What The Lists Hold Screensaver
The What The Lists Hold screensaver shows five public IP blocklists measured side by side, key-less. It’s free, runs in your browser, and ESC exits.
Live preview
Press ESC to leave fullscreen. Settings are saved in your browser only.
How the What The Lists Hold screensaver works
The saver reads the source described above and draws it on a canvas — no account, no tracking.
Five public IP blocklists measured side by side, key-less. The comparison is deliberately unfair: one counts network blocks, another single addresses, another only the last hour. The Tor exit list is included because it is not a threat list and gets used as one.
It refreshes on a schedule, so what you see stays current.
Colours and any options can be changed in settings; nothing is stored beyond your own browser.
Why blocklist sizes are not threat volumes
An IP blocklist is a published list of network addresses that a firewall or filter can refuse to talk to. The saver compares five by size, and they are built for different purposes: FireHOL Level 1 is composed from other lists (its header names DShield, Feodo, fullbogons and Spamhaus DROP) with minimum false positives as the goal; the CINS Army list from Sentinel IPS is drawn from its sensors’ attack data and capped at 15,000 addresses; Feodo Tracker lists botnet command-and-control servers; and blocklist.de publishes addresses reported attacking its servers.
The sizes therefore mean different things. Entries can be written in CIDR notation, where an address plus a prefix length describes a whole network block, so a list of a few thousand blocks can cover far more addresses than a list of 15,000 single ones. A shorter prefix covers more addresses, a longer one fewer.
One list is not a threat list at all: the Tor Project’s bulk exit list holds addresses used by Tor exit relays, the points where Tor traffic reaches the open internet. Some operators use it as a blocklist, but it records where traffic exits, not a verdict on that traffic. A bigger list is not necessarily better or more dangerous; the numbers describe how each list is built, not how many attacks are happening.
A worked example
Five public IP blocklists measured side by side, key-less. The comparison is deliberately unfair: one counts network blocks, another single addresses, another only the last hour. The Tor exit list is included because it is not a threat list and gets used as one.
Settings & tips
- Accent and Background recolour the display.
- Every value on screen comes from the live source — nothing is simulated.
- Press ESC to leave fullscreen.
Frequently asked questions
- Is this real data?
- Yes — it comes from the source named on this page and is refreshed on a schedule.
- Is a key needed?
- No. This source is fully key-less.
- Is it free?
- Yes, and it runs entirely in your browser.
- What is CIDR notation?
- A way to write a block of IP addresses as an address and a prefix length. A short prefix covers many addresses and a long one covers few.
- Is a bigger list better protection?
- Not automatically. Lists are built differently, one entry can be a single address or a whole network block, and some count only recent activity, so size alone is not a quality measure.