Robot
/
blocklist-ipsets
mirror of https://github.com/firehol/blocklist-ipsets.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Mon May 20 10:18:23 UTC 2024 update

This commit is contained in:
Costa Tsaousis 2024-05-19 06:49:22 +01:00
commit 61363d1690
1358 changed files with 7092284 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

106
.gitignore vendored Normal file
View File

@ -0,0 +1,106 @@
bogons.netset
.cache
.cache.old
dragon_http.netset
dragon_*.ipset
dragon_*.netset
dragon_sshpauth.netset
dragon_vncprobe.netset
dronebl_anonymizers.netset
dronebl_auto_botnets.netset
dronebl_autorooting_worms.netset
dronebl_compromised.netset
dronebl_ddos_drones.netset
dronebl_dns_mx_on_irc.netset
dronebl_*.ipset
dronebl_irc_drones.netset
dronebl_*.netset
dronebl_unknown.netset
dronebl_worms_bots.netset
errors/
fullbogons.netset
history/
ib_*.ipset
iblocklist_ads.netset
iblocklist_ads.*set
iblocklist_badpeers.ipset
iblocklist_badpeers.*set
iblocklist_bogons.netset
iblocklist_bogons.*set
iblocklist_dshield.netset
iblocklist_dshield.*set
iblocklist_edu.netset
iblocklist_edu.*set
iblocklist_exclusions.netset
iblocklist_exclusions.*set
iblocklist_fornonlancomputers.netset
iblocklist_fornonlancomputers.*set
iblocklist_forumspam.netset
iblocklist_forumspam.*set
iblocklist_hijacked.netset
iblocklist_hijacked.*set
iblocklist_iana_multicast.netset
iblocklist_iana_multicast.*set
iblocklist_iana_private.netset
iblocklist_iana_private.*set
iblocklist_iana_reserved.netset
iblocklist_iana_reserved.*set
iblocklist_level1.netset
iblocklist_level1.*set
iblocklist_level2.netset
iblocklist_level2.*set
iblocklist_level3.netset
iblocklist_level3.*set
iblocklist_org_microsoft.netset
iblocklist_org_microsoft.*set
iblocklist_proxies.ipset
iblocklist_proxies.*set
iblocklist_rangetest.netset
iblocklist_rangetest.*set
iblocklist_spider.netset
iblocklist_spider.*set
iblocklist_spyware.netset
iblocklist_spyware.*set
iblocklist_webexploit.ipset
iblocklist_webexploit.*set
ib_*.netset
iprange*
ipv4_range_to_cidr.awk
*.lastchecked
*.setinfo
sorbs_anonymizers.netset
sorbs_dul.netset
sorbs_escalations.netset
sorbs_*.ipset
sorbs_*.netset
sorbs_new_spam.netset
sorbs_noserver.netset
sorbs_recent_spam.netset
sorbs_smtp.netset
sorbs_web.netset
sorbs_zombie.netset
*.source
*.tmp
update-ipsets*
.warn_if_last_downloaded_before_this
blueliv*.ipset
blueliv*.netset
blueliv_crimeserver_online.ipset
blueliv_crimeserver_recent.ipset
blueliv_crimeserver_last.ipset
blueliv_crimeserver_last_1d.ipset
blueliv_crimeserver_last_2d.ipset
blueliv_crimeserver_last_7d.ipset
blueliv_crimeserver_last_30d.ipset
iblocklist_badpeers.netset
dataplane_sipquery.ipset
dataplane_sshpwauth.ipset
dataplane_sshclient.ipset
dataplane_sipregistration.ipset
dataplane_sipinvitation.ipset
dataplane_vncrfb.ipset
dataplane_dnsrd.ipset
dataplane_dnsrdany.ipset
dataplane_dnsversion.ipset
shunlist.ipset
ip2proxy_px1lite.netset

228
README-EDIT.md Normal file
View File

@ -0,0 +1,228 @@
> Due to the amount of data and the frequency of the updates on this repo,
> github has requested to limit the number of updates.
> The site [https://iplists.firehol.org](https://iplists.firehol.org) has direct links
> to all the files in this repo. **This repo is now updated once per day.**
---
### Contents
- [About this repo](#about-this-repo)
- [Using these ipsets](#using-these-ipsets)
- [Which ones to use?](#which-ones-to-use)
- [Why are open proxy lists included](#why-are-open-proxy-lists-included)
- [Using them in FireHOL](#using-them-in-firehol)
* [Adding the ipsets in your firehol.conf](#adding-the-ipsets-in-your-fireholconf)
* [Updating the ipsets while the firewall is running](#updating-the-ipsets-while-the-firewall-is-running)
- [Dynamic List of ipsets included](#list-of-ipsets-included)
- [Comparison of ipsets](#comparison-of-ipsets)
---
# About this repo
This repository includes a list of ipsets dynamically updated with
[FireHOL](https://github.com/firehol/firehol)'s `update-ipsets.sh`
[documented in this wiki](https://github.com/firehol/blocklist-ipsets/wiki).
This repo is self maintained. It it updated automatically from the script via a cron job.
This repo has a site: [http://iplists.firehol.org](http://iplists.firehol.org).
## Why do we need blocklists?
As time passes and the internet matures in our life, cybercrime is becoming increasingly sophisticated.
Although there are many tools (detection of malware, viruses, intrusion detection and prevention systems,
etc) to help us isolate the bad guys, there are now a lot more than just such attacks.
What is more interesting is that the fraudsters or attackers in many cases are not going to do a direct
damage to you or your systems. They will use you and your systems to gain something else, possibly not
related or indirectly related to your business. Nowadays the attacks cannot be identified easily. They are
distributed and come to our systems from a vast amount of IPs around the world.
To get an idea, check for example the [XRumer](http://en.wikipedia.org/wiki/XRumer) software. This thing
mimics human behavior to post ads, it creates email accounts, responds to emails it receives, bypasses
captchas, it goes gently to stay unnoticed, etc.
To increase our effectiveness we need to complement our security solutions with our shared knowledge, our
shared experience in this fight.
Hopefully, there are many teams out there that do their best to identify the attacks and pinpoint the
attackers. These teams release blocklists. Blocklists of IPs (for use in firewalls), domains & URLs
(for use in proxies), etc.
What we are interested here is IPs.
Using IP blocklists at the internet side of your firewall is a key component of internet security. These
lists share key knowledge between us, allowing us to learn from each other and effectively isolate
fraudsters and attackers from our services.
I decided to upload these lists to a github repo because:
1. They are freely available on the internet. The intention of their creators is to help internet security.
Keep in mind though that a few of these lists may have special licences attached. Before using them, please check their source site for any information regarding proper use.
2. Github provides (via `git pull`) a unified way of updating all the lists together.
Pulling this repo regularly on your machines, you will update all the IP lists at once.
3. Github also provides a unified version control. Using it we can have a history of what each list has
done, which IPs or subnets were added and which were removed.
## DNSBLs
Check also another tool included in FireHOL v3+, called `dnsbl-ipset.sh`.
This tool is capable of creating an ipset based on your traffic by looking up information on DNSBLs and
scoring it according to your preferences.
More information [here](https://github.com/firehol/firehol/wiki/dnsbl-ipset.sh).
---
# Using these ipsets
Please be very careful what you choose to use and how you use it. If you blacklist traffic using these
lists you may end up blocking your users, your customers, even yourself (!) from accessing your services.
1. Go to to the site of each list and read how each list is maintained. You are going to trust these guys for doing their job right.
2. Most sites have either a donation system or commercial lists of higher quality. Try to support them.
3. I have included the TOR network in these lists (`bm_tor`, `dm_tor`, `et_tor`). The TOR network is not necessarily bad and you should not block it if you want to allow your users be anonymous. I have included it because for certain cases, allowing an anonymity network might be a risky thing (such as eCommerce).
4. Apply any blacklist at the internet side of your firewall. Be very careful. The `bogons` and `fullbogons` lists contain private, unrouteable IPs that should not be routed on the internet. If you apply such a blocklist on your DMZ or LAN side, you will be blocked out of your firewall.
5. Always have a whitelist too, containing the IP addresses or subnets you trust. Try to build the rules in such a way that if an IP is in the whitelist, it should not be blocked by these blocklists.
## Which ones to use
### Level 1 - Basic
These are the ones I trust. **Level 1** provides basic security against the most well-known attackers, with the minimum of false positives.
1. **Abuse.ch** lists `feodo`, `palevo`, `sslbl`, `zeus`, `zeus_badips`
These folks are doing a great job tracking crime ware. Their blocklists are very focused.
Keep in mind `zeus` may include some false positives. You can use `zeus_badips` instead.
2. **DShield.org** list `dshield`
It contains the top 20 attacking class C (/24) subnets, over the last three days.
3. **Spamhaus.org** lists `spamhaus_drop`, `spamhaus_edrop`
DROP (Don't Route Or Peer) and EDROP are advisory "drop all traffic" lists, consisting of netblocks that are "hijacked" or leased by professional spam or cyber-crime operations (used for dissemination of malware, trojan downloaders, botnet controllers).
According to Spamhaus.org:
> When implemented at a network or ISP's 'core routers', DROP and EDROP will help protect the network's users from spamming, scanning, harvesting, DNS-hijacking and DDoS attacks originating on rogue netblocks.
>
> Spamhaus strongly encourages the use of DROP and EDROP by tier-1s and backbones.
Spamhaus is very responsive to adapt these lists when a network owner updates them that the issue has been solved (I had one such incident with one of my users).
4. **Team-Cymru.org** list `bogons` or `fullbogons`
These are lists of IPs that should not be routed on the internet. No one should be using them.
Be very careful to apply either of the two on the internet side of your network.
### Level 2 - Essentials
**Level 2** provide protection against current brute force attacks. This level may have a small percentage of false positives, mainly due to dynamic IPs being re-used by other users.
1. **OpenBL.org** lists `openbl*`
The team of OpenBL tracks brute force attacks on their hosts. They have a very short list for hosts, under their own control, collecting this information, to eliminate false positives.
They suggest to use the default blacklist which has a retention policy of 90 days (`openbl`), but they also provide lists with different retention policies (from 1 day to 1 year).
Their goal is to report abuse to the responsible provider so that the infection is disabled.
2. **Blocklist.de** lists `blocklist_de*`
Is a network of users reporting abuse mainly using `fail2ban`. They eliminate false positives using other lists available. Since they collect information from their users, their lists may be subject to poisoning, or false positives.
I asked them about poisoning. [Here](https://forum.blocklist.de/viewtopic.php?f=4&t=244&sid=847d00d26b0735add3518ff515242cad) you can find their answer. In short, they track it down so that they have an ignorable rate of false positives.
Also, they only include individual IPs (no subnets) which have attacked their users the last 48 hours and their list contains 20.000 to 40.000 IPs (which is small enough considering the size of the internet).
Like `openbl`, their goal is to report abuse back, so that the infection is disabled.
They also provide their blocklist per type of attack (mail, web, etc).
Of course, there are more lists included. You can check them and decide if they fit for your needs.
## Why are open proxy lists included
Of course, I haven't included them for you to use the open proxies. The port the proxy is listening, or the type of proxy, are not included (although most of them use the standard proxy ports and do serve web requests).
If you check the comparisons for the open proxy lists (`ri_connect_proxies`, `ri_web_proxies`, `xroxy`, `proxz`, `proxyrss`, etc)
you will find that they overlap to a great degree with other blocklists, like `blocklist_de`, `stopforumspam`, etc.
> This means the attackers also use open proxies to execute attacks.
So, if you are under attack, blocking the open proxies may help isolate a large part of the attack.
I don't suggest to permanently block IPs using the proxy lists. Their purpose of existence is questionable.
Their quality though may be acceptable, since lot of these sites advertise that they test open proxies before including them in their lists, so that there are no false positives, at least at the time they tested them.
---
## Using them in FireHOL
`update-ipsets.sh` itself does not alter your firewall. It can be used to update ipsets both on disk and in the kernel for any firewall solution you use.
The information below, shows you how to configure FireHOL to use the provides ipsets.
### Adding the ipsets in your firehol.conf
I use something like this:
```sh
# our wan interface
wan="dsl0"
# our whitelist
ipset4 create whitelist hash:net
ipset4 add whitelist A.B.C.D/E # A.B.C.D/E is whitelisted
# subnets - netsets
for x in fullbogons dshield spamhaus_drop spamhaus_edrop
do
ipset4 create ${x} hash:net
ipset4 addfile ${x} ipsets/${x}.netset
blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} \
except src ipset:whitelist
done
# individual IPs - ipsets
for x in feodo palevo sslbl zeus openbl blocklist_de
do
ipset4 create ${x} hash:ip
ipset4 addfile ${x} ipsets/${x}.ipset
blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} \
except src ipset:whitelist
done
... rest of firehol.conf ...
```
If you are concerned about iptables performance, change the `blacklist4` keyword `full` to `input`.
This will block only inbound NEW connections, i.e. only the first packet for every NEW inbound connection will be checked.
All other traffic passes through unchecked.
> Before adding these rules to your `firehol.conf` you should run `update-ipsets.sh` to enable them.
### Updating the ipsets while the firewall is running
Just use the `update-ipsets.sh` script from the firehol distribution.
This script will update each ipset and call firehol to update the ipset while the firewall is running.
> You can add `update-ipsets.sh` to cron, to run every 10 mins. `update-ipsets.sh` is smart enough to download
> a list only when it needs to.
---
# List of ipsets included

