docker compose up -d --build
docker compose logs -f

Local run (no Docker):

pip install -r scraper/requirements.txt
DATA_DIR=data python scraper/fetch.py

GitHub Actions: .github/workflows/update-lists.yml runs every hour. First runs perform the resumable full crawl; once complete, each hourly run is a fast incremental update and refreshes the live counts in the README.

API Source

All data is sourced from the official public API:

GET https://siberguvenlik.gov.tr/api/address/index?type={domain|url|ip|ip6|ip6net}&page={n}&per-page=1000

API documentation: https://siberguvenlik.gov.tr/api/openapi.yaml

Tech stack: Python 3.12 · GitHub Actions (hourly) · Docker · JSONL database (250K-record shards) · Licensed under GPLv3

GitHub