626
README.md Normal file
View File

@ -0,0 +1,626 @@
> Due to the amount of data and the frequency of the updates on this repo,
> github has requested to limit the number of updates.
> The site [https://iplists.firehol.org](https://iplists.firehol.org) has direct links
> to all the files in this repo. **This repo is now updated once per day.**
---
### Contents
- [About this repo](#about-this-repo)
- [Using these ipsets](#using-these-ipsets)
- [Which ones to use?](#which-ones-to-use)
- [Why are open proxy lists included](#why-are-open-proxy-lists-included)
- [Using them in FireHOL](#using-them-in-firehol)
* [Adding the ipsets in your firehol.conf](#adding-the-ipsets-in-your-fireholconf)
* [Updating the ipsets while the firewall is running](#updating-the-ipsets-while-the-firewall-is-running)
- [Dynamic List of ipsets included](#list-of-ipsets-included)
- [Comparison of ipsets](#comparison-of-ipsets)
---
# About this repo
This repository includes a list of ipsets dynamically updated with
[FireHOL](https://github.com/firehol/firehol)'s `update-ipsets.sh`
[documented in this wiki](https://github.com/firehol/blocklist-ipsets/wiki).
This repo is self maintained. It it updated automatically from the script via a cron job.
This repo has a site: [http://iplists.firehol.org](http://iplists.firehol.org).
## Why do we need blocklists?
As time passes and the internet matures in our life, cybercrime is becoming increasingly sophisticated.
Although there are many tools (detection of malware, viruses, intrusion detection and prevention systems,
etc) to help us isolate the bad guys, there are now a lot more than just such attacks.
What is more interesting is that the fraudsters or attackers in many cases are not going to do a direct
damage to you or your systems. They will use you and your systems to gain something else, possibly not
related or indirectly related to your business. Nowadays the attacks cannot be identified easily. They are
distributed and come to our systems from a vast amount of IPs around the world.
To get an idea, check for example the [XRumer](http://en.wikipedia.org/wiki/XRumer) software. This thing
mimics human behavior to post ads, it creates email accounts, responds to emails it receives, bypasses
captchas, it goes gently to stay unnoticed, etc.
To increase our effectiveness we need to complement our security solutions with our shared knowledge, our
shared experience in this fight.
Hopefully, there are many teams out there that do their best to identify the attacks and pinpoint the
attackers. These teams release blocklists. Blocklists of IPs (for use in firewalls), domains & URLs
(for use in proxies), etc.
What we are interested here is IPs.
Using IP blocklists at the internet side of your firewall is a key component of internet security. These
lists share key knowledge between us, allowing us to learn from each other and effectively isolate
fraudsters and attackers from our services.
I decided to upload these lists to a github repo because:
1. They are freely available on the internet. The intention of their creators is to help internet security.
Keep in mind though that a few of these lists may have special licences attached. Before using them, please check their source site for any information regarding proper use.
2. Github provides (via `git pull`) a unified way of updating all the lists together.
Pulling this repo regularly on your machines, you will update all the IP lists at once.
3. Github also provides a unified version control. Using it we can have a history of what each list has
done, which IPs or subnets were added and which were removed.
## DNSBLs
Check also another tool included in FireHOL v3+, called `dnsbl-ipset.sh`.
This tool is capable of creating an ipset based on your traffic by looking up information on DNSBLs and
scoring it according to your preferences.
More information [here](https://github.com/firehol/firehol/wiki/dnsbl-ipset.sh).
---
# Using these ipsets
Please be very careful what you choose to use and how you use it. If you blacklist traffic using these
lists you may end up blocking your users, your customers, even yourself (!) from accessing your services.
1. Go to to the site of each list and read how each list is maintained. You are going to trust these guys for doing their job right.
2. Most sites have either a donation system or commercial lists of higher quality. Try to support them.
3. I have included the TOR network in these lists (`bm_tor`, `dm_tor`, `et_tor`). The TOR network is not necessarily bad and you should not block it if you want to allow your users be anonymous. I have included it because for certain cases, allowing an anonymity network might be a risky thing (such as eCommerce).
4. Apply any blacklist at the internet side of your firewall. Be very careful. The `bogons` and `fullbogons` lists contain private, unrouteable IPs that should not be routed on the internet. If you apply such a blocklist on your DMZ or LAN side, you will be blocked out of your firewall.
5. Always have a whitelist too, containing the IP addresses or subnets you trust. Try to build the rules in such a way that if an IP is in the whitelist, it should not be blocked by these blocklists.
## Which ones to use
### Level 1 - Basic
These are the ones I trust. **Level 1** provides basic security against the most well-known attackers, with the minimum of false positives.
1. **Abuse.ch** lists `feodo`, `palevo`, `sslbl`, `zeus`, `zeus_badips`
These folks are doing a great job tracking crime ware. Their blocklists are very focused.
Keep in mind `zeus` may include some false positives. You can use `zeus_badips` instead.
2. **DShield.org** list `dshield`
It contains the top 20 attacking class C (/24) subnets, over the last three days.
3. **Spamhaus.org** lists `spamhaus_drop`, `spamhaus_edrop`
DROP (Don't Route Or Peer) and EDROP are advisory "drop all traffic" lists, consisting of netblocks that are "hijacked" or leased by professional spam or cyber-crime operations (used for dissemination of malware, trojan downloaders, botnet controllers).
According to Spamhaus.org:
> When implemented at a network or ISP's 'core routers', DROP and EDROP will help protect the network's users from spamming, scanning, harvesting, DNS-hijacking and DDoS attacks originating on rogue netblocks.
>
> Spamhaus strongly encourages the use of DROP and EDROP by tier-1s and backbones.
Spamhaus is very responsive to adapt these lists when a network owner updates them that the issue has been solved (I had one such incident with one of my users).
4. **Team-Cymru.org** list `bogons` or `fullbogons`
These are lists of IPs that should not be routed on the internet. No one should be using them.
Be very careful to apply either of the two on the internet side of your network.
### Level 2 - Essentials
**Level 2** provide protection against current brute force attacks. This level may have a small percentage of false positives, mainly due to dynamic IPs being re-used by other users.
1. **OpenBL.org** lists `openbl*`
The team of OpenBL tracks brute force attacks on their hosts. They have a very short list for hosts, under their own control, collecting this information, to eliminate false positives.
They suggest to use the default blacklist which has a retention policy of 90 days (`openbl`), but they also provide lists with different retention policies (from 1 day to 1 year).
Their goal is to report abuse to the responsible provider so that the infection is disabled.
2. **Blocklist.de** lists `blocklist_de*`
Is a network of users reporting abuse mainly using `fail2ban`. They eliminate false positives using other lists available. Since they collect information from their users, their lists may be subject to poisoning, or false positives.
I asked them about poisoning. [Here](https://forum.blocklist.de/viewtopic.php?f=4&t=244&sid=847d00d26b0735add3518ff515242cad) you can find their answer. In short, they track it down so that they have an ignorable rate of false positives.
Also, they only include individual IPs (no subnets) which have attacked their users the last 48 hours and their list contains 20.000 to 40.000 IPs (which is small enough considering the size of the internet).
Like `openbl`, their goal is to report abuse back, so that the infection is disabled.
They also provide their blocklist per type of attack (mail, web, etc).
Of course, there are more lists included. You can check them and decide if they fit for your needs.
## Why are open proxy lists included
Of course, I haven't included them for you to use the open proxies. The port the proxy is listening, or the type of proxy, are not included (although most of them use the standard proxy ports and do serve web requests).
If you check the comparisons for the open proxy lists (`ri_connect_proxies`, `ri_web_proxies`, `xroxy`, `proxz`, `proxyrss`, etc)
you will find that they overlap to a great degree with other blocklists, like `blocklist_de`, `stopforumspam`, etc.
> This means the attackers also use open proxies to execute attacks.
So, if you are under attack, blocking the open proxies may help isolate a large part of the attack.
I don't suggest to permanently block IPs using the proxy lists. Their purpose of existence is questionable.
Their quality though may be acceptable, since lot of these sites advertise that they test open proxies before including them in their lists, so that there are no false positives, at least at the time they tested them.
---
## Using them in FireHOL
`update-ipsets.sh` itself does not alter your firewall. It can be used to update ipsets both on disk and in the kernel for any firewall solution you use.
The information below, shows you how to configure FireHOL to use the provides ipsets.
### Adding the ipsets in your firehol.conf
I use something like this:
```sh
# our wan interface
wan="dsl0"
# our whitelist
ipset4 create whitelist hash:net
ipset4 add whitelist A.B.C.D/E # A.B.C.D/E is whitelisted
# subnets - netsets
for x in fullbogons dshield spamhaus_drop spamhaus_edrop
do
ipset4 create ${x} hash:net
ipset4 addfile ${x} ipsets/${x}.netset
blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} \
except src ipset:whitelist
done
# individual IPs - ipsets
for x in feodo palevo sslbl zeus openbl blocklist_de
do
ipset4 create ${x} hash:ip
ipset4 addfile ${x} ipsets/${x}.ipset
blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} \
except src ipset:whitelist
done
... rest of firehol.conf ...
```
If you are concerned about iptables performance, change the `blacklist4` keyword `full` to `input`.
This will block only inbound NEW connections, i.e. only the first packet for every NEW inbound connection will be checked.
All other traffic passes through unchecked.
> Before adding these rules to your `firehol.conf` you should run `update-ipsets.sh` to enable them.
### Updating the ipsets while the firewall is running
Just use the `update-ipsets.sh` script from the firehol distribution.
This script will update each ipset and call firehol to update the ipset while the firewall is running.
> You can add `update-ipsets.sh` to cron, to run every 10 mins. `update-ipsets.sh` is smart enough to download
> a list only when it needs to.
---
# List of ipsets included
The following list was automatically generated on Mon May 20 10:18:22 UTC 2024.
The update frequency is the maximum allowed by internal configuration. A list will never be downloaded sooner than the update frequency stated. A list may also not be downloaded, after this frequency expired, if it has not been modified on the server (as reported by HTTP `IF_MODIFIED_SINCE` method).
name|info|type|entries|update|
:--:|:--:|:--:|:-----:|:----:|
[alienvault_reputation](http://iplists.firehol.org/?ipset=alienvault_reputation)|[AlienVault.com](https://www.alienvault.com/) IP reputation database|ipv4 hash:ip|609 unique IPs|updated every 6 hours from [this link](https://reputation.alienvault.com/reputation.generic)
[asprox_c2](http://iplists.firehol.org/?ipset=asprox_c2)|[h3x.eu](http://atrack.h3x.eu/) ASPROX Tracker - Asprox C&C Sites|ipv4 hash:ip|0 unique IPs|updated every 1 day from [this link](http://atrack.h3x.eu/c2)
[bambenek_banjori](http://iplists.firehol.org/?ipset=bambenek_banjori)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of banjori C&Cs with 90 minute lookback|ipv4 hash:ip|136 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/banjori-iplist.txt)
[bambenek_bebloh](http://iplists.firehol.org/?ipset=bambenek_bebloh)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of bebloh C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/bebloh-iplist.txt)
[bambenek_c2](http://iplists.firehol.org/?ipset=bambenek_c2)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) master feed of known, active and non-sinkholed C&Cs IP addresses|ipv4 hash:ip|1 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/c2-ipmasterlist.txt)
[bambenek_cl](http://iplists.firehol.org/?ipset=bambenek_cl)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of cl C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/cl-iplist.txt)
[bambenek_cryptowall](http://iplists.firehol.org/?ipset=bambenek_cryptowall)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of cryptowall C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/cryptowall-iplist.txt)
[bambenek_dircrypt](http://iplists.firehol.org/?ipset=bambenek_dircrypt)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of dircrypt C&Cs with 90 minute lookback|ipv4 hash:ip|2 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/dircrypt-iplist.txt)
[bambenek_dyre](http://iplists.firehol.org/?ipset=bambenek_dyre)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of dyre C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/dyre-iplist.txt)
[bambenek_geodo](http://iplists.firehol.org/?ipset=bambenek_geodo)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of geodo C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/geodo-iplist.txt)
[bambenek_hesperbot](http://iplists.firehol.org/?ipset=bambenek_hesperbot)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of hesperbot C&Cs with 90 minute lookback|ipv4 hash:ip|2 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/hesperbot-iplist.txt)
[bambenek_matsnu](http://iplists.firehol.org/?ipset=bambenek_matsnu)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of matsnu C&Cs with 90 minute lookback|ipv4 hash:ip|1 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/matsnu-iplist.txt)
[bambenek_necurs](http://iplists.firehol.org/?ipset=bambenek_necurs)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of necurs C&Cs with 90 minute lookback|ipv4 hash:ip|13 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/necurs-iplist.txt)
[bambenek_p2pgoz](http://iplists.firehol.org/?ipset=bambenek_p2pgoz)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of p2pgoz C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/p2pgoz-iplist.txt)
[bambenek_pushdo](http://iplists.firehol.org/?ipset=bambenek_pushdo)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of pushdo C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/pushdo-iplist.txt)
[bambenek_pykspa](http://iplists.firehol.org/?ipset=bambenek_pykspa)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of pykspa C&Cs with 90 minute lookback|ipv4 hash:ip|5 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/pykspa-iplist.txt)
[bambenek_qakbot](http://iplists.firehol.org/?ipset=bambenek_qakbot)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of qakbot C&Cs with 90 minute lookback|ipv4 hash:ip|2 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/qakbot-iplist.txt)
[bambenek_ramnit](http://iplists.firehol.org/?ipset=bambenek_ramnit)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of ramnit C&Cs with 90 minute lookback|ipv4 hash:ip|98 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/ramnit-iplist.txt)
[bambenek_ranbyus](http://iplists.firehol.org/?ipset=bambenek_ranbyus)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of ranbyus C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/ranbyus-iplist.txt)
[bambenek_simda](http://iplists.firehol.org/?ipset=bambenek_simda)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of simda C&Cs with 90 minute lookback|ipv4 hash:ip|131 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/simda-iplist.txt)
[bambenek_suppobox](http://iplists.firehol.org/?ipset=bambenek_suppobox)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of suppobox C&Cs with 90 minute lookback|ipv4 hash:ip|108 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/suppobox-iplist.txt)
[bambenek_symmi](http://iplists.firehol.org/?ipset=bambenek_symmi)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of symmi C&Cs with 90 minute lookback|ipv4 hash:ip|1 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/symmi-iplist.txt)
[bambenek_tinba](http://iplists.firehol.org/?ipset=bambenek_tinba)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of tinba C&Cs with 90 minute lookback|ipv4 hash:ip|4 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/tinba-iplist.txt)
[bambenek_volatile](http://iplists.firehol.org/?ipset=bambenek_volatile)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of volatile C&Cs with 90 minute lookback|ipv4 hash:ip|1 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/volatile-iplist.txt)
[bbcan177_ms1](http://iplists.firehol.org/?ipset=bbcan177_ms1)|pfBlockerNG Malicious Threats|ipv4 hash:net|2688 subnets, 5269973 unique IPs|updated every 1 day from [this link](https://gist.githubusercontent.com/BBcan177/bf29d47ea04391cb3eb0/raw)
[bbcan177_ms3](http://iplists.firehol.org/?ipset=bbcan177_ms3)|pfBlockerNG Malicious Threats|ipv4 hash:net|1146 subnets, 30151694 unique IPs|updated every 1 day from [this link](https://gist.githubusercontent.com/BBcan177/d7105c242f17f4498f81/raw)
[bds_atif](http://iplists.firehol.org/?ipset=bds_atif)|Artillery Threat Intelligence Feed and Banlist Feed|ipv4 hash:ip|622 unique IPs|updated every 1 day from [this link](https://www.binarydefense.com/banlist.txt)
[bitcoin_blockchain_info_1d](http://iplists.firehol.org/?ipset=bitcoin_blockchain_info_1d)|[Blockchain.info](https://blockchain.info/en/connected-nodes) Bitcoin nodes connected to Blockchain.info.|ipv4 hash:ip|988 unique IPs|updated every 10 mins from [this link](https://blockchain.info/en/connected-nodes)
[bitcoin_blockchain_info_30d](http://iplists.firehol.org/?ipset=bitcoin_blockchain_info_30d)|[Blockchain.info](https://blockchain.info/en/connected-nodes) Bitcoin nodes connected to Blockchain.info.|ipv4 hash:ip|8196 unique IPs|updated every 10 mins from [this link](https://blockchain.info/en/connected-nodes)
[bitcoin_blockchain_info_7d](http://iplists.firehol.org/?ipset=bitcoin_blockchain_info_7d)|[Blockchain.info](https://blockchain.info/en/connected-nodes) Bitcoin nodes connected to Blockchain.info.|ipv4 hash:ip|2636 unique IPs|updated every 10 mins from [this link](https://blockchain.info/en/connected-nodes)
[bitcoin_nodes](http://iplists.firehol.org/?ipset=bitcoin_nodes)|[BitNodes](https://getaddr.bitnodes.io/) Bitcoin connected nodes, globally.|ipv4 hash:ip|5748 unique IPs|updated every 10 mins from [this link](https://getaddr.bitnodes.io/api/v1/snapshots/latest/)
[bitcoin_nodes_1d](http://iplists.firehol.org/?ipset=bitcoin_nodes_1d)|[BitNodes](https://getaddr.bitnodes.io/) Bitcoin connected nodes, globally.|ipv4 hash:ip|6959 unique IPs|updated every 10 mins from [this link](https://getaddr.bitnodes.io/api/v1/snapshots/latest/)
[bitcoin_nodes_30d](http://iplists.firehol.org/?ipset=bitcoin_nodes_30d)|[BitNodes](https://getaddr.bitnodes.io/) Bitcoin connected nodes, globally.|ipv4 hash:ip|13897 unique IPs|updated every 10 mins from [this link](https://getaddr.bitnodes.io/api/v1/snapshots/latest/)
[bitcoin_nodes_7d](http://iplists.firehol.org/?ipset=bitcoin_nodes_7d)|[BitNodes](https://getaddr.bitnodes.io/) Bitcoin connected nodes, globally.|ipv4 hash:ip|8748 unique IPs|updated every 10 mins from [this link](https://getaddr.bitnodes.io/api/v1/snapshots/latest/)
[blocklist_de](http://iplists.firehol.org/?ipset=blocklist_de)|[Blocklist.de](https://www.blocklist.de/) IPs that have been detected by fail2ban in the last 48 hours|ipv4 hash:ip|24610 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/all.txt)
[blocklist_de_apache](http://iplists.firehol.org/?ipset=blocklist_de_apache)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours as having run attacks on the service Apache, Apache-DDOS, RFI-Attacks.|ipv4 hash:ip|8974 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/apache.txt)
[blocklist_de_bots](http://iplists.firehol.org/?ipset=blocklist_de_bots)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours as having run attacks on the RFI-Attacks, REG-Bots, IRC-Bots or BadBots (BadBots = it has posted a Spam-Comment on a open Forum or Wiki).|ipv4 hash:ip|119 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/bots.txt)
[blocklist_de_bruteforce](http://iplists.firehol.org/?ipset=blocklist_de_bruteforce)|[Blocklist.de](https://www.blocklist.de/) All IPs which attacks Joomla, Wordpress and other Web-Logins with Brute-Force Logins.|ipv4 hash:ip|909 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/bruteforcelogin.txt)
[blocklist_de_ftp](http://iplists.firehol.org/?ipset=blocklist_de_ftp)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours for attacks on the Service FTP.|ipv4 hash:ip|36 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/ftp.txt)
[blocklist_de_imap](http://iplists.firehol.org/?ipset=blocklist_de_imap)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours for attacks on the Service imap, sasl, pop3, etc.|ipv4 hash:ip|2160 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/imap.txt)
[blocklist_de_mail](http://iplists.firehol.org/?ipset=blocklist_de_mail)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours as having run attacks on the service Mail, Postfix.|ipv4 hash:ip|13962 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/mail.txt)
[blocklist_de_sip](http://iplists.firehol.org/?ipset=blocklist_de_sip)|[Blocklist.de](https://www.blocklist.de/) All IP addresses that tried to login in a SIP, VOIP or Asterisk Server and are included in the IPs list from infiltrated.net|ipv4 hash:ip|43 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/sip.txt)
[blocklist_de_ssh](http://iplists.firehol.org/?ipset=blocklist_de_ssh)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours as having run attacks on the service SSH.|ipv4 hash:ip|9438 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/ssh.txt)
[blocklist_de_strongips](http://iplists.firehol.org/?ipset=blocklist_de_strongips)|[Blocklist.de](https://www.blocklist.de/) All IPs which are older then 2 month and have more then 5.000 attacks.|ipv4 hash:ip|321 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/strongips.txt)
[blocklist_net_ua](http://iplists.firehol.org/?ipset=blocklist_net_ua)|[blocklist.net.ua](https://blocklist.net.ua) The BlockList project was created to become protection against negative influence of the harmful and potentially dangerous events on the Internet. First of all this service will help internet and hosting providers to protect subscribers sites from being hacked. BlockList will help to stop receiving a large amount of spam from dubious SMTP relays or from attempts of brute force passwords to servers and network equipment.|ipv4 hash:ip|78557 unique IPs|updated every 10 mins from [this link](https://blocklist.net.ua/blocklist.csv)
[blueliv_crimeserver_last](http://iplists.firehol.org/?ipset=blueliv_crimeserver_last)|[blueliv.com](https://www.blueliv.com/) Last 6 hours Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|24381 unique IPs|updated every 6 hours
[blueliv_crimeserver_last_1d](http://iplists.firehol.org/?ipset=blueliv_crimeserver_last_1d)|[blueliv.com](https://www.blueliv.com/) Last 6 hours Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|58312 unique IPs|updated every 6 hours
[blueliv_crimeserver_last_2d](http://iplists.firehol.org/?ipset=blueliv_crimeserver_last_2d)|[blueliv.com](https://www.blueliv.com/) Last 6 hours Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|71293 unique IPs|updated every 6 hours
[blueliv_crimeserver_last_30d](http://iplists.firehol.org/?ipset=blueliv_crimeserver_last_30d)|[blueliv.com](https://www.blueliv.com/) Last 6 hours Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|87551 unique IPs|updated every 6 hours
[blueliv_crimeserver_last_7d](http://iplists.firehol.org/?ipset=blueliv_crimeserver_last_7d)|[blueliv.com](https://www.blueliv.com/) Last 6 hours Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|77098 unique IPs|updated every 6 hours
[blueliv_crimeserver_online](http://iplists.firehol.org/?ipset=blueliv_crimeserver_online)|[blueliv.com](https://www.blueliv.com/) Online Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|15628 unique IPs|updated every 1 day
[blueliv_crimeserver_recent](http://iplists.firehol.org/?ipset=blueliv_crimeserver_recent)|[blueliv.com](https://www.blueliv.com/) Recent Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|64076 unique IPs|updated every 1 day
bm_tor|[torstatus.blutmagie.de](https://torstatus.blutmagie.de) list of all TOR network servers|ipv4 hash:ip|disabled|updated every 30 mins from [this link](https://torstatus.blutmagie.de/ip_list_all.php/Tor_ip_list_ALL.csv)
[bogons](http://iplists.firehol.org/?ipset=bogons)|[Team-Cymru.org](http://www.team-cymru.org) private and reserved addresses defined by RFC 1918, RFC 5735, and RFC 6598 and netblocks that have not been allocated to a regional internet registry|ipv4 hash:net|13 subnets, 592708608 unique IPs|updated every 1 day
[botscout](http://iplists.firehol.org/?ipset=botscout)|[BotScout](http://botscout.com/) helps prevent automated web scripts, known as bots, from registering on forums, polluting databases, spreading spam, and abusing forms on web sites. They do this by tracking the names, IPs, and email addresses that bots use and logging them as unique signatures for future reference. They also provide a simple yet powerful API that you can use to test forms when they're submitted on your site. This list is composed of the most recently-caught bots.|ipv4 hash:ip|54 unique IPs|updated every 30 mins from [this link](http://botscout.com/last_caught_cache.htm)
[botscout_1d](http://iplists.firehol.org/?ipset=botscout_1d)|[BotScout](http://botscout.com/) helps prevent automated web scripts, known as bots, from registering on forums, polluting databases, spreading spam, and abusing forms on web sites. They do this by tracking the names, IPs, and email addresses that bots use and logging them as unique signatures for future reference. They also provide a simple yet powerful API that you can use to test forms when they're submitted on your site. This list is composed of the most recently-caught bots.|ipv4 hash:ip|957 unique IPs|updated every 30 mins from [this link](http://botscout.com/last_caught_cache.htm)
[botscout_30d](http://iplists.firehol.org/?ipset=botscout_30d)|[BotScout](http://botscout.com/) helps prevent automated web scripts, known as bots, from registering on forums, polluting databases, spreading spam, and abusing forms on web sites. They do this by tracking the names, IPs, and email addresses that bots use and logging them as unique signatures for future reference. They also provide a simple yet powerful API that you can use to test forms when they're submitted on your site. This list is composed of the most recently-caught bots.|ipv4 hash:ip|14957 unique IPs|updated every 30 mins from [this link](http://botscout.com/last_caught_cache.htm)
[botscout_7d](http://iplists.firehol.org/?ipset=botscout_7d)|[BotScout](http://botscout.com/) helps prevent automated web scripts, known as bots, from registering on forums, polluting databases, spreading spam, and abusing forms on web sites. They do this by tracking the names, IPs, and email addresses that bots use and logging them as unique signatures for future reference. They also provide a simple yet powerful API that you can use to test forms when they're submitted on your site. This list is composed of the most recently-caught bots.|ipv4 hash:ip|5056 unique IPs|updated every 30 mins from [this link](http://botscout.com/last_caught_cache.htm)
[botvrij_dst](http://iplists.firehol.org/?ipset=botvrij_dst)|[botvrij.eu](http://www.botvrij.eu/) Indicators of Compromise (IOCS) about malicious destination IPs, gathered via open source information feeds (blog pages and PDF documents) and then consolidated into different datasets. To ensure the quality of the data all entries older than approx. 6 months are removed.|ipv4 hash:ip|215 unique IPs|updated every 1 day from [this link](http://www.botvrij.eu/data/ioclist.ip-dst.raw)
[botvrij_src](http://iplists.firehol.org/?ipset=botvrij_src)|[botvrij.eu](http://www.botvrij.eu/) Indicators of Compromise (IOCS) about malicious source IPs, gathered via open source information feeds (blog pages and PDF documents) and then consolidated into different datasets. To ensure the quality of the data all entries older than approx. 6 months are removed.|ipv4 hash:ip|0 unique IPs|updated every 1 day from [this link](http://www.botvrij.eu/data/ioclist.ip-src.raw)
[bruteforceblocker](http://iplists.firehol.org/?ipset=bruteforceblocker)|[danger.rulez.sk bruteforceblocker](http://danger.rulez.sk/index.php/bruteforceblocker/) (fail2ban alternative for SSH on OpenBSD). This is an automatically generated list from users reporting failed authentication attempts. An IP seems to be included if 3 or more users report it. Its retention pocily seems 30 days.|ipv4 hash:ip|311 unique IPs|updated every 3 hours from [this link](http://danger.rulez.sk/projects/bruteforceblocker/blist.php)
[ciarmy](http://iplists.firehol.org/?ipset=ciarmy)|[CIArmy.com](http://ciarmy.com/) IPs with poor Rogue Packet score that have not yet been identified as malicious by the community|ipv4 hash:ip|15000 unique IPs|updated every 3 hours from [this link](http://cinsscore.com/list/ci-badguys.txt)
[cidr_report_bogons](http://iplists.firehol.org/?ipset=cidr_report_bogons)|Unallocated (Free) Address Space, generated on a daily basis using the IANA registry files, the Regional Internet Registry stats files and the Regional Internet Registry whois data.|ipv4 hash:net|9143 subnets, 602773696 unique IPs|updated every 1 day from [this link](http://www.cidr-report.org/bogons/freespace-prefix.txt)
[cleanmx_phishing](http://iplists.firehol.org/?ipset=cleanmx_phishing)|[Clean-MX.de](http://support.clean-mx.de/) IPs sending phishing messages|ipv4 hash:ip|4519 unique IPs|updated every 30 mins from [this link](http://support.clean-mx.de/clean-mx/xmlphishing?response=alive&format=csv&domain=)
[cleanmx_viruses](http://iplists.firehol.org/?ipset=cleanmx_viruses)|[Clean-MX.de](http://support.clean-mx.de/clean-mx/viruses.php) IPs with viruses|ipv4 hash:ip|12190 unique IPs|updated every 30 mins from [this link](http://support.clean-mx.de/clean-mx/xmlviruses.php?response=alive&fields=ip)
[cleantalk](http://iplists.firehol.org/?ipset=cleantalk)|[CleanTalk](https://cleantalk.org/) Today's HTTP Spammers (includes: cleantalk_new cleantalk_updated)|ipv4 hash:ip|491 unique IPs|updated every 1 min
[cleantalk_1d](http://iplists.firehol.org/?ipset=cleantalk_1d)|[CleanTalk](https://cleantalk.org/) Today's HTTP Spammers (includes: cleantalk_new_1d cleantalk_updated_1d)|ipv4 hash:ip|1598 unique IPs|updated every 1 min
[cleantalk_30d](http://iplists.firehol.org/?ipset=cleantalk_30d)|[CleanTalk](https://cleantalk.org/) Today's HTTP Spammers (includes: cleantalk_new_30d cleantalk_updated_30d)|ipv4 hash:ip|47761 unique IPs|updated every 1 min
[cleantalk_7d](http://iplists.firehol.org/?ipset=cleantalk_7d)|[CleanTalk](https://cleantalk.org/) Today's HTTP Spammers (includes: cleantalk_new_7d cleantalk_updated_7d)|ipv4 hash:ip|10599 unique IPs|updated every 1 min
[cleantalk_new](http://iplists.firehol.org/?ipset=cleantalk_new)|[CleanTalk](https://cleantalk.org/) Recent HTTP Spammers|ipv4 hash:ip|250 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/submited_today)
[cleantalk_new_1d](http://iplists.firehol.org/?ipset=cleantalk_new_1d)|[CleanTalk](https://cleantalk.org/) Recent HTTP Spammers|ipv4 hash:ip|766 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/submited_today)
[cleantalk_new_30d](http://iplists.firehol.org/?ipset=cleantalk_new_30d)|[CleanTalk](https://cleantalk.org/) Recent HTTP Spammers|ipv4 hash:ip|16217 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/submited_today)
[cleantalk_new_7d](http://iplists.firehol.org/?ipset=cleantalk_new_7d)|[CleanTalk](https://cleantalk.org/) Recent HTTP Spammers|ipv4 hash:ip|4702 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/submited_today)
[cleantalk_top20](http://iplists.firehol.org/?ipset=cleantalk_top20)|[CleanTalk](https://cleantalk.org/) Top 20 HTTP Spammers|ipv4 hash:ip|20 unique IPs|updated every 1 day from [this link](https://cleantalk.org/blacklists/top20)
[cleantalk_updated](http://iplists.firehol.org/?ipset=cleantalk_updated)|[CleanTalk](https://cleantalk.org/) Recurring HTTP Spammers|ipv4 hash:ip|250 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/updated_today)
[cleantalk_updated_1d](http://iplists.firehol.org/?ipset=cleantalk_updated_1d)|[CleanTalk](https://cleantalk.org/) Recurring HTTP Spammers|ipv4 hash:ip|907 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/updated_today)
[cleantalk_updated_30d](http://iplists.firehol.org/?ipset=cleantalk_updated_30d)|[CleanTalk](https://cleantalk.org/) Recurring HTTP Spammers|ipv4 hash:ip|39836 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/updated_today)
[cleantalk_updated_7d](http://iplists.firehol.org/?ipset=cleantalk_updated_7d)|[CleanTalk](https://cleantalk.org/) Recurring HTTP Spammers|ipv4 hash:ip|6773 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/updated_today)
[coinbl_hosts](http://iplists.firehol.org/?ipset=coinbl_hosts)|[CoinBlockerLists](https://gitlab.com/ZeroDot1/CoinBlockerLists) Simple lists that can help prevent cryptomining in the browser or other applications. This list contains all domains - A list for administrators to prevent mining in networks. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|10429 unique IPs|updated every 1 day from [this link](https://zerodot1.gitlab.io/CoinBlockerLists/hosts)
[coinbl_hosts_browser](http://iplists.firehol.org/?ipset=coinbl_hosts_browser)|[CoinBlockerLists](https://gitlab.com/ZeroDot1/CoinBlockerLists) Simple lists that can help prevent cryptomining in the browser or other applications. A hosts list to prevent browser mining only. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|627 unique IPs|updated every 1 day from [this link](https://zerodot1.gitlab.io/CoinBlockerLists/hosts_browser)
[coinbl_hosts_optional](http://iplists.firehol.org/?ipset=coinbl_hosts_optional)|[CoinBlockerLists](https://gitlab.com/ZeroDot1/CoinBlockerLists) Simple lists that can help prevent cryptomining in the browser or other applications. This list contains additional domains, for administrators to prevent mining in networks. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|471 unique IPs|updated every 1 day from [this link](https://zerodot1.gitlab.io/CoinBlockerLists/hosts_optional)
[coinbl_ips](http://iplists.firehol.org/?ipset=coinbl_ips)|[CoinBlockerLists](https://gitlab.com/ZeroDot1/CoinBlockerLists) Simple lists that can help prevent cryptomining in the browser or other applications. This list contains all IPs - An additional list for administrators to prevent mining in networks. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|1390 unique IPs|updated every 1 day from [this link](https://zerodot1.gitlab.io/CoinBlockerLists/MiningServerIPList.txt)
[cruzit_web_attacks](http://iplists.firehol.org/?ipset=cruzit_web_attacks)|[CruzIt.com](http://www.cruzit.com/wbl.php) IPs of compromised machines scanning for vulnerabilities and DDOS attacks|ipv4 hash:ip|13878 unique IPs|updated every 12 hours from [this link](http://www.cruzit.com/xwbl2txt.php)
[cta_cryptowall](http://iplists.firehol.org/?ipset=cta_cryptowall)|[Cyber Threat Alliance](http://www.cyberthreatalliance.org/cryptowall-dashboard.html) CryptoWall is one of the most lucrative and broad-reaching ransomware campaigns affecting Internet users today. Sharing intelligence and analysis resources, the CTA profiled the latest version of CryptoWall, which impacted hundreds of thousands of users, resulting in over US $325 million in damages worldwide.|ipv4 hash:ip|1360 unique IPs|updated every 1 day from [this link](https://public.tableau.com/views/CTAOnlineViz/DashboardData.csv?:embed=y&:showVizHome=no&:showTabs=y&:display_count=y&:display_static_image=y&:bootstrapWhenNotified=true)
[cybercrime](http://iplists.firehol.org/?ipset=cybercrime)|[CyberCrime](http://cybercrime-tracker.net/) A project tracking Command and Control.|ipv4 hash:ip|1450 unique IPs|updated every 12 hours from [this link](http://cybercrime-tracker.net/fuckerz.php)
[darklist_de](http://iplists.firehol.org/?ipset=darklist_de)|[darklist.de](http://www.darklist.de/) ssh fail2ban reporting|ipv4 hash:net|6008 subnets, 274857 unique IPs|updated every 1 day from [this link](http://www.darklist.de/raw.php)
[datacenters](http://iplists.firehol.org/?ipset=datacenters)|[Nick Galbreath](https://github.com/client9/ipcat) This is a list of IPv4 address that correspond to datacenters, co-location centers, shared and virtual webhosting providers. In other words, ip addresses that end web consumers should not be using.|ipv4 hash:net|4224 subnets, 95959476 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/client9/ipcat/master/datacenters.csv)
[dataplane_dnsrd](http://iplists.firehol.org/?ipset=dataplane_dnsrd)|[DataPlane.org](https://dataplane.org/) IP addresses that have been identified as sending recursive DNS queries to a remote host. This report lists addresses that may be cataloging open DNS resolvers or evaluating cache entries.|ipv4 hash:ip|3852 unique IPs|updated every 1 hour
[dataplane_dnsrdany](http://iplists.firehol.org/?ipset=dataplane_dnsrdany)|[DataPlane.org](https://dataplane.org/) IP addresses that have been identified as sending recursive DNS IN ANY queries to a remote host. This report lists addresses that may be cataloging open DNS resolvers for the purpose of later using them to facilitate DNS amplification and reflection attacks.|ipv4 hash:ip|77 unique IPs|updated every 1 hour
[dataplane_dnsversion](http://iplists.firehol.org/?ipset=dataplane_dnsversion)|[DataPlane.org](https://dataplane.org/) IP addresses that have been identified as sending DNS CH TXT VERSION.BIND queries to a remote host. This report lists addresses that may be cataloging DNS software.|ipv4 hash:ip|3530 unique IPs|updated every 1 hour
[dataplane_sipinvitation](http://iplists.firehol.org/?ipset=dataplane_sipinvitation)|[DataPlane.org](https://dataplane.org/) IP addresses that have been seen initiating a SIP INVITE operation to a remote host. This report lists hosts that are suspicious of more than just port scanning. These hosts may be SIP client cataloging or conducting various forms of telephony abuse.|ipv4 hash:ip|19 unique IPs|updated every 1 hour
[dataplane_sipquery](http://iplists.firehol.org/?ipset=dataplane_sipquery)|[DataPlane.org](https://dataplane.org/) IP addresses that has been seen initiating a SIP OPTIONS query to a remote host. This report lists hosts that are suspicious of more than just port scanning. These hosts may be SIP server cataloging or conducting various forms of telephony abuse.|ipv4 hash:ip|2562 unique IPs|updated every 1 hour
[dataplane_sipregistration](http://iplists.firehol.org/?ipset=dataplane_sipregistration)|[DataPlane.org](https://dataplane.org/) IP addresses that have been seen initiating a SIP REGISTER operation to a remote host. This report lists hosts that are suspicious of more than just port scanning. These hosts may be SIP client cataloging or conducting various forms of telephony abuse.|ipv4 hash:ip|52 unique IPs|updated every 1 hour
[dataplane_sshclient](http://iplists.firehol.org/?ipset=dataplane_sshclient)|[DataPlane.org](https://dataplane.org/) IP addresses that has been seen initiating an SSH connection to a remote host. This report lists hosts that are suspicious of more than just port scanning. These hosts may be SSH server cataloging or conducting authentication attack attempts.|ipv4 hash:ip|22411 unique IPs|updated every 1 hour
[dataplane_sshpwauth](http://iplists.firehol.org/?ipset=dataplane_sshpwauth)|[DataPlane.org](https://dataplane.org/) IP addresses that has been seen attempting to remotely login to a host using SSH password authentication. This report lists hosts that are highly suspicious and are likely conducting malicious SSH password authentication attacks.|ipv4 hash:ip|16575 unique IPs|updated every 1 hour
[dataplane_vncrfb](http://iplists.firehol.org/?ipset=dataplane_vncrfb)|[DataPlane.org](https://dataplane.org/) IP addresses that have been seen initiating a VNC remote frame buffer (RFB) session to a remote host. This report lists hosts that are suspicious of more than just port scanning. These hosts may be VNC server cataloging or conducting various forms of remote access abuse.|ipv4 hash:ip|2498 unique IPs|updated every 1 hour
[dm_tor](http://iplists.firehol.org/?ipset=dm_tor)|[dan.me.uk](https://www.dan.me.uk) dynamic list of TOR nodes|ipv4 hash:ip|5460 unique IPs|updated every 30 mins from [this link](https://www.dan.me.uk/torlist/)
[dronebl_anonymizers](http://iplists.firehol.org/?ipset=dronebl_anonymizers)|[DroneBL.org](https://dronebl.org) List of open proxies. It includes IPs which DroneBL categorizes as SOCKS proxies (8), HTTP proxies (9), web page proxies (11), WinGate proxies (14), proxy chains (10).|ipv4 hash:net|1120391 subnets, 1210923 unique IPs|updated every 1 min
[dronebl_auto_botnets](http://iplists.firehol.org/?ipset=dronebl_auto_botnets)|[DroneBL.org](https://dronebl.org) IPs of automatically detected botnets. It includes IPs for which DroneBL responds with 17.|ipv4 hash:net|3992 subnets, 4007 unique IPs|updated every 1 min
[dronebl_autorooting_worms](http://iplists.firehol.org/?ipset=dronebl_autorooting_worms)|[DroneBL.org](https://dronebl.org) IPs of autorooting worms. It includes IPs for which DroneBL responds with 16. These are usually SSH bruteforce attacks.|ipv4 hash:net|36 subnets, 36 unique IPs|updated every 1 min
[dronebl_compromised](http://iplists.firehol.org/?ipset=dronebl_compromised)|[DroneBL.org](https://dronebl.org) IPs of compromised routers / gateways. It includes IPs for which DroneBL responds with 15 (BOPM detected).|ipv4 hash:net|44323 subnets, 45785 unique IPs|updated every 1 min
[dronebl_ddos_drones](http://iplists.firehol.org/?ipset=dronebl_ddos_drones)|[DroneBL.org](https://dronebl.org) IPs of DDoS drones. It includes IPs for which DroneBL responds with 7.|ipv4 hash:net|7667 subnets, 7826 unique IPs|updated every 1 min
[dronebl_dns_mx_on_irc](http://iplists.firehol.org/?ipset=dronebl_dns_mx_on_irc)|[DroneBL.org](https://dronebl.org) List of IPs of DNS / MX hostname detected on IRC. It includes IPs for which DroneBL responds with 18.|ipv4 hash:net|18 subnets, 18 unique IPs|updated every 1 min
[dronebl_irc_drones](http://iplists.firehol.org/?ipset=dronebl_irc_drones)|[DroneBL.org](https://dronebl.org) List of IRC spam drones (litmus/sdbot/fyle). It includes IPs for which DroneBL responds with 3.|ipv4 hash:net|814033 subnets, 983595 unique IPs|updated every 1 min
[dronebl_unknown](http://iplists.firehol.org/?ipset=dronebl_unknown)|[DroneBL.org](https://dronebl.org) List of IPs of uncategorized threats. It includes IPs for which DroneBL responds with 255.|ipv4 hash:net|152 subnets, 152 unique IPs|updated every 1 min
[dronebl_worms_bots](http://iplists.firehol.org/?ipset=dronebl_worms_bots)|[DroneBL.org](https://dronebl.org) IPs of unknown worms or spambots. It includes IPs for which DroneBL responds with 6|ipv4 hash:net|164766 subnets, 174614 unique IPs|updated every 1 min
[dshield](http://iplists.firehol.org/?ipset=dshield)|[DShield.org](https://dshield.org/) top 20 attacking class C (/24) subnets over the last three days|ipv4 hash:net|19 subnets, 5120 unique IPs|updated every 10 mins from [this link](http://feeds.dshield.org/block.txt)
[dshield_1d](http://iplists.firehol.org/?ipset=dshield_1d)|[DShield.org](https://dshield.org/) top 20 attacking class C (/24) subnets over the last three days|ipv4 hash:net|21 subnets, 5632 unique IPs|updated every 10 mins from [this link](http://feeds.dshield.org/block.txt)
[dshield_30d](http://iplists.firehol.org/?ipset=dshield_30d)|[DShield.org](https://dshield.org/) top 20 attacking class C (/24) subnets over the last three days|ipv4 hash:net|42 subnets, 11776 unique IPs|updated every 10 mins from [this link](http://feeds.dshield.org/block.txt)
[dshield_7d](http://iplists.firehol.org/?ipset=dshield_7d)|[DShield.org](https://dshield.org/) top 20 attacking class C (/24) subnets over the last three days|ipv4 hash:net|29 subnets, 7936 unique IPs|updated every 10 mins from [this link](http://feeds.dshield.org/block.txt)
[dshield_top_1000](http://iplists.firehol.org/?ipset=dshield_top_1000)|[DShield.org](https://dshield.org/) top 1000 attacking hosts in the last 30 days|ipv4 hash:ip|1000 unique IPs|updated every 1 hour from [this link](https://isc.sans.edu/api/sources/attacks/1000/)
[dyndns_ponmocup](http://iplists.firehol.org/?ipset=dyndns_ponmocup)|[DynDNS.org](http://security-research.dyndns.org/pub/malware-feeds/) Ponmocup. The malware powering the botnet has been around since 2006 and it’s known under various names, including Ponmocup, Vundo, Virtumonde, Milicenso and Swisyn. It has been used for ad fraud, data theft and downloading additional threats to infected systems. Ponmocup is one of the largest currently active and, with nine consecutive years, also one of the longest running, but it is rarely noticed as the operators take care to keep it operating under the radar.|ipv4 hash:ip|35 unique IPs|updated every 1 day from [this link](http://security-research.dyndns.org/pub/malware-feeds/ponmocup-infected-domains-shadowserver.csv)
[esentire_14072015_com](http://iplists.firehol.org/?ipset=esentire_14072015_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|579 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/14072015.com_watch_ip.lst)
[esentire_14072015q_com](http://iplists.firehol.org/?ipset=esentire_14072015q_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|575 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/14072015q.com_watch_ip.lst)
[esentire_22072014a_com](http://iplists.firehol.org/?ipset=esentire_22072014a_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|1290 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/22072014a.com_watch_ip.lst)
[esentire_22072014b_com](http://iplists.firehol.org/?ipset=esentire_22072014b_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|1288 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/22072014b.com_watch_ip.lst)
[esentire_22072014c_com](http://iplists.firehol.org/?ipset=esentire_22072014c_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|1289 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/22072014c.com_watch_ip.lst)
[esentire_atomictrivia_ru](http://iplists.firehol.org/?ipset=esentire_atomictrivia_ru)|Andromeda/Gamarue Checkin|ipv4 hash:ip|7 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/atomictrivia.ru_watch_ip.lst)
[esentire_auth_update_ru](http://iplists.firehol.org/?ipset=esentire_auth_update_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|1306 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/auth-update.ru_watch_ip.lst)
[esentire_burmundisoul_ru](http://iplists.firehol.org/?ipset=esentire_burmundisoul_ru)|Ursnif Variant CnC|ipv4 hash:ip|2551 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/burmundisoul.ru_watch_ip.lst)
[esentire_crazyerror_su](http://iplists.firehol.org/?ipset=esentire_crazyerror_su)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|18613 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/crazyerror.su_watch_ip.lst)
[esentire_dagestanskiiviskis_ru](http://iplists.firehol.org/?ipset=esentire_dagestanskiiviskis_ru)|Ursnif Variant CnC|ipv4 hash:ip|517 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/dagestanskiiviskis.ru_watch_ip.lst)
[esentire_differentia_ru](http://iplists.firehol.org/?ipset=esentire_differentia_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|12 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/differentia.ru_watch_ip.lst)
[esentire_disorderstatus_ru](http://iplists.firehol.org/?ipset=esentire_disorderstatus_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|7 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/disorderstatus.ru_watch_ip.lst)
[esentire_dorttlokolrt_com](http://iplists.firehol.org/?ipset=esentire_dorttlokolrt_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|23664 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/dorttlokolrt.com_watch_ip.lst)
[esentire_downs1_ru](http://iplists.firehol.org/?ipset=esentire_downs1_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|7231 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/downs1.ru_watch_ip.lst)
[esentire_ebankoalalusys_ru](http://iplists.firehol.org/?ipset=esentire_ebankoalalusys_ru)|Ursnif Variant CnC|ipv4 hash:ip|898 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/ebankoalalusys.ru_watch_ip.lst)
[esentire_emptyarray_ru](http://iplists.firehol.org/?ipset=esentire_emptyarray_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|20139 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/emptyarray.ru_watch_ip.lst)
[esentire_fioartd_com](http://iplists.firehol.org/?ipset=esentire_fioartd_com)|Andromeda/Gamarue Checkin|ipv4 hash:ip|601 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/fioartd.com_watch_ip.lst)
[esentire_getarohirodrons_com](http://iplists.firehol.org/?ipset=esentire_getarohirodrons_com)|Andromeda/Gamarue Checkin|ipv4 hash:ip|2156 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/getarohirodrons.com_watch_ip.lst)
[esentire_hasanhashsde_ru](http://iplists.firehol.org/?ipset=esentire_hasanhashsde_ru)|Ursnif Variant CnC|ipv4 hash:ip|1184 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/hasanhashsde.ru_watch_ip.lst)
[esentire_inleet_ru](http://iplists.firehol.org/?ipset=esentire_inleet_ru)|Ursnif Variant CnC|ipv4 hash:ip|4219 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/inleet.ru_watch_ip.lst)
[esentire_islamislamdi_ru](http://iplists.firehol.org/?ipset=esentire_islamislamdi_ru)|Ursnif Variant CnC|ipv4 hash:ip|673 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/islamislamdi.ru_watch_ip.lst)
[esentire_krnqlwlplttc_com](http://iplists.firehol.org/?ipset=esentire_krnqlwlplttc_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|2 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/krnqlwlplttc.com_watch_ip.lst)
[esentire_maddox1_ru](http://iplists.firehol.org/?ipset=esentire_maddox1_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|11345 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/maddox1.ru_watch_ip.lst)
[esentire_manning1_ru](http://iplists.firehol.org/?ipset=esentire_manning1_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|6824 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/manning1.ru_watch_ip.lst)
[esentire_misteryherson_ru](http://iplists.firehol.org/?ipset=esentire_misteryherson_ru)|Ursnif Variant CnC|ipv4 hash:ip|176 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/misteryherson.ru_watch_ip.lst)
[esentire_mysebstarion_ru](http://iplists.firehol.org/?ipset=esentire_mysebstarion_ru)|Ursnif Variant CnC|ipv4 hash:ip|1058 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/mysebstarion.ru_watch_ip.lst)
[esentire_smartfoodsglutenfree_kz](http://iplists.firehol.org/?ipset=esentire_smartfoodsglutenfree_kz)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|2674 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/smartfoodsglutenfree.kz_watch_ip.lst)
[esentire_venerologvasan93_ru](http://iplists.firehol.org/?ipset=esentire_venerologvasan93_ru)|Ursnif Variant CnC|ipv4 hash:ip|1263 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/venerologvasan93.ru_watch_ip.lst)
[esentire_volaya_ru](http://iplists.firehol.org/?ipset=esentire_volaya_ru)|Win32/PSW.Papras.CK CnC|ipv4 hash:ip|5080 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/volaya.ru_watch_ip.lst)
[et_block](http://iplists.firehol.org/?ipset=et_block)|[EmergingThreats.net](http://www.emergingthreats.net/) default blacklist (at the time of writing includes spamhaus DROP, dshield and abuse.ch trackers, which are available separately too - prefer to use the direct ipsets instead of this, they seem to lag a bit in updates)|ipv4 hash:net|1360 subnets, 16304648 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt)
[et_botcc](http://iplists.firehol.org/?ipset=et_botcc)|[EmergingThreats.net Command and Control IPs](http://doc.emergingthreats.net/bin/view/Main/BotCC) These IPs are updates every 24 hours and should be considered VERY highly reliable indications that a host is communicating with a known and active Bot or Malware command and control server - (although they say this includes abuse.ch trackers, it does not - check its overlaps)|ipv4 hash:ip|67 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/fwrules/emerging-PIX-CC.rules)
[et_compromised](http://iplists.firehol.org/?ipset=et_compromised)|[EmergingThreats.net compromised hosts](http://doc.emergingthreats.net/bin/view/Main/CompromisedHost)|ipv4 hash:ip|334 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/blockrules/compromised-ips.txt)
[et_dshield](http://iplists.firehol.org/?ipset=et_dshield)|[EmergingThreats.net](http://www.emergingthreats.net/) dshield blocklist|ipv4 hash:net|19 subnets, 5120 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/fwrules/emerging-PIX-DSHIELD.rules)
[et_spamhaus](http://iplists.firehol.org/?ipset=et_spamhaus)|[EmergingThreats.net](http://www.emergingthreats.net/) spamhaus blocklist|ipv4 hash:net|1335 subnets, 16300032 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/fwrules/emerging-PIX-DROP.rules)
[et_tor](http://iplists.firehol.org/?ipset=et_tor)|[EmergingThreats.net TOR list](http://doc.emergingthreats.net/bin/view/Main/TorRules) of TOR network IPs|ipv4 hash:ip|5482 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/blockrules/emerging-tor.rules)
[feodo](http://iplists.firehol.org/?ipset=feodo)|[Abuse.ch Feodo tracker](https://feodotracker.abuse.ch) trojan includes IPs which are being used by Feodo (also known as Cridex or Bugat) which commits ebanking fraud|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://feodotracker.abuse.ch/blocklist/?download=ipblocklist)
[feodo_badips](http://iplists.firehol.org/?ipset=feodo_badips)|[Abuse.ch Feodo tracker BadIPs](https://feodotracker.abuse.ch) The Feodo Tracker Feodo BadIP Blocklist only contains IP addresses (IPv4) used as C&C communication channel by the Feodo Trojan version B. These IP addresses are usually servers rented by cybercriminals directly and used for the exclusive purpose of hosting a Feodo C&C server. Hence you should expect no legit traffic to those IP addresses. The site highly recommends you to block/drop any traffic towards any Feodo C&C using the Feodo BadIP Blocklist. Please consider that this blocklist only contains IP addresses used by version B of the Feodo Trojan. C&C communication channels used by version A, version C and version D are not covered by this blocklist.|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://feodotracker.abuse.ch/blocklist/?download=badips)
[firehol_abusers_1d](http://iplists.firehol.org/?ipset=firehol_abusers_1d)|An ipset made from blocklists that track abusers in the last 24 hours. (includes: botscout_1d cleantalk_new_1d cleantalk_updated_1d php_commenters_1d php_dictionary_1d php_harvesters_1d php_spammers_1d stopforumspam_1d)|ipv4 hash:net|5963 subnets, 6071 unique IPs|updated every 1 min
[firehol_abusers_30d](http://iplists.firehol.org/?ipset=firehol_abusers_30d)|An ipset made from blocklists that track abusers in the last 30 days. (includes: cleantalk_new_30d cleantalk_updated_30d php_commenters_30d php_dictionary_30d php_harvesters_30d php_spammers_30d stopforumspam sblam)|ipv4 hash:net|174485 subnets, 189222 unique IPs|updated every 1 min
[firehol_anonymous](http://iplists.firehol.org/?ipset=firehol_anonymous)|An ipset that includes all the anonymizing IPs of the world. (includes: anonymous dm_tor firehol_proxies tor_exits)|ipv4 hash:net|994650 subnets, 1119421 unique IPs|updated every 1 min
[firehol_level1](http://iplists.firehol.org/?ipset=firehol_level1)|A firewall blacklist composed from IP lists, providing maximum protection with minimum false positives. Suitable for basic protection on all internet facing servers, routers and firewalls. (includes: bambenek_c2 dshield feodo fullbogons spamhaus_drop spamhaus_edrop sslbl ransomware_rw)|ipv4 hash:net|2176 subnets, 612575232 unique IPs|updated every 1 min
[firehol_level2](http://iplists.firehol.org/?ipset=firehol_level2)|An ipset made from blocklists that track attacks, during about the last 48 hours. (includes: blocklist_de dshield_1d greensnow)|ipv4 hash:net|18687 subnets, 32691 unique IPs|updated every 1 min
[firehol_level3](http://iplists.firehol.org/?ipset=firehol_level3)|An ipset made from blocklists that track attacks, spyware, viruses. It includes IPs than have been reported or detected in the last 30 days. (includes: bruteforceblocker ciarmy dshield_30d dshield_top_1000 malc0de maxmind_proxy_fraud myip shunlist snort_ipfilter sslbl_aggressive talosintel_ipfilter vxvault)|ipv4 hash:net|17073 subnets, 31504 unique IPs|updated every 1 min
[firehol_level4](http://iplists.firehol.org/?ipset=firehol_level4)|An ipset made from blocklists that track attacks, but may include a large number of false positives. (includes: blocklist_net_ua botscout_30d cruzit_web_attacks cybercrime haley_ssh iblocklist_hijacked iblocklist_spyware iblocklist_webexploit ipblacklistcloud_top iw_wormlist malwaredomainlist)|ipv4 hash:net|148951 subnets, 9244510 unique IPs|updated every 1 min
[firehol_proxies](http://iplists.firehol.org/?ipset=firehol_proxies)|An ipset made from all sources that track open proxies. It includes IPs reported or detected in the last 30 days. (includes: iblocklist_proxies maxmind_proxy_fraud ip2proxy_px1lite proxylists_30d proxz_30d socks_proxy_30d sslproxies_30d xroxy_30d)|ipv4 hash:net|989842 subnets, 1108214 unique IPs|updated every 1 min
[firehol_webclient](http://iplists.firehol.org/?ipset=firehol_webclient)|An IP blacklist made from blocklists that track IPs that a web client should never talk to. This list is to be used on top of firehol_level1. (includes: ransomware_online sslbl_aggressive cybercrime dyndns_ponmocup maxmind_proxy_fraud)|ipv4 hash:net|1904 subnets, 2065 unique IPs|updated every 1 min
[firehol_webserver](http://iplists.firehol.org/?ipset=firehol_webserver)|A web server IP blacklist made from blocklists that track IPs that should never be used by your web users. (This list includes IPs that are servers hosting malware, bots, etc or users having a long criminal history. This list is to be used on top of firehol_level1, firehol_level2, firehol_level3 and possibly firehol_proxies or firehol_anonymous). (includes: maxmind_proxy_fraud myip pushing_inertia_blocklist stopforumspam_toxic)|ipv4 hash:net|2777 subnets, 60488035 unique IPs|updated every 1 min
[fullbogons](http://iplists.firehol.org/?ipset=fullbogons)|[Team-Cymru.org](http://www.team-cymru.org) IP space that has been allocated to an RIR, but not assigned by that RIR to an actual ISP or other end-user|ipv4 hash:net|800 subnets, 596203776 unique IPs|updated every 1 day
geolite2_asn|[MaxMind GeoLite2 ASN](https://dev.maxmind.com/geoip/geoip2/geolite2/)|ipv4 hash:net|disabled|updated every 7 days from [this link](http://geolite.maxmind.com/download/geoip/database/GeoLite2-ASN-CSV.zip)
[geolite2_country](https://github.com/firehol/blocklist-ipsets/tree/master/geolite2_country)|[MaxMind GeoLite2](http://dev.maxmind.com/geoip/geoip2/geolite2/) databases are free IP geolocation databases comparable to, but less accurate than, MaxMind’s GeoIP2 databases. They include IPs per country, IPs per continent, IPs used by anonymous services (VPNs, Proxies, etc) and Satellite Providers.|ipv4 hash:net|All the world|updated every 7 days from [this link](http://geolite.maxmind.com/download/geoip/database/GeoLite2-Country-CSV.zip)
gofferje_sip|[Stefan Gofferje](http://stefan.gofferje.net/it-stuff/sipfraud/sip-attacker-blacklist) A personal blacklist of networks and IPs of SIP attackers. To end up here, the IP or network must have been the origin of considerable and repeated attacks on my PBX and additionally, the ISP didn't react to any complaint. Note from the author: I don't give any guarantees of accuracy, completeness or even usability! USE AT YOUR OWN RISK! Also note that I block complete countries, namely China, Korea and Palestine with blocklists from ipdeny.com, so some attackers will never even get the chance to get noticed by me to be put on this blacklist. I also don't accept any liabilities related to this blocklist. If you're an ISP and don't like your IPs being listed here, too bad! You should have done something about your customers' behavior and reacted to my complaints. This blocklist is nothing but an expression of my personal opinion and exercising my right of free speech.|ipv4 hash:net|disabled|updated every 6 hours from [this link](http://stefan.gofferje.net/sipblocklist.zone)
[gpf_comics](http://iplists.firehol.org/?ipset=gpf_comics)|The GPF DNS Block List is a list of IP addresses on the Internet that have attacked the [GPF Comics](http://www.gpf-comics.com/) family of Web sites. IPs on this block list have been banned from accessing all of our servers because they were caught in the act of spamming, attempting to exploit our scripts, scanning for vulnerabilities, or consuming resources to the detriment of our human visitors.|ipv4 hash:ip|2830 unique IPs|updated every 1 day from [this link](https://www.gpf-comics.com/dnsbl/export.php)
[graphiclineweb](http://iplists.firehol.org/?ipset=graphiclineweb)|[GraphiclineWeb](https://graphiclineweb.wordpress.com/tech-notes/ip-blacklist/) The IP’s, Hosts and Domains listed in this table are banned universally from accessing websites controlled by the maintainer. Some form of bad activity has been seen from the addresses listed. Bad activity includes: unwanted spiders, rule breakers, comment spammers, trackback spammers, spambots, hacker bots, registration bots and other scripting attackers, harvesters, nuisance spiders, spy bots and organizations spying on websites for commercial reasons.|ipv4 hash:net|2579 subnets, 330527 unique IPs|updated every 1 day from [this link](https://graphiclineweb.wordpress.com/tech-notes/ip-blacklist/)
[greensnow](http://iplists.firehol.org/?ipset=greensnow)|[GreenSnow](https://greensnow.co/) is a team harvesting a large number of IPs from different computers located around the world. GreenSnow is comparable with SpamHaus.org for attacks of any kind except for spam. Their list is updated automatically and you can withdraw at any time your IP address if it has been listed. Attacks / bruteforce that are monitored are: Scan Port, FTP, POP3, mod_security, IMAP, SMTP, SSH, cPanel, etc.|ipv4 hash:ip|6607 unique IPs|updated every 30 mins from [this link](http://blocklist.greensnow.co/greensnow.txt)
[haley_ssh](http://iplists.firehol.org/?ipset=haley_ssh)|[Charles Haley](http://charles.the-haleys.org) IPs launching SSH dictionary attacks.|ipv4 hash:ip|51147 unique IPs|updated every 4 hours from [this link](http://charles.the-haleys.org/ssh_dico_attack_hdeny_format.php/hostsdeny.txt)
[hphosts_ats](http://iplists.firehol.org/?ipset=hphosts_ats)|[hpHosts](http://hosts-file.net/?s=Download) ad/tracking servers listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|13037 unique IPs|updated every 1 day from [this link](http://hosts-file.net/ad_servers.txt)
[hphosts_emd](http://iplists.firehol.org/?ipset=hphosts_emd)|[hpHosts](http://hosts-file.net/?s=Download) malware sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|59204 unique IPs|updated every 1 day from [this link](http://hosts-file.net/emd.txt)
[hphosts_exp](http://iplists.firehol.org/?ipset=hphosts_exp)|[hpHosts](http://hosts-file.net/?s=Download) exploit sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|196 unique IPs|updated every 1 day from [this link](http://hosts-file.net/exp.txt)
[hphosts_fsa](http://iplists.firehol.org/?ipset=hphosts_fsa)|[hpHosts](http://hosts-file.net/?s=Download) fraud sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|24764 unique IPs|updated every 1 day from [this link](http://hosts-file.net/fsa.txt)
[hphosts_grm](http://iplists.firehol.org/?ipset=hphosts_grm)|[hpHosts](http://hosts-file.net/?s=Download) sites involved in spam (that do not otherwise meet any other classification criteria) listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|293 unique IPs|updated every 1 day from [this link](http://hosts-file.net/grm.txt)
[hphosts_hfs](http://iplists.firehol.org/?ipset=hphosts_hfs)|[hpHosts](http://hosts-file.net/?s=Download) sites spamming the hpHosts forums (and not meeting any other classification criteria) listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|245 unique IPs|updated every 1 day from [this link](http://hosts-file.net/hfs.txt)
[hphosts_hjk](http://iplists.firehol.org/?ipset=hphosts_hjk)|[hpHosts](http://hosts-file.net/?s=Download) hijack sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|152 unique IPs|updated every 1 day from [this link](http://hosts-file.net/hjk.txt)
[hphosts_mmt](http://iplists.firehol.org/?ipset=hphosts_mmt)|[hpHosts](http://hosts-file.net/?s=Download) sites involved in misleading marketing (e.g. fake Flash update adverts) listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|960 unique IPs|updated every 1 day from [this link](http://hosts-file.net/mmt.txt)
[hphosts_pha](http://iplists.firehol.org/?ipset=hphosts_pha)|[hpHosts](http://hosts-file.net/?s=Download) illegal pharmacy sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|2474 unique IPs|updated every 1 day from [this link](http://hosts-file.net/pha.txt)
[hphosts_psh](http://iplists.firehol.org/?ipset=hphosts_psh)|[hpHosts](http://hosts-file.net/?s=Download) phishing sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|44781 unique IPs|updated every 1 day from [this link](http://hosts-file.net/psh.txt)
[hphosts_wrz](http://iplists.firehol.org/?ipset=hphosts_wrz)|[hpHosts](http://hosts-file.net/?s=Download) warez/piracy sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|905 unique IPs|updated every 1 day from [this link](http://hosts-file.net/wrz.txt)
[iblocklist_abuse_palevo](http://iplists.firehol.org/?ipset=iblocklist_abuse_palevo)|palevotracker.abuse.ch IP blocklist.|ipv4 hash:net|12 subnets, 12 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=erqajhwrxiuvjxqrrwfj&fileformat=p2p&archiveformat=gz)
[iblocklist_abuse_spyeye](http://iplists.firehol.org/?ipset=iblocklist_abuse_spyeye)|spyeyetracker.abuse.ch IP blocklist.|ipv4 hash:net|83 subnets, 84 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=zvjxsfuvdhoxktpeiokq&fileformat=p2p&archiveformat=gz)
[iblocklist_abuse_zeus](http://iplists.firehol.org/?ipset=iblocklist_abuse_zeus)|zeustracker.abuse.ch IP blocklist that contains IP addresses which are currently beeing tracked on the abuse.ch ZeuS Tracker.|ipv4 hash:net|209 subnets, 212 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=ynkdjqsjyfmilsgbogqf&fileformat=p2p&archiveformat=gz)
[iblocklist_ads](http://iplists.firehol.org/?ipset=iblocklist_ads)|Advertising trackers and a short list of bad/intrusive porn sites.|ipv4 hash:net|3389 subnets, 888721 unique IPs|updated every 12 hours
[iblocklist_badpeers](http://iplists.firehol.org/?ipset=iblocklist_badpeers)|IPs that have been reported for bad deeds in p2p.|ipv4 hash:net|48578 subnets, 1569289 unique IPs|updated every 12 hours
[iblocklist_bogons](http://iplists.firehol.org/?ipset=iblocklist_bogons)|Unallocated address space.|ipv4 hash:net|2692 subnets, 645673639 unique IPs|updated every 12 hours
[iblocklist_ciarmy_malicious](http://iplists.firehol.org/?ipset=iblocklist_ciarmy_malicious)|ciarmy.com IP blocklist. Based on information from a network of Sentinel devices deployed around the world, they compile a list of known bad IP addresses. Sentinel devices are uniquely positioned to pick up traffic from bad guys without requiring any type of signature-based or rate-based identification. If an IP is identified in this way by a significant number of Sentinels, the IP is malicious and should be blocked.|ipv4 hash:net|13047 subnets, 15000 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=npkuuhuxcsllnhoamkvm&fileformat=p2p&archiveformat=gz)
[iblocklist_cidr_report_bogons](http://iplists.firehol.org/?ipset=iblocklist_cidr_report_bogons)|cidr-report.org IP list of Unallocated address space.|ipv4 hash:net|9143 subnets, 602773696 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=lujdnbasfaaixitgmxpp&fileformat=p2p&archiveformat=gz)
[iblocklist_cruzit_web_attacks](http://iplists.firehol.org/?ipset=iblocklist_cruzit_web_attacks)|CruzIT IP list with individual IP addresses of compromised machines scanning for vulnerabilities and DDOS attacks.|ipv4 hash:net|14096 subnets, 14397 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=czvaehmjpsnwwttrdoyl&fileformat=p2p&archiveformat=gz)
[iblocklist_dshield](http://iplists.firehol.org/?ipset=iblocklist_dshield)|known Hackers and such people.|ipv4 hash:net|16 subnets, 2566 unique IPs|updated every 12 hours
[iblocklist_edu](http://iplists.firehol.org/?ipset=iblocklist_edu)|IPs used by Educational Institutions.|ipv4 hash:net|43898 subnets, 227924915 unique IPs|updated every 12 hours
[iblocklist_exclusions](http://iplists.firehol.org/?ipset=iblocklist_exclusions)|Exclusions.|ipv4 hash:net|313 subnets, 7488 unique IPs|updated every 12 hours
[iblocklist_fornonlancomputers](http://iplists.firehol.org/?ipset=iblocklist_fornonlancomputers)|IP blocklist for non-LAN computers.|ipv4 hash:net|4 subnets, 302055424 unique IPs|updated every 12 hours
[iblocklist_forumspam](http://iplists.firehol.org/?ipset=iblocklist_forumspam)|Forum spam.|ipv4 hash:net|455 subnets, 479 unique IPs|updated every 12 hours
[iblocklist_hijacked](http://iplists.firehol.org/?ipset=iblocklist_hijacked)|Hijacked IP-Blocks. Contains hijacked IP-Blocks and known IP-Blocks that are used to deliver Spam. This list is a combination of lists with hijacked IP-Blocks. Hijacked IP space are IP blocks that are being used without permission by organizations that have no relation to original organization (or its legal successor) that received the IP block. In essence it's stealing of somebody else's IP resources.|ipv4 hash:net|512 subnets, 8736512 unique IPs|updated every 12 hours
[iblocklist_iana_multicast](http://iplists.firehol.org/?ipset=iblocklist_iana_multicast)|IANA Multicast IPs.|ipv4 hash:net|1 subnets, 268435456 unique IPs|updated every 12 hours
[iblocklist_iana_private](http://iplists.firehol.org/?ipset=iblocklist_iana_private)|IANA Private IPs.|ipv4 hash:net|58 subnets, 51643646 unique IPs|updated every 12 hours
[iblocklist_iana_reserved](http://iplists.firehol.org/?ipset=iblocklist_iana_reserved)|IANA Reserved IPs.|ipv4 hash:net|1 subnets, 536870912 unique IPs|updated every 12 hours
[iblocklist_isp_aol](http://iplists.firehol.org/?ipset=iblocklist_isp_aol)|AOL IPs.|ipv4 hash:net|16 subnets, 6627584 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=toboaiysofkflwgrttmb&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_att](http://iplists.firehol.org/?ipset=iblocklist_isp_att)|AT&T IPs.|ipv4 hash:net|35 subnets, 55845128 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=grbtkzijgrowvobvessf&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_cablevision](http://iplists.firehol.org/?ipset=iblocklist_isp_cablevision)|Cablevision IPs.|ipv4 hash:net|11 subnets, 1787136 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=dwwbsmzirrykdlvpqozb&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_charter](http://iplists.firehol.org/?ipset=iblocklist_isp_charter)|Charter IPs.|ipv4 hash:net|21 subnets, 6138112 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=htnzojgossawhpkbulqw&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_comcast](http://iplists.firehol.org/?ipset=iblocklist_isp_comcast)|Comcast IPs.|ipv4 hash:net|33 subnets, 45121536 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=rsgyxvuklicibautguia&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_embarq](http://iplists.firehol.org/?ipset=iblocklist_isp_embarq)|Embarq IPs.|ipv4 hash:net|14 subnets, 2703360 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=twdblifaysaqtypevvdp&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_qwest](http://iplists.firehol.org/?ipset=iblocklist_isp_qwest)|Qwest IPs.|ipv4 hash:net|73 subnets, 15777552 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=jezlifrpefawuoawnfez&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_sprint](http://iplists.firehol.org/?ipset=iblocklist_isp_sprint)|Sprint IPs.|ipv4 hash:net|73 subnets, 6310570 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=hngtqrhhuadlceqxbrob&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_suddenlink](http://iplists.firehol.org/?ipset=iblocklist_isp_suddenlink)|Suddenlink IPs.|ipv4 hash:net|3 subnets, 458752 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=psaoblrwylfrdsspfuiq&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_twc](http://iplists.firehol.org/?ipset=iblocklist_isp_twc)|Time Warner Cable IPs.|ipv4 hash:net|56 subnets, 15015936 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=aqtsnttnqmcucwrjmohd&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_verizon](http://iplists.firehol.org/?ipset=iblocklist_isp_verizon)|Verizon IPs.|ipv4 hash:net|22 subnets, 18087936 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=cdmdbprvldivlqsaqjol&fileformat=p2p&archiveformat=gz)
[iblocklist_level1](http://iplists.firehol.org/?ipset=iblocklist_level1)|Level 1 (for use in p2p): Companies or organizations who are clearly involved with trying to stop filesharing (e.g. Baytsp, MediaDefender, Mediasentry). Companies which anti-p2p activity has been seen from. Companies that produce or have a strong financial interest in copyrighted material (e.g. music, movie, software industries a.o.). Government ranges or companies that have a strong financial interest in doing work for governments. Legal industry ranges. IPs or ranges of ISPs from which anti-p2p activity has been observed. Basically this list will block all kinds of internet connections that most people would rather not have during their internet travels.|ipv4 hash:net|235630 subnets, 725141674 unique IPs|updated every 12 hours
[iblocklist_level2](http://iplists.firehol.org/?ipset=iblocklist_level2)|Level 2 (for use in p2p). General corporate ranges. Ranges used by labs or researchers. Proxies.|ipv4 hash:net|78371 subnets, 337852557 unique IPs|updated every 12 hours
[iblocklist_level3](http://iplists.firehol.org/?ipset=iblocklist_level3)|Level 3 (for use in p2p). Many portal-type websites. ISP ranges that may be dodgy for some reason. Ranges that belong to an individual, but which have not been determined to be used by a particular company. Ranges for things that are unusual in some way. The L3 list is aka the paranoid list.|ipv4 hash:net|18873 subnets, 137080819 unique IPs|updated every 12 hours
[iblocklist_malc0de](http://iplists.firehol.org/?ipset=iblocklist_malc0de)|malc0de.com IP blocklist. Addresses that have been identified distributing malware during the past 30 days.|ipv4 hash:net|21 subnets, 21 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=pbqcylkejciyhmwttify&fileformat=p2p&archiveformat=gz)
[iblocklist_onion_router](http://iplists.firehol.org/?ipset=iblocklist_onion_router)|The Onion Router IP addresses.|ipv4 hash:net|850 subnets, 1199 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=togdoptykrlolpddwbvz&fileformat=p2p&archiveformat=gz)
[iblocklist_org_activision](http://iplists.firehol.org/?ipset=iblocklist_org_activision)|Activision IPs.|ipv4 hash:net|49 subnets, 4902 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=gfnxlhxsijzrcuxwzebb&fileformat=p2p&archiveformat=gz)
[iblocklist_org_apple](http://iplists.firehol.org/?ipset=iblocklist_org_apple)|Apple IPs.|ipv4 hash:net|1 subnets, 16777216 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=aphcqvpxuqgrkgufjruj&fileformat=p2p&archiveformat=gz)
[iblocklist_org_blizzard](http://iplists.firehol.org/?ipset=iblocklist_org_blizzard)|Blizzard IPs.|ipv4 hash:net|8 subnets, 16795139 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=ercbntshuthyykfkmhxc&fileformat=p2p&archiveformat=gz)
[iblocklist_org_crowd_control](http://iplists.firehol.org/?ipset=iblocklist_org_crowd_control)|Crowd Control Productions IPs.|ipv4 hash:net|2 subnets, 768 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=eveiyhgmusglurfmjyag&fileformat=p2p&archiveformat=gz)
[iblocklist_org_electronic_arts](http://iplists.firehol.org/?ipset=iblocklist_org_electronic_arts)|Electronic Arts IPs.|ipv4 hash:net|42 subnets, 69720 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=ejqebpcdmffinaetsvxj&fileformat=p2p&archiveformat=gz)
[iblocklist_org_joost](http://iplists.firehol.org/?ipset=iblocklist_org_joost)|Joost IPs.|ipv4 hash:net|4 subnets, 16779456 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=alxugfmeszbhpxqfdits&fileformat=p2p&archiveformat=gz)
[iblocklist_org_linden_lab](http://iplists.firehol.org/?ipset=iblocklist_org_linden_lab)|Linden Lab IPs.|ipv4 hash:net|11 subnets, 23600 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=qnjdimxnaupjmpqolxcv&fileformat=p2p&archiveformat=gz)
[iblocklist_org_logmein](http://iplists.firehol.org/?ipset=iblocklist_org_logmein)|LogMeIn IPs.|ipv4 hash:net|13 subnets, 16781568 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=tgbankumtwtrzllndbmb&fileformat=p2p&archiveformat=gz)
[iblocklist_org_microsoft](http://iplists.firehol.org/?ipset=iblocklist_org_microsoft)|Microsoft IP ranges.|ipv4 hash:net|901 subnets, 1848599 unique IPs|updated every 12 hours
[iblocklist_org_ncsoft](http://iplists.firehol.org/?ipset=iblocklist_org_ncsoft)|NCsoft IPs.|ipv4 hash:net|5 subnets, 12560 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=mwjuwmebrnzyyxpbezxu&fileformat=p2p&archiveformat=gz)
[iblocklist_org_nintendo](http://iplists.firehol.org/?ipset=iblocklist_org_nintendo)|Nintendo IPs.|ipv4 hash:net|45 subnets, 3927 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=pevkykuhgaegqyayzbnr&fileformat=p2p&archiveformat=gz)
[iblocklist_org_pandora](http://iplists.firehol.org/?ipset=iblocklist_org_pandora)|Pandora IPs.|ipv4 hash:net|1 subnets, 2048 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=aevzidimyvwybzkletsg&fileformat=p2p&archiveformat=gz)
[iblocklist_org_pirate_bay](http://iplists.firehol.org/?ipset=iblocklist_org_pirate_bay)|The Pirate Bay IPs.|ipv4 hash:net|5 subnets, 323 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=nzldzlpkgrcncdomnttb&fileformat=p2p&archiveformat=gz)
[iblocklist_org_punkbuster](http://iplists.firehol.org/?ipset=iblocklist_org_punkbuster)|Punkbuster IPs.|ipv4 hash:net|1 subnets, 1 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=zvwwndvzulqcltsicwdg&fileformat=p2p&archiveformat=gz)
[iblocklist_org_riot_games](http://iplists.firehol.org/?ipset=iblocklist_org_riot_games)|Riot Games IPs.|ipv4 hash:net|6 subnets, 1792 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=sdlvfabdjvrdttfjotcy&fileformat=p2p&archiveformat=gz)
[iblocklist_org_sony_online](http://iplists.firehol.org/?ipset=iblocklist_org_sony_online)|Sony Online Entertainment IPs.|ipv4 hash:net|7 subnets, 24616 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=tukpvrvlubsputmkmiwg&fileformat=p2p&archiveformat=gz)
[iblocklist_org_square_enix](http://iplists.firehol.org/?ipset=iblocklist_org_square_enix)|Square Enix IPs.|ipv4 hash:net|2 subnets, 4112 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=odyaqontcydnodrlyina&fileformat=p2p&archiveformat=gz)
[iblocklist_org_steam](http://iplists.firehol.org/?ipset=iblocklist_org_steam)|Steam IPs.|ipv4 hash:net|53 subnets, 596448 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=cnxkgiklecdaihzukrud&fileformat=p2p&archiveformat=gz)
[iblocklist_org_ubisoft](http://iplists.firehol.org/?ipset=iblocklist_org_ubisoft)|Ubisoft IPs.|ipv4 hash:net|10 subnets, 5308 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=etmcrglomupyxtaebzht&fileformat=p2p&archiveformat=gz)
[iblocklist_org_xfire](http://iplists.firehol.org/?ipset=iblocklist_org_xfire)|XFire IPs.|ipv4 hash:net|3 subnets, 3328 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=ppqqnyihmcrryraaqsjo&fileformat=p2p&archiveformat=gz)
[iblocklist_pedophiles](http://iplists.firehol.org/?ipset=iblocklist_pedophiles)|IP ranges of people who we have found to be sharing child pornography in the p2p community.|ipv4 hash:net|29188 subnets, 847889 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=dufcxgnbjsdwmwctgfuj&fileformat=p2p&archiveformat=gz)
[iblocklist_proxies](http://iplists.firehol.org/?ipset=iblocklist_proxies)|Open Proxies IPs list (without TOR)|ipv4 hash:ip|672 unique IPs|updated every 12 hours
[iblocklist_rangetest](http://iplists.firehol.org/?ipset=iblocklist_rangetest)|Suspicious IPs that are under investigation.|ipv4 hash:net|576 subnets, 4280758 unique IPs|updated every 12 hours
[iblocklist_spamhaus_drop](http://iplists.firehol.org/?ipset=iblocklist_spamhaus_drop)|Spamhaus.org DROP (Don't Route Or Peer) list.|ipv4 hash:net|900 subnets, 17338368 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=zbdlwrqkabxbcppvrnos&fileformat=p2p&archiveformat=gz)
[iblocklist_spider](http://iplists.firehol.org/?ipset=iblocklist_spider)|IP list intended to be used by webmasters to block hostile spiders from their web sites.|ipv4 hash:net|773 subnets, 846788 unique IPs|updated every 12 hours
[iblocklist_spyware](http://iplists.firehol.org/?ipset=iblocklist_spyware)|Known malicious SPYWARE and ADWARE IP Address ranges. It is compiled from various sources, including other available spyware blacklists, HOSTS files, from research found at many of the top anti-spyware forums, logs of spyware victims, etc.|ipv4 hash:net|3351 subnets, 338709 unique IPs|updated every 12 hours
[iblocklist_webexploit](http://iplists.firehol.org/?ipset=iblocklist_webexploit)|Web server hack and exploit attempts. IP addresses related to current web server hack and exploit attempts that have been logged or can be found in and cross referenced with other related IP databases. Malicious and other non search engine bots will also be listed here, along with anything found that can have a negative impact on a website or webserver such as proxies being used for negative SEO hijacks, unauthorised site mirroring, harvesting, scraping, snooping and data mining / spy bot / security & copyright enforcement companies that target and continuosly scan webservers.|ipv4 hash:ip|15382 unique IPs|updated every 12 hours
[iblocklist_yoyo_adservers](http://iplists.firehol.org/?ipset=iblocklist_yoyo_adservers)|pgl.yoyo.org ad servers|ipv4 hash:net|7822 subnets, 9216 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=zhogegszwduurnvsyhdf&fileformat=p2p&archiveformat=gz)
[ip2location_country](https://github.com/ktsaou/blocklist-ipsets/tree/master/ip2location_country)|[IP2Location.com](http://lite.ip2location.com/database-ip-country) geolocation database|ipv4 hash:net|All the world|updated every 1 day from [this link](http://download.ip2location.com/lite/IP2LOCATION-LITE-DB1.CSV.ZIP)
[ip2location_country_eh](http://iplists.firehol.org/?ipset=ip2location_country_eh)|Western Sahara (EH) -- [IP2Location.com](http://lite.ip2location.com/database-ip-country)|ipv4 hash:net|1 subnets, 256 unique IPs|updated every 1 day from [this link](http://download.ip2location.com/lite/IP2LOCATION-LITE-DB1.CSV.ZIP)
[ip2proxy_px1lite](http://iplists.firehol.org/?ipset=ip2proxy_px1lite)|[IP2Location.com](https://lite.ip2location.com/database/px1-ip-country) IP2Proxy LITE IP-COUNTRY Database contains IP addresses which are used as public proxies. The LITE edition is a free version of database that is limited to public proxies IP address.|ipv4 hash:net|978086 subnets, 1095898 unique IPs|updated every 1 day
[ipblacklistcloud_recent](http://iplists.firehol.org/?ipset=ipblacklistcloud_recent)|[IP Blacklist Cloud](http://www.ip-finder.me/) These are the most recent IP addresses that have been blacklisted by websites. IP Blacklist Cloud plugin protects your WordPress based website from spam comments, gives details about login attacks which you don't even know are happening without this plugin!|ipv4 hash:ip|32 unique IPs|updated every 4 hours from [this link](http://www.ip-finder.me/download/)
[ipblacklistcloud_recent_1d](http://iplists.firehol.org/?ipset=ipblacklistcloud_recent_1d)|[IP Blacklist Cloud](http://www.ip-finder.me/) These are the most recent IP addresses that have been blacklisted by websites. IP Blacklist Cloud plugin protects your WordPress based website from spam comments, gives details about login attacks which you don't even know are happening without this plugin!|ipv4 hash:ip|32 unique IPs|updated every 4 hours from [this link](http://www.ip-finder.me/download/)
[ipblacklistcloud_recent_30d](http://iplists.firehol.org/?ipset=ipblacklistcloud_recent_30d)|[IP Blacklist Cloud](http://www.ip-finder.me/) These are the most recent IP addresses that have been blacklisted by websites. IP Blacklist Cloud plugin protects your WordPress based website from spam comments, gives details about login attacks which you don't even know are happening without this plugin!|ipv4 hash:ip|196 unique IPs|updated every 4 hours from [this link](http://www.ip-finder.me/download/)
[ipblacklistcloud_recent_7d](http://iplists.firehol.org/?ipset=ipblacklistcloud_recent_7d)|[IP Blacklist Cloud](http://www.ip-finder.me/) These are the most recent IP addresses that have been blacklisted by websites. IP Blacklist Cloud plugin protects your WordPress based website from spam comments, gives details about login attacks which you don't even know are happening without this plugin!|ipv4 hash:ip|64 unique IPs|updated every 4 hours from [this link](http://www.ip-finder.me/download/)
[ipblacklistcloud_top](http://iplists.firehol.org/?ipset=ipblacklistcloud_top)|[IP Blacklist Cloud](http://www.ip-finder.me/) These are the top IP addresses that have been blacklisted by many websites. IP Blacklist Cloud plugin protects your WordPress based website from spam comments, gives details about login attacks which you don't even know are happening without this plugin!|ipv4 hash:ip|200 unique IPs|updated every 1 day from [this link](http://www.ip-finder.me/ip-full-list/)
[ipdeny_country](https://github.com/firehol/blocklist-ipsets/tree/master/ipdeny_country)|[IPDeny.com](http://www.ipdeny.com/) geolocation database|ipv4 hash:net|All the world|updated every 1 day from [this link](http://www.ipdeny.com/ipblocks/data/countries/all-zones.tar.gz)
[iw_spamlist](http://iplists.firehol.org/?ipset=iw_spamlist)|[ImproWare Antispam](http://antispam.imp.ch/) IPs sending spam, in the last 3 days|ipv4 hash:ip|0 unique IPs|updated every 1 hour from [this link](http://antispam.imp.ch/spamlist)
[iw_wormlist](http://iplists.firehol.org/?ipset=iw_wormlist)|[ImproWare Antispam](http://antispam.imp.ch/) IPs sending emails with viruses or worms, in the last 3 days|ipv4 hash:ip|0 unique IPs|updated every 1 hour from [this link](http://antispam.imp.ch/wormlist)
[lashback_ubl](http://iplists.firehol.org/?ipset=lashback_ubl)|[The LashBack UBL](http://blacklist.lashback.com/) The Unsubscribe Blacklist (UBL) is a real-time blacklist of IP addresses which are sending email to names harvested from suppression files (this is a big list, more than 500.000 IPs)|ipv4 hash:ip|37994 unique IPs|updated every 1 day from [this link](http://www.unsubscore.com/blacklist.txt)
[malc0de](http://iplists.firehol.org/?ipset=malc0de)|[Malc0de.com](http://malc0de.com) malicious IPs of the last 30 days|ipv4 hash:ip|21 unique IPs|updated every 1 day from [this link](http://malc0de.com/bl/IP_Blacklist.txt)
[malwaredomainlist](http://iplists.firehol.org/?ipset=malwaredomainlist)|[malwaredomainlist.com](http://www.malwaredomainlist.com) list of malware active ip addresses|ipv4 hash:ip|996 unique IPs|updated every 12 hours from [this link](http://www.malwaredomainlist.com/hostslist/ip.txt)
[maxmind_proxy_fraud](http://iplists.firehol.org/?ipset=maxmind_proxy_fraud)|[MaxMind.com](https://www.maxmind.com/en/high-risk-ip-sample-list) sample list of high-risk IP addresses.|ipv4 hash:ip|583 unique IPs|updated every 4 hours from [this link](https://www.maxmind.com/en/high-risk-ip-sample-list)
[myip](http://iplists.firehol.org/?ipset=myip)|[myip.ms](http://www.myip.ms/info/about) IPs identified as web bots in the last 10 days, using several sites that require human action|ipv4 hash:ip|1575 unique IPs|updated every 1 day from [this link](http://www.myip.ms/files/blacklist/csf/latest_blacklist.txt)
[nixspam](http://iplists.firehol.org/?ipset=nixspam)|[NiX Spam](http://www.heise.de/ix/NiX-Spam-DNSBL-and-blacklist-for-download-499637.html) IP addresses that sent spam in the last hour - automatically generated entries without distinguishing open proxies from relays, dialup gateways, and so on. All IPs are removed after 12 hours if there is no spam from there.|ipv4 hash:ip|17135 unique IPs|updated every 15 mins from [this link](http://www.dnsbl.manitu.net/download/nixspam-ip.dump.gz)
[normshield_all_attack](http://iplists.firehol.org/?ipset=normshield_all_attack)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category attack with severity all|ipv4 hash:ip|549 unique IPs|updated every 12 hours
[normshield_all_bruteforce](http://iplists.firehol.org/?ipset=normshield_all_bruteforce)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category bruteforce with severity all|ipv4 hash:ip|196 unique IPs|updated every 12 hours
[normshield_all_ddosbot](http://iplists.firehol.org/?ipset=normshield_all_ddosbot)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category ddosbot with severity all|ipv4 hash:ip|1 unique IPs|updated every 12 hours
[normshield_all_dnsscan](http://iplists.firehol.org/?ipset=normshield_all_dnsscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category dnsscan with severity all|ipv4 hash:ip|1 unique IPs|updated every 12 hours
[normshield_all_spam](http://iplists.firehol.org/?ipset=normshield_all_spam)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category spam with severity all|ipv4 hash:ip|17 unique IPs|updated every 12 hours
[normshield_all_suspicious](http://iplists.firehol.org/?ipset=normshield_all_suspicious)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category suspicious with severity all|ipv4 hash:ip|11 unique IPs|updated every 12 hours
[normshield_all_wannacry](http://iplists.firehol.org/?ipset=normshield_all_wannacry)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category wannacry with severity all|ipv4 hash:ip|1165 unique IPs|updated every 12 hours
[normshield_all_webscan](http://iplists.firehol.org/?ipset=normshield_all_webscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category webscan with severity all|ipv4 hash:ip|46 unique IPs|updated every 12 hours
[normshield_all_wormscan](http://iplists.firehol.org/?ipset=normshield_all_wormscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category wormscan with severity all|ipv4 hash:ip|28 unique IPs|updated every 12 hours
[normshield_high_attack](http://iplists.firehol.org/?ipset=normshield_high_attack)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category attack with severity high|ipv4 hash:ip|549 unique IPs|updated every 12 hours
[normshield_high_bruteforce](http://iplists.firehol.org/?ipset=normshield_high_bruteforce)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category bruteforce with severity high|ipv4 hash:ip|196 unique IPs|updated every 12 hours
[normshield_high_ddosbot](http://iplists.firehol.org/?ipset=normshield_high_ddosbot)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category ddosbot with severity high|ipv4 hash:ip|1 unique IPs|updated every 12 hours
[normshield_high_dnsscan](http://iplists.firehol.org/?ipset=normshield_high_dnsscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category dnsscan with severity high|ipv4 hash:ip|1 unique IPs|updated every 12 hours
[normshield_high_spam](http://iplists.firehol.org/?ipset=normshield_high_spam)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category spam with severity high|ipv4 hash:ip|17 unique IPs|updated every 12 hours
[normshield_high_suspicious](http://iplists.firehol.org/?ipset=normshield_high_suspicious)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category suspicious with severity high|ipv4 hash:ip|11 unique IPs|updated every 12 hours
[normshield_high_wannacry](http://iplists.firehol.org/?ipset=normshield_high_wannacry)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category wannacry with severity high|ipv4 hash:ip|1165 unique IPs|updated every 12 hours
[normshield_high_webscan](http://iplists.firehol.org/?ipset=normshield_high_webscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category webscan with severity high|ipv4 hash:ip|46 unique IPs|updated every 12 hours
[normshield_high_wormscan](http://iplists.firehol.org/?ipset=normshield_high_wormscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category wormscan with severity high|ipv4 hash:ip|28 unique IPs|updated every 12 hours
[nt_malware_dns](http://iplists.firehol.org/?ipset=nt_malware_dns)|[No Think](http://www.nothink.org/) Malware DNS (the original list includes hostnames and domains, which are ignored)|ipv4 hash:ip|235 unique IPs|updated every 1 hour from [this link](http://www.nothink.org/blacklist/blacklist_malware_dns.txt)
[nt_malware_http](http://iplists.firehol.org/?ipset=nt_malware_http)|[No Think](http://www.nothink.org/) Malware HTTP|ipv4 hash:ip|69 unique IPs|updated every 1 hour from [this link](http://www.nothink.org/blacklist/blacklist_malware_http.txt)
[nt_malware_irc](http://iplists.firehol.org/?ipset=nt_malware_irc)|[No Think](http://www.nothink.org/) Malware IRC|ipv4 hash:ip|42 unique IPs|updated every 1 hour from [this link](http://www.nothink.org/blacklist/blacklist_malware_irc.txt)
[nt_ssh_7d](http://iplists.firehol.org/?ipset=nt_ssh_7d)|[NoThink](http://www.nothink.org/) Last 7 days SSH attacks|ipv4 hash:ip|169 unique IPs|updated every 1 hour from [this link](http://www.nothink.org/blacklist/blacklist_ssh_week.txt)
[nullsecure](http://iplists.firehol.org/?ipset=nullsecure)|[nullsecure.org](http://nullsecure.org/) This is a free threat feed provided for use in any acceptable manner. This feed was aggregated using the [Tango Honeypot Intelligence Splunk App](https://github.com/aplura/Tango) by Brian Warehime, a Senior Security Analyst at Defense Point Security.|ipv4 hash:ip|1 unique IPs|updated every 8 hours from [this link](http://nullsecure.org/threatfeed/master.txt)
[packetmail](http://iplists.firehol.org/?ipset=packetmail)|[PacketMail.net](https://www.packetmail.net/) IP addresses that have been detected performing TCP SYN to 206.82.85.196/30 to a non-listening service or daemon. No assertion is made, nor implied, that any of the below listed IP addresses are accurate, malicious, hostile, or engaged in nefarious acts. Use this list at your own risk.|ipv4 hash:ip|3986 unique IPs|updated every 4 hours from [this link](https://www.packetmail.net/iprep.txt)
[packetmail_emerging_ips](http://iplists.firehol.org/?ipset=packetmail_emerging_ips)|[PacketMail.net](https://www.packetmail.net/) IP addresses that have been detected as potentially of interest based on the number of unique users of the packetmail IP Reputation system. No assertion is made, nor implied, that any of the below listed IP addresses are accurate, malicious, hostile, or engaged in nefarious acts. Use this list at your own risk.|ipv4 hash:ip|26 unique IPs|updated every 4 hours from [this link](https://www.packetmail.net/iprep_emerging_ips.txt)
[packetmail_mail](http://iplists.firehol.org/?ipset=packetmail_mail)|[PacketMail.net](https://www.packetmail.net/) IP addresses that have been detected performing behavior not in compliance with the requirements this system enforces for email acceptance. No assertion is made, nor implied, that any of the below listed IP addresses are accurate, malicious, hostile, or engaged in nefarious acts. Use this list at your own risk.|ipv4 hash:ip|73 unique IPs|updated every 4 hours from [this link](https://www.packetmail.net/iprep_mail.txt)
[packetmail_ramnode](http://iplists.firehol.org/?ipset=packetmail_ramnode)|[PacketMail.net](https://www.packetmail.net/) IP addresses that have been detected performing TCP SYN to 81.4.103.251 to a non-listening service or daemon. No assertion is made, nor implied, that any of the below listed IP addresses are accurate, malicious, hostile, or engaged in nefarious acts. Use this list at your own risk.|ipv4 hash:ip|2502 unique IPs|updated every 4 hours from [this link](https://www.packetmail.net/iprep_ramnode.txt)
php_bad|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) bad web hosts (this list is composed using an RSS feed)|ipv4 hash:ip|disabled|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=b&rss=1)
[php_commenters](http://iplists.firehol.org/?ipset=php_commenters)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) comment spammers (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=c&rss=1)
[php_commenters_1d](http://iplists.firehol.org/?ipset=php_commenters_1d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) comment spammers (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=c&rss=1)
[php_commenters_30d](http://iplists.firehol.org/?ipset=php_commenters_30d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) comment spammers (this list is composed using an RSS feed)|ipv4 hash:ip|1122 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=c&rss=1)
[php_commenters_7d](http://iplists.firehol.org/?ipset=php_commenters_7d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) comment spammers (this list is composed using an RSS feed)|ipv4 hash:ip|289 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=c&rss=1)
[php_dictionary](http://iplists.firehol.org/?ipset=php_dictionary)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) directory attackers (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1)
[php_dictionary_1d](http://iplists.firehol.org/?ipset=php_dictionary_1d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) directory attackers (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1)
[php_dictionary_30d](http://iplists.firehol.org/?ipset=php_dictionary_30d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) directory attackers (this list is composed using an RSS feed)|ipv4 hash:ip|1165 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1)
[php_dictionary_7d](http://iplists.firehol.org/?ipset=php_dictionary_7d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) directory attackers (this list is composed using an RSS feed)|ipv4 hash:ip|301 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1)
[php_harvesters](http://iplists.firehol.org/?ipset=php_harvesters)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) harvesters (IPs that surf the internet looking for email addresses) (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=h&rss=1)
[php_harvesters_1d](http://iplists.firehol.org/?ipset=php_harvesters_1d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) harvesters (IPs that surf the internet looking for email addresses) (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=h&rss=1)
[php_harvesters_30d](http://iplists.firehol.org/?ipset=php_harvesters_30d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) harvesters (IPs that surf the internet looking for email addresses) (this list is composed using an RSS feed)|ipv4 hash:ip|407 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=h&rss=1)
[php_harvesters_7d](http://iplists.firehol.org/?ipset=php_harvesters_7d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) harvesters (IPs that surf the internet looking for email addresses) (this list is composed using an RSS feed)|ipv4 hash:ip|152 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=h&rss=1)
[php_spammers](http://iplists.firehol.org/?ipset=php_spammers)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) spam servers (IPs used by spammers to send messages) (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=s&rss=1)
[php_spammers_1d](http://iplists.firehol.org/?ipset=php_spammers_1d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) spam servers (IPs used by spammers to send messages) (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=s&rss=1)
[php_spammers_30d](http://iplists.firehol.org/?ipset=php_spammers_30d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) spam servers (IPs used by spammers to send messages) (this list is composed using an RSS feed)|ipv4 hash:ip|993 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=s&rss=1)
[php_spammers_7d](http://iplists.firehol.org/?ipset=php_spammers_7d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) spam servers (IPs used by spammers to send messages) (this list is composed using an RSS feed)|ipv4 hash:ip|265 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=s&rss=1)
[proxylists](http://iplists.firehol.org/?ipset=proxylists)|[proxylists.net](http://www.proxylists.net/) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|2668 unique IPs|updated every 1 hour from [this link](http://www.proxylists.net/proxylists.xml)
[proxylists_1d](http://iplists.firehol.org/?ipset=proxylists_1d)|[proxylists.net](http://www.proxylists.net/) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|5094 unique IPs|updated every 1 hour from [this link](http://www.proxylists.net/proxylists.xml)
[proxylists_30d](http://iplists.firehol.org/?ipset=proxylists_30d)|[proxylists.net](http://www.proxylists.net/) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|10138 unique IPs|updated every 1 hour from [this link](http://www.proxylists.net/proxylists.xml)
[proxylists_7d](http://iplists.firehol.org/?ipset=proxylists_7d)|[proxylists.net](http://www.proxylists.net/) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|8263 unique IPs|updated every 1 hour from [this link](http://www.proxylists.net/proxylists.xml)
proxyrss|[proxyrss.com](http://www.proxyrss.com) open proxies syndicated from multiple sources.|ipv4 hash:ip|disabled|updated every 4 hours from [this link](http://www.proxyrss.com/proxylists/all.gz)
[proxyspy_1d](http://iplists.firehol.org/?ipset=proxyspy_1d)|[ProxySpy](http://spys.ru/en/) open proxies (updated hourly)|ipv4 hash:ip|300 unique IPs|updated every 1 hour from [this link](http://txt.proxyspy.net/proxy.txt)
[proxyspy_30d](http://iplists.firehol.org/?ipset=proxyspy_30d)|[ProxySpy](http://spys.ru/en/) open proxies (updated hourly)|ipv4 hash:ip|6720 unique IPs|updated every 1 hour from [this link](http://txt.proxyspy.net/proxy.txt)
[proxyspy_7d](http://iplists.firehol.org/?ipset=proxyspy_7d)|[ProxySpy](http://spys.ru/en/) open proxies (updated hourly)|ipv4 hash:ip|2828 unique IPs|updated every 1 hour from [this link](http://txt.proxyspy.net/proxy.txt)
[proxz](http://iplists.firehol.org/?ipset=proxz)|[proxz.com](http://www.proxz.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|26 unique IPs|updated every 1 hour from [this link](http://www.proxz.com/proxylists.xml)
[proxz_1d](http://iplists.firehol.org/?ipset=proxz_1d)|[proxz.com](http://www.proxz.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|266 unique IPs|updated every 1 hour from [this link](http://www.proxz.com/proxylists.xml)
[proxz_30d](http://iplists.firehol.org/?ipset=proxz_30d)|[proxz.com](http://www.proxz.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|3338 unique IPs|updated every 1 hour from [this link](http://www.proxz.com/proxylists.xml)
[proxz_7d](http://iplists.firehol.org/?ipset=proxz_7d)|[proxz.com](http://www.proxz.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|1201 unique IPs|updated every 1 hour from [this link](http://www.proxz.com/proxylists.xml)
[pushing_inertia_blocklist](http://iplists.firehol.org/?ipset=pushing_inertia_blocklist)|[Pushing Inertia](https://github.com/pushinginertia/ip-blacklist) IPs of hosting providers that are known to host various bots, spiders, scrapers, etc. to block access from these providers to web servers.|ipv4 hash:net|1309 subnets, 60462830 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/pushinginertia/ip-blacklist/master/ip_blacklist.conf)
[ransomware_cryptowall_ps](http://iplists.firehol.org/?ipset=ransomware_cryptowall_ps)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is CW_PS_IPBL: CryptoWall Ransomware Payment Sites IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/CW_PS_IPBL.txt)
[ransomware_feed](http://iplists.firehol.org/?ipset=ransomware_feed)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. The IPs in this list have been extracted from the tracker data feed.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/feeds/csv/)
[ransomware_locky_c2](http://iplists.firehol.org/?ipset=ransomware_locky_c2)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is LY_C2_IPBL: Locky Ransomware C2 URL blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/LY_C2_IPBL.txt)
[ransomware_locky_ps](http://iplists.firehol.org/?ipset=ransomware_locky_ps)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is LY_PS_IPBL: Locky Ransomware Payment Sites IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/LY_PS_IPBL.txt)
[ransomware_online](http://iplists.firehol.org/?ipset=ransomware_online)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. The IPs in this list have been extracted from the tracker data feed, filtering only online IPs.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/feeds/csv/)
[ransomware_rw](http://iplists.firehol.org/?ipset=ransomware_rw)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list includes TC_PS_IPBL, LY_C2_IPBL, TL_C2_IPBL, TL_PS_IPBL and it is the recommended blocklist. It might not catch everything, but the false positive rate should be low. However, false positives are possible, especially with regards to RW_IPBL. IP addresses associated with Ransomware Payment Sites (*_PS_IPBL) or Locky botnet C&Cs (LY_C2_IPBL) stay listed on RW_IPBL for a time of 30 days after the last appearance. This means that an IP address stays listed on RW_IPBL even after the threat has been eliminated (e.g. the VPS / server has been suspended by the hosting provider) for another 30 days.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt)
[ransomware_teslacrypt_ps](http://iplists.firehol.org/?ipset=ransomware_teslacrypt_ps)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is TC_PS_IPBL: TeslaCrypt Ransomware Payment Sites IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/TC_PS_IPBL.txt)
[ransomware_torrentlocker_c2](http://iplists.firehol.org/?ipset=ransomware_torrentlocker_c2)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is TL_C2_IPBL: TorrentLocker Ransomware C2 IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/TL_C2_IPBL.txt)
[ransomware_torrentlocker_ps](http://iplists.firehol.org/?ipset=ransomware_torrentlocker_ps)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is TL_PS_IPBL: TorrentLocker Ransomware Payment Sites IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/TL_PS_IPBL.txt)
ri_connect_proxies|[rosinstrument.com](http://www.rosinstrument.com) open CONNECT proxies (this list is composed using an RSS feed)|ipv4 hash:ip|disabled|updated every 1 hour from [this link](http://tools.rosinstrument.com/proxy/plab100.xml)
ri_web_proxies|[rosinstrument.com](http://www.rosinstrument.com) open HTTP proxies (this list is composed using an RSS feed)|ipv4 hash:ip|disabled|updated every 1 hour from [this link](http://tools.rosinstrument.com/proxy/l100.xml)
[sblam](http://iplists.firehol.org/?ipset=sblam)|[sblam.com](http://sblam.com) IPs used by web form spammers, during the last month|ipv4 hash:ip|3099 unique IPs|updated every 1 day from [this link](http://sblam.com/blacklist.txt)
[shunlist](http://iplists.firehol.org/?ipset=shunlist)|[AutoShun.org](http://autoshun.org/) IPs identified as hostile by correlating logs from distributed snort installations running the autoshun plugin|ipv4 hash:ip|500 unique IPs|updated every 4 hours
[snort_ipfilter](http://iplists.firehol.org/?ipset=snort_ipfilter)|[labs.snort.org](https://labs.snort.org/) supplied IP blacklist (this list seems to be updated frequently, but we found no information about it)|ipv4 hash:ip|836 unique IPs|updated every 12 hours from [this link](http://labs.snort.org/feeds/ip-filter.blf)
[socks_proxy](http://iplists.firehol.org/?ipset=socks_proxy)|[socks-proxy.net](http://www.socks-proxy.net/) open SOCKS proxies|ipv4 hash:ip|302 unique IPs|updated every 10 mins from [this link](http://www.socks-proxy.net/)
[socks_proxy_1d](http://iplists.firehol.org/?ipset=socks_proxy_1d)|[socks-proxy.net](http://www.socks-proxy.net/) open SOCKS proxies|ipv4 hash:ip|2218 unique IPs|updated every 10 mins from [this link](http://www.socks-proxy.net/)
[socks_proxy_30d](http://iplists.firehol.org/?ipset=socks_proxy_30d)|[socks-proxy.net](http://www.socks-proxy.net/) open SOCKS proxies|ipv4 hash:ip|5486 unique IPs|updated every 10 mins from [this link](http://www.socks-proxy.net/)
[socks_proxy_7d](http://iplists.firehol.org/?ipset=socks_proxy_7d)|[socks-proxy.net](http://www.socks-proxy.net/) open SOCKS proxies|ipv4 hash:ip|3338 unique IPs|updated every 10 mins from [this link](http://www.socks-proxy.net/)
[sorbs_anonymizers](http://iplists.firehol.org/?ipset=sorbs_anonymizers)|[Sorbs.net](https://www.sorbs.net/) List of open HTTP and SOCKS proxies.|ipv4 hash:net|597391 subnets, 610263 unique IPs|updated every 1 min
sorbs_block|[Sorbs.net](https://www.sorbs.net/) List of hosts demanding that they never be tested by SORBS.|ipv4 hash:net|disabled|
[sorbs_dul](http://iplists.firehol.org/?ipset=sorbs_dul)|[Sorbs.net](https://www.sorbs.net/) Dynamic IP Addresses.|ipv4 hash:net|607718 subnets, 375474210 unique IPs|updated every 1 min
[sorbs_escalations](http://iplists.firehol.org/?ipset=sorbs_escalations)|[Sorbs.net](https://www.sorbs.net/) Netblocks of spam supporting service providers, including those who provide websites, DNS or drop boxes for a spammer. Spam supporters are added on a 'third strike and you are out' basis, where the third spam will cause the supporter to be added to the list.|ipv4 hash:net|8 subnets, 2304 unique IPs|updated every 1 min
[sorbs_new_spam](http://iplists.firehol.org/?ipset=sorbs_new_spam)|[Sorbs.net](https://www.sorbs.net/) List of hosts that have been noted as sending spam/UCE/UBE within the last 48 hours|ipv4 hash:net|33977 subnets, 35967 unique IPs|updated every 1 min
[sorbs_noserver](http://iplists.firehol.org/?ipset=sorbs_noserver)|[Sorbs.net](https://www.sorbs.net/) IP addresses and netblocks of where system administrators and ISPs owning the network have indicated that servers should not be present.|ipv4 hash:net|15066 subnets, 22951270 unique IPs|updated every 1 min
[sorbs_recent_spam](http://iplists.firehol.org/?ipset=sorbs_recent_spam)|[Sorbs.net](https://www.sorbs.net/) List of hosts that have been noted as sending spam/UCE/UBE within the last 28 days (includes sorbs_new_spam)|ipv4 hash:net|522240 subnets, 555438 unique IPs|updated every 1 min
[sorbs_smtp](http://iplists.firehol.org/?ipset=sorbs_smtp)|[Sorbs.net](https://www.sorbs.net/) List of SMTP Open Relays.|ipv4 hash:net|1968 subnets, 1976 unique IPs|updated every 1 min
[sorbs_web](http://iplists.firehol.org/?ipset=sorbs_web)|[Sorbs.net](https://www.sorbs.net/) List of IPs which have spammer abusable vulnerabilities (e.g. FormMail scripts)|ipv4 hash:net|5895259 subnets, 6375029 unique IPs|updated every 1 min
[sorbs_zombie](http://iplists.firehol.org/?ipset=sorbs_zombie)|[Sorbs.net](https://www.sorbs.net/) List of networks hijacked from their original owners, some of which have already used for spamming.|ipv4 hash:net|78 subnets, 1903876 unique IPs|updated every 1 min
[spamhaus_drop](http://iplists.firehol.org/?ipset=spamhaus_drop)|[Spamhaus.org](http://www.spamhaus.org) DROP list (according to their site this list should be dropped at tier-1 ISPs globally)|ipv4 hash:net|1334 subnets, 16299776 unique IPs|updated every 12 hours from [this link](http://www.spamhaus.org/drop/drop.txt)
[spamhaus_edrop](http://iplists.firehol.org/?ipset=spamhaus_edrop)|[Spamhaus.org](http://www.spamhaus.org) EDROP (extended matches that should be used with DROP)|ipv4 hash:net|336 subnets, 731392 unique IPs|updated every 12 hours from [this link](http://www.spamhaus.org/drop/edrop.txt)
[sslbl](http://iplists.firehol.org/?ipset=sslbl)|[Abuse.ch SSL Blacklist](https://sslbl.abuse.ch/) bad SSL traffic related to malware or botnet activities|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://sslbl.abuse.ch/blacklist/sslipblacklist.csv)
[sslbl_aggressive](http://iplists.firehol.org/?ipset=sslbl_aggressive)|[Abuse.ch SSL Blacklist](https://sslbl.abuse.ch/) The aggressive version of the SSL IP Blacklist contains all IPs that SSLBL ever detected being associated with a malicious SSL certificate. Since IP addresses can be reused (e.g. when the customer changes), this blacklist may cause false positives. Hence I highly recommend you to use the standard version instead of the aggressive one.|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.csv)
[sslproxies](http://iplists.firehol.org/?ipset=sslproxies)|[SSLProxies.org](http://www.sslproxies.org/) open SSL proxies|ipv4 hash:ip|102 unique IPs|updated every 10 mins from [this link](http://www.sslproxies.org/)
[sslproxies_1d](http://iplists.firehol.org/?ipset=sslproxies_1d)|[SSLProxies.org](http://www.sslproxies.org/) open SSL proxies|ipv4 hash:ip|193 unique IPs|updated every 10 mins from [this link](http://www.sslproxies.org/)
[sslproxies_30d](http://iplists.firehol.org/?ipset=sslproxies_30d)|[SSLProxies.org](http://www.sslproxies.org/) open SSL proxies|ipv4 hash:ip|1141 unique IPs|updated every 10 mins from [this link](http://www.sslproxies.org/)
[sslproxies_7d](http://iplists.firehol.org/?ipset=sslproxies_7d)|[SSLProxies.org](http://www.sslproxies.org/) open SSL proxies|ipv4 hash:ip|484 unique IPs|updated every 10 mins from [this link](http://www.sslproxies.org/)
[stopforumspam](http://iplists.firehol.org/?ipset=stopforumspam)|[StopForumSpam.com](http://www.stopforumspam.com) Banned IPs used by forum spammers|ipv4 hash:ip|146385 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/bannedips.zip)
[stopforumspam_180d](http://iplists.firehol.org/?ipset=stopforumspam_180d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers (last 180 days)|ipv4 hash:ip|265834 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/listed_ip_180.zip)
[stopforumspam_1d](http://iplists.firehol.org/?ipset=stopforumspam_1d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers in the last 24 hours|ipv4 hash:ip|3597 unique IPs|updated every 1 hour from [this link](http://www.stopforumspam.com/downloads/listed_ip_1.zip)
[stopforumspam_30d](http://iplists.firehol.org/?ipset=stopforumspam_30d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers (last 30 days)|ipv4 hash:ip|55631 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/listed_ip_30.zip)
[stopforumspam_365d](http://iplists.firehol.org/?ipset=stopforumspam_365d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers (last 365 days)|ipv4 hash:ip|478255 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/listed_ip_365.zip)
[stopforumspam_7d](http://iplists.firehol.org/?ipset=stopforumspam_7d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers (last 7 days)|ipv4 hash:ip|18157 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/listed_ip_7.zip)
[stopforumspam_90d](http://iplists.firehol.org/?ipset=stopforumspam_90d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers (last 90 days)|ipv4 hash:ip|147654 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/listed_ip_90.zip)
[stopforumspam_toxic](http://iplists.firehol.org/?ipset=stopforumspam_toxic)|[StopForumSpam.com](http://www.stopforumspam.com) Networks that have large amounts of spambots and are flagged as toxic. Toxic IP ranges are infrequently changed.|ipv4 hash:net|46 subnets, 120411 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/toxic_ip_cidr.txt)
[taichung](http://iplists.firehol.org/?ipset=taichung)|[Taichung Education Center](https://www.tc.edu.tw/net/netflow/lkout/recent/30) Blocked IP Addresses (attacks and bots).|ipv4 hash:ip|2658 unique IPs|updated every 1 day from [this link](https://www.tc.edu.tw/net/netflow/lkout/recent/30)
[talosintel_ipfilter](http://iplists.firehol.org/?ipset=talosintel_ipfilter)|[TalosIntel.com](http://talosintel.com/additional-resources/) List of known malicious network threats|ipv4 hash:ip|732 unique IPs|updated every 15 mins from [this link](http://talosintel.com/feeds/ip-filter.blf)
[threatcrowd](http://iplists.firehol.org/?ipset=threatcrowd)|[Crowdsourced IP feed from ThreatCrowd](http://threatcrowd.blogspot.gr/2016/02/crowdsourced-feeds-from-threatcrowd.html). These feeds are not a substitute for the scale of auto-extracted command and control domains or the quality of some commercially provided feeds. But crowd-sourcing does go some way towards the quick sharing of threat intelligence between the community.|ipv4 hash:ip|977 unique IPs|updated every 1 hour from [this link](https://www.threatcrowd.org/feeds/ips.txt)
[tor_exits](http://iplists.firehol.org/?ipset=tor_exits)|[TorProject.org](https://www.torproject.org) list of all current TOR exit points (TorDNSEL)|ipv4 hash:ip|1216 unique IPs|updated every 5 mins from [this link](https://check.torproject.org/exit-addresses)
[tor_exits_1d](http://iplists.firehol.org/?ipset=tor_exits_1d)|[TorProject.org](https://www.torproject.org) list of all current TOR exit points (TorDNSEL)|ipv4 hash:ip|1227 unique IPs|updated every 5 mins from [this link](https://check.torproject.org/exit-addresses)
[tor_exits_30d](http://iplists.firehol.org/?ipset=tor_exits_30d)|[TorProject.org](https://www.torproject.org) list of all current TOR exit points (TorDNSEL)|ipv4 hash:ip|1475 unique IPs|updated every 5 mins from [this link](https://check.torproject.org/exit-addresses)
[tor_exits_7d](http://iplists.firehol.org/?ipset=tor_exits_7d)|[TorProject.org](https://www.torproject.org) list of all current TOR exit points (TorDNSEL)|ipv4 hash:ip|1281 unique IPs|updated every 5 mins from [this link](https://check.torproject.org/exit-addresses)
[turris_greylist](http://iplists.firehol.org/?ipset=turris_greylist)|[Turris Greylist](https://www.turris.cz/en/greylist) IPs that are blocked on the firewalls of Turris routers. The data is processed and clasified every week and behaviour of IP addresses that accessed a larger number of Turris routers is evaluated. The result is a list of addresses that have tried to obtain information about services on the router or tried to gain access to them. We do not recommend to use these data as a list of addresses that should be blocked but it can be used for example in analysis of the traffic in other networks.|ipv4 hash:ip|9614 unique IPs|updated every 7 days from [this link](https://www.turris.cz/greylist-data/greylist-latest.csv)
[urandomusto_dns](http://iplists.firehol.org/?ipset=urandomusto_dns)|IP Feed about dns, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|67 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=dns&out=txt&submit=go)
[urandomusto_ftp](http://iplists.firehol.org/?ipset=urandomusto_ftp)|IP Feed about ftp, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|152 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=ftp&out=txt&submit=go)
[urandomusto_http](http://iplists.firehol.org/?ipset=urandomusto_http)|IP Feed about http, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|289 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=http&out=txt&submit=go)
[urandomusto_mailer](http://iplists.firehol.org/?ipset=urandomusto_mailer)|IP Feed about mailer, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|259 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=mailer&out=txt&submit=go)
[urandomusto_malware](http://iplists.firehol.org/?ipset=urandomusto_malware)|IP Feed about malware, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|1 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=malware&out=txt&submit=go)
[urandomusto_ntp](http://iplists.firehol.org/?ipset=urandomusto_ntp)|IP Feed about ntp, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|72 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=ntp&out=txt&submit=go)
[urandomusto_rdp](http://iplists.firehol.org/?ipset=urandomusto_rdp)|IP Feed about rdp, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|133 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=rdp&out=txt&submit=go)
[urandomusto_smb](http://iplists.firehol.org/?ipset=urandomusto_smb)|IP Feed about smb, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|45 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=smb&out=txt&submit=go)
[urandomusto_spam](http://iplists.firehol.org/?ipset=urandomusto_spam)|IP Feed about spam, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|4 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=spam&out=txt&submit=go)
[urandomusto_ssh](http://iplists.firehol.org/?ipset=urandomusto_ssh)|IP Feed about ssh, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|126 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=ssh&out=txt&submit=go)
[urandomusto_telnet](http://iplists.firehol.org/?ipset=urandomusto_telnet)|IP Feed about telnet, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|299 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=telnet&out=txt&submit=go)
[urandomusto_unspecified](http://iplists.firehol.org/?ipset=urandomusto_unspecified)|IP Feed about unspecified, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|178 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=unspecified&out=txt&submit=go)
[urandomusto_vnc](http://iplists.firehol.org/?ipset=urandomusto_vnc)|IP Feed about vnc, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|27 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=vnc&out=txt&submit=go)
[urlvir](http://iplists.firehol.org/?ipset=urlvir)|[URLVir.com](http://www.urlvir.com/) Active Malicious IP Addresses Hosting Malware. URLVir is an online security service developed by NoVirusThanks Company Srl that automatically monitors changes of malicious URLs (executable files).|ipv4 hash:ip|171 unique IPs|updated every 1 day from [this link](http://www.urlvir.com/export-ip-addresses/)
[uscert_hidden_cobra](http://iplists.firehol.org/?ipset=uscert_hidden_cobra)|Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace. DHS and FBI assess that HIDDEN COBRA actors will continue to use cyber operations to advance their government’s military and strategic objectives. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware. Variants of malware and tools used by HIDDEN COBRA actors include Destover, Wild Positron/Duuzer and Hangman.|ipv4 hash:ip|627 unique IPs|updated every 1 day from [this link](https://www.us-cert.gov/sites/default/files/publications/TA-17-164A_csv.csv)
[voipbl](http://iplists.firehol.org/?ipset=voipbl)|[VoIPBL.org](http://www.voipbl.org/) a distributed VoIP blacklist that is aimed to protects against VoIP Fraud and minimizing abuse for network that have publicly accessible PBX's. Several algorithms, external sources and manual confirmation are used before they categorize something as an attack and determine the threat level.|ipv4 hash:net|57978 subnets, 76250 unique IPs|updated every 4 hours from [this link](http://www.voipbl.org/update/)
[vxvault](http://iplists.firehol.org/?ipset=vxvault)|[VxVault](http://vxvault.net) The latest 100 additions of VxVault.|ipv4 hash:ip|56 unique IPs|updated every 12 hours from [this link](http://vxvault.net/ViriList.php?s=0&m=100)
[xforce_bccs](http://iplists.firehol.org/?ipset=xforce_bccs)|[IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/) Botnet Command and Control Servers|ipv4 hash:ip|416 unique IPs|updated every 1 day from [this link](https://api.xforce.ibmcloud.com/taxii)
[xroxy](http://iplists.firehol.org/?ipset=xroxy)|[xroxy.com](http://www.xroxy.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|17 unique IPs|updated every 1 hour from [this link](http://www.xroxy.com/proxyrss.xml)
[xroxy_1d](http://iplists.firehol.org/?ipset=xroxy_1d)|[xroxy.com](http://www.xroxy.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|17 unique IPs|updated every 1 hour from [this link](http://www.xroxy.com/proxyrss.xml)
[xroxy_30d](http://iplists.firehol.org/?ipset=xroxy_30d)|[xroxy.com](http://www.xroxy.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|76 unique IPs|updated every 1 hour from [this link](http://www.xroxy.com/proxyrss.xml)
[xroxy_7d](http://iplists.firehol.org/?ipset=xroxy_7d)|[xroxy.com](http://www.xroxy.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|45 unique IPs|updated every 1 hour from [this link](http://www.xroxy.com/proxyrss.xml)
[yoyo_adservers](http://iplists.firehol.org/?ipset=yoyo_adservers)|[Yoyo.org](http://pgl.yoyo.org/adservers/) IPs of ad servers|ipv4 hash:ip|9216 unique IPs|updated every 12 hours from [this link](http://pgl.yoyo.org/adservers/iplist.php?ipformat=plain&showintro=0&mimetype=plaintext)
zeus|[Abuse.ch Zeus tracker](https://zeustracker.abuse.ch) standard, contains the same data as the ZeuS IP blocklist (zeus_badips) but with the slight difference that it doesn't exclude hijacked websites (level 2) and free web hosting providers (level 3). This means that this blocklist contains all IPv4 addresses associated with ZeuS C&Cs which are currently being tracked by ZeuS Tracker. Hence this blocklist will likely cause some false positives.|ipv4 hash:ip|disabled|updated every 30 mins from [this link](https://zeustracker.abuse.ch/blocklist.php?download=ipblocklist)
zeus_badips|[Abuse.ch Zeus tracker](https://zeustracker.abuse.ch) badips includes IPv4 addresses that are used by the ZeuS trojan. It is the recommened blocklist if you want to block only ZeuS IPs. It excludes IP addresses that ZeuS Tracker believes to be hijacked (level 2) or belong to a free web hosting provider (level 3). Hence the false postive rate should be much lower compared to the standard ZeuS IP blocklist.|ipv4 hash:ip|disabled|updated every 30 mins from [this link](https://zeustracker.abuse.ch/blocklist.php?download=badips)

639
alienvault_reputation.ipset Normal file
View File

@ -0,0 +1,639 @@
#
# alienvault_reputation
#
# ipv4 hash:ip ipset
#
# [AlienVault.com] (https://www.alienvault.com/) IP
# reputation database
#
# Maintainer : Alien Vault
# Maintainer URL : https://www.alienvault.com/
# List source URL : https://reputation.alienvault.com/reputation.generic
# Source File Date: Fri Nov 12 14:10:50 UTC 2021
#
# Category : reputation
# Version : 4236
#
# This File Date : Fri Nov 12 15:52:25 UTC 2021
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 609 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=alienvault_reputation
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.34.58.110
1.34.226.50
1.161.219.86
1.171.103.192
1.173.242.161
1.246.222.20
1.246.222.134
1.246.222.234
1.246.223.191
2.106.156.53
3.21.74.31
4.71.37.45
4.71.37.46
14.34.157.101
14.42.145.172
14.111.220.134
14.241.244.250
18.117.69.135
18.188.148.80
23.247.108.44
24.188.100.85
27.21.147.209
27.35.154.75
27.38.61.75
27.38.61.120
27.41.36.239
27.43.119.144
27.43.178.112
27.47.116.249
27.158.79.129
27.159.92.181
27.194.89.189
27.194.122.23
27.197.24.223
27.199.237.162
27.203.233.132
27.207.195.126
27.215.53.111
27.215.109.196
27.215.114.223
27.215.122.160
27.217.163.40
27.217.243.163
36.228.50.77
36.231.35.185
37.0.10.31
39.66.73.50
39.74.177.167
39.81.71.78
41.86.5.232
41.86.18.34
41.86.18.165
41.86.19.146
42.51.55.157
42.115.33.98
42.228.193.67
42.231.171.245
43.251.99.6
44.192.244.178
45.146.164.110
45.229.54.55
45.229.54.83
45.229.54.143
45.229.54.193
45.229.54.199
45.229.54.212
45.229.55.57
45.229.55.69
45.229.55.112
45.248.192.48
46.4.123.15
46.101.13.94
46.183.218.151
49.76.60.132
49.89.62.252
49.89.90.173
49.89.93.21
49.89.95.159
49.143.32.6
49.158.196.18
49.213.183.219
49.213.187.246
51.15.228.117
51.15.246.104
51.158.64.113
51.158.102.132
51.158.108.237
51.158.117.164
51.158.125.226
51.211.24.160
51.211.112.79
51.211.117.109
58.58.41.106
58.99.99.34
58.219.232.140
58.248.147.64
58.248.193.3
58.248.193.50
58.248.193.88
58.248.193.97
58.248.193.105
58.248.193.132
58.248.193.141
58.248.193.232
58.248.193.246
58.249.12.95
58.249.87.78
58.249.110.198
58.253.12.9
59.63.204.76
59.63.204.245
59.63.207.69
59.126.96.5
59.127.209.88
59.175.63.89
60.212.108.240
60.244.133.195
61.0.168.149
61.129.101.38
61.152.197.56
61.219.98.43
61.224.147.178
61.242.40.14
61.242.40.17
61.242.40.204
61.242.40.206
61.242.40.212
61.242.40.225
61.242.40.229
61.242.40.245
61.242.54.5
61.242.54.16
61.242.54.48
61.242.54.49
61.242.54.60
61.242.54.62
61.242.54.126
61.242.54.137
61.242.54.170
61.242.54.175
61.242.54.203
61.242.54.211
61.242.54.214
61.242.54.239
61.242.54.242
61.242.54.249
61.242.58.12
61.242.58.14
61.242.58.47
61.242.58.66
61.242.58.67
61.242.58.104
61.242.58.135
61.242.58.178
61.242.58.197
61.242.58.200
61.242.58.239
61.242.58.246
62.4.14.198
62.16.41.210
62.171.159.207
62.219.229.190
64.39.108.94
65.108.11.163
68.183.107.64
69.55.55.230
69.176.89.226
70.50.152.130
70.50.155.251
71.68.229.247
78.142.18.56
78.154.219.169
78.186.248.243
78.187.196.38
78.188.240.230
79.170.30.142
80.14.216.204
80.82.65.247
80.243.181.81
80.243.181.119
81.214.72.215
81.250.169.249
83.138.53.128
84.53.229.12
85.71.26.28
86.157.2.211
86.161.0.86
86.175.105.80
86.181.4.169
89.40.73.14
89.208.122.213
91.104.31.56
91.188.215.198
91.234.62.231
93.51.27.113
93.65.23.221
93.112.152.134
94.156.58.17
95.137.248.182
100.27.42.241
100.27.42.242
100.27.42.243
100.27.42.244
101.0.32.22
101.0.41.25
101.0.57.60
101.0.57.158
101.22.144.130
101.65.131.144
101.181.0.198
101.181.17.112
101.181.17.137
101.181.26.186
101.181.27.80
101.181.34.69
101.181.40.233
101.181.60.181
101.181.68.79
101.181.73.91
101.181.82.102
101.181.98.158
101.181.102.108
101.181.104.241
101.181.114.172
101.181.132.37
103.37.3.58
103.40.172.173
103.40.172.189
103.40.196.2
103.40.196.24
103.40.197.24
103.40.197.175
103.91.19.231
103.91.245.48
103.104.106.98
103.104.106.223
103.119.55.151
103.136.82.50
103.170.92.5
103.170.92.7
103.170.92.10
103.170.92.11
103.170.92.22
103.206.21.107
103.215.240.1
103.231.172.42
104.131.14.192
104.131.82.45
104.248.162.33
106.104.116.79
109.116.204.63
109.123.118.38
110.25.95.241
110.35.227.222
110.89.11.143
110.251.198.23
111.38.106.48
111.92.75.188
111.92.75.217
111.92.116.45
111.165.36.134
111.185.227.109
111.185.228.37
111.202.167.22
111.202.190.6
111.252.213.245
112.5.37.160
112.6.221.37
112.27.124.111
112.27.124.130
112.27.124.145
112.27.124.158
112.30.4.73
112.30.4.118
112.31.87.98
112.31.211.135
112.86.255.100
112.94.96.114
112.94.97.85
112.94.97.166
112.94.98.6
112.94.98.57
112.94.98.71
112.94.98.151
112.94.99.84
112.94.99.86
112.94.99.93
112.94.99.139
112.94.101.190
112.94.101.203
112.94.101.235
112.105.10.251
112.235.46.128
112.237.2.80
112.239.103.43
112.239.120.150
112.248.109.159
112.250.243.72
112.251.18.12
112.255.126.89
113.170.128.242
113.246.130.182
113.251.235.19
114.33.64.24
114.33.190.246
114.34.135.57
114.35.131.161
114.35.175.239
114.35.194.18
114.36.34.63
114.41.226.96
114.236.52.101
114.239.51.77
114.246.35.129
115.51.122.143
115.58.202.92
115.62.58.10
115.165.221.95
116.2.173.20
116.68.99.71
116.211.100.26
116.212.156.31
117.36.199.38
117.87.18.27
117.95.137.93
117.204.149.200
117.208.51.51
117.240.142.212
118.79.140.135
118.161.210.248
118.250.154.242
119.29.119.174
119.122.114.138
119.165.111.147
119.179.238.100
119.191.160.221
119.191.217.155
119.224.91.233
120.1.140.25
120.85.92.40
120.85.93.174
120.85.94.182
120.85.97.71
120.85.112.124
120.85.112.128
120.85.112.133
120.85.113.42
120.85.113.55
120.85.113.120
120.85.113.253
120.85.114.64
120.85.114.146
120.85.114.164
120.85.114.188
120.85.115.2
120.85.115.46
120.85.115.49
120.85.115.60
120.85.115.75
120.85.115.104
120.85.115.148
120.85.115.175
120.85.115.197
120.85.115.225
120.85.116.17
120.85.116.69
120.85.116.70
120.85.116.133
120.85.116.230
120.85.116.238
120.85.117.207
120.85.118.78
120.85.118.161
120.85.118.169
120.85.118.195
120.85.118.219
120.85.118.227
120.85.118.235
120.85.118.238
120.85.148.26
120.85.149.112
120.85.172.249
120.86.236.214
120.86.236.217
120.86.237.94
120.86.237.166
120.86.238.47
120.86.238.188
120.86.239.97
120.86.239.154
120.86.254.133
120.86.254.188
120.86.255.109
120.86.255.247
120.193.91.183
120.193.91.190
120.193.91.215
120.226.28.53
120.226.28.55
120.226.28.56
120.238.189.72
120.240.48.83
120.240.48.91
121.5.155.158
121.46.232.130
121.61.98.22
121.206.154.132
122.96.12.203
122.116.229.208
122.116.240.129
122.117.28.200
122.117.212.66
122.147.22.146
122.147.62.76
122.173.23.55
122.188.150.21
122.254.29.23
123.10.15.34
123.11.152.93
123.12.23.5
123.110.213.41
123.205.156.212
124.131.55.15
124.153.136.175
125.44.11.69
125.63.105.55
125.127.132.112
125.127.139.69
125.128.28.181
125.168.147.202
125.224.126.41
125.228.33.211
125.228.43.197
125.228.89.178
125.228.90.229
134.209.218.203
137.184.62.180
140.206.86.124
146.70.34.2
156.251.136.4
157.61.212.1
157.61.212.29
157.61.212.37
157.61.212.41
157.61.212.44
157.61.212.47
157.61.212.55
157.61.212.57
157.61.212.59
157.61.212.64
157.61.212.78
157.61.212.82
157.61.212.84
157.61.212.85
157.61.212.87
157.61.212.88
157.61.212.95
157.61.212.101
157.61.212.104
157.61.212.109
157.61.212.111
157.61.212.117
157.61.212.122
157.61.213.140
157.61.213.146
157.61.213.149
157.61.213.165
157.61.213.174
157.61.213.179
157.61.213.238
157.61.213.240
159.203.186.159
160.124.138.190
161.22.34.116
161.97.143.54
163.125.211.103
163.125.211.119
163.125.211.144
163.172.140.20
163.172.176.168
163.179.167.155
163.204.211.80
164.155.88.34
165.227.74.61
165.227.84.230
167.71.249.184
167.172.59.207
170.247.76.178
170.247.76.179
174.83.73.163
175.9.135.33
175.10.19.32
175.11.64.24
175.183.4.23
175.183.16.135
176.103.88.57
176.111.173.122
176.111.173.139
176.221.206.115
177.149.164.24
178.18.254.229
178.72.69.78
178.72.70.88
178.72.70.112
178.72.70.124
178.72.70.207
178.72.70.239
178.72.76.2
178.72.78.156
178.72.78.202
178.141.14.216
180.151.24.60
180.176.99.48
180.188.232.122
180.188.232.137
180.188.237.170
181.176.155.25
181.199.162.7
181.199.170.222
182.52.136.45
182.115.173.95
182.124.92.70
182.155.120.143
182.166.180.194
182.235.208.124
183.82.144.126
183.161.1.19
183.237.146.175
183.237.146.206
184.58.233.179
185.68.230.207
185.128.41.50
185.142.239.135
185.191.32.158
185.191.246.45
185.232.64.32
186.33.90.249
186.250.115.93
187.45.116.162
188.169.36.27
188.169.174.166
190.180.154.227
192.3.194.202
193.169.252.158
193.169.252.166
193.169.252.245
195.208.154.9
198.98.62.43
201.71.186.178
201.184.16.244
201.184.49.234
201.184.54.178
201.184.54.179
201.184.54.180
201.184.64.238
201.184.89.98
202.129.58.130
202.164.138.157
202.164.139.168
202.164.139.218
202.164.139.229
203.176.129.73
203.248.175.71
203.248.175.72
206.189.111.16
207.180.219.238
210.13.110.60
210.89.63.21
210.89.63.231
210.89.63.245
210.108.70.119
210.180.237.212
211.47.83.200
211.149.191.209
212.129.26.4
212.193.30.144
213.5.47.43
216.4.95.61
216.4.95.62
218.29.126.53
218.31.123.90
218.161.106.26
219.68.238.49
219.69.110.206
219.136.172.161
219.138.140.114
219.157.139.165
220.133.64.233
220.134.64.169
220.134.206.134
220.134.236.78
220.135.135.44
220.135.241.12
220.143.33.129
221.1.225.191
221.1.226.15
221.160.177.119
221.231.169.141
222.77.181.28
222.118.4.29
222.138.119.194
222.240.117.88
222.247.5.78
222.253.45.141
223.130.31.57
223.149.1.211
223.149.140.37
223.155.34.126
223.159.88.8

30
asprox_c2.ipset Normal file
View File

@ -0,0 +1,30 @@
#
# asprox_c2
#
# ipv4 hash:ip ipset
#
# [h3x.eu] (http://atrack.h3x.eu/) ASPROX Tracker - Asprox
# C&C Sites
#
# Maintainer : h3x.eu
# Maintainer URL : http://atrack.h3x.eu/
# List source URL : http://atrack.h3x.eu/c2
# Source File Date: Mon Nov 6 03:04:11 UTC 2017
#
# Category : malware
# Version : 1
#
# This File Date : Sun Jun 3 05:36:21 UTC 2018
# Update Frequency: 1 day
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=asprox_c2
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

167
bambenek_banjori.ipset Normal file
View File

@ -0,0 +1,167 @@
#
# bambenek_banjori
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of banjori C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/banjori-iplist.txt
# Source File Date: Wed Jul 29 20:05:53 UTC 2020
#
# Category : malware
# Version : 17534
#
# This File Date : Wed Jul 29 20:12:14 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 136 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_banjori
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
3.216.121.17
5.79.79.212
13.59.74.74
14.192.4.75
18.213.250.117
18.215.128.143
23.89.20.107
23.89.102.123
23.107.124.53
23.110.15.74
23.226.53.226
23.227.38.65
23.231.218.195
23.236.62.147
34.98.99.30
34.102.136.180
35.186.238.101
35.226.69.129
43.230.142.125
43.241.196.105
43.249.76.176
47.91.170.222
47.245.10.59
50.117.86.130
52.4.209.250
52.25.92.0
52.58.78.16
54.65.172.3
54.85.65.140
62.149.142.219
67.20.112.155
74.208.236.219
74.220.199.8
78.24.9.52
78.46.156.194
81.169.145.88
81.169.145.159
81.169.145.160
81.169.145.161
89.188.24.70
92.53.96.22
94.130.109.30
95.211.75.10
96.30.52.60
103.70.226.182
104.24.102.57
104.24.103.57
104.24.108.92
104.24.109.92
104.164.181.36
104.171.23.69
104.171.23.70
107.165.137.88
107.180.26.185
108.59.12.99
108.59.12.101
109.70.4.246
109.71.54.17
112.78.125.29
112.121.187.246
119.3.179.174
119.188.157.23
121.40.153.149
121.54.175.96
122.10.99.22
130.211.40.170
133.130.35.90
133.242.195.32
134.73.61.187
137.175.15.6
145.131.10.247
149.255.58.42
150.95.255.38
154.95.106.131
154.195.133.14
154.195.209.90
154.201.77.14
154.213.139.148
154.216.122.13
154.216.243.104
156.224.61.139
156.225.101.57
156.238.79.182
156.247.12.40
156.250.218.137
158.177.208.8
160.121.36.178
160.153.96.67
162.209.205.67
162.210.102.66
162.210.195.111
163.43.102.74
169.50.13.61
169.50.57.89
172.67.143.254
172.67.211.10
172.106.32.42
175.29.102.46
178.22.59.66
180.153.100.94
185.104.45.33
185.135.241.4
185.216.113.170
186.202.153.222
192.169.243.26
192.190.87.140
193.222.100.37
196.22.132.17
198.23.48.104
198.38.83.24
198.54.117.197
198.54.117.198
198.54.117.199
198.54.117.200
198.54.121.133
199.58.179.10
199.59.242.153
202.124.241.178
202.181.97.76
202.254.234.152
203.156.192.80
208.73.210.202
208.73.210.217
208.73.211.165
208.73.211.177
208.91.197.91
208.109.80.14
212.12.54.87
213.176.50.208
213.186.33.5
216.40.47.17
217.26.53.16
217.26.63.20
217.70.184.38
219.118.71.121
219.235.5.224

31
bambenek_bebloh.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_bebloh
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of bebloh C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/bebloh-iplist.txt
# Source File Date: Thu Jun 7 00:02:37 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:33 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_bebloh
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

32
bambenek_c2.ipset Normal file
View File

@ -0,0 +1,32 @@
#
# bambenek_c2
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) master feed of
# known, active and non-sinkholed C&Cs IP addresses
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/c2-ipmasterlist.txt
# Source File Date: Wed Jan 5 14:31:38 UTC 2022
#
# Category : malware
# Version : 16213
#
# This File Date : Thu Jan 6 06:56:05 UTC 2022
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_c2
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
127.200.200.200

31
bambenek_cl.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_cl
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of cl C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/cl-iplist.txt
# Source File Date: Fri Dec 14 00:05:01 UTC 2018
#
# Category : malware
# Version : 18
#
# This File Date : Fri Dec 14 00:08:08 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_cl
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

31
bambenek_cryptowall.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_cryptowall
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of cryptowall C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/cryptowall-iplist.txt
# Source File Date: Thu Dec 3 12:25:05 UTC 2015
#
# Category : malware
# Version : 5
#
# This File Date : Thu Jun 7 00:08:34 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_cryptowall
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

33
bambenek_dircrypt.ipset Normal file
View File

@ -0,0 +1,33 @@
#
# bambenek_dircrypt
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of dircrypt C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/dircrypt-iplist.txt
# Source File Date: Sat Jul 18 09:06:23 UTC 2020
#
# Category : malware
# Version : 260
#
# This File Date : Sat Jul 18 09:08:07 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 2 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_dircrypt
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
164.155.216.36
169.50.13.61

31
bambenek_dyre.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_dyre
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of dyre C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/dyre-iplist.txt
# Source File Date: Thu Jun 7 00:03:08 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:34 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_dyre
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

31
bambenek_geodo.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_geodo
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of geodo C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/geodo-iplist.txt
# Source File Date: Thu Jun 7 00:02:33 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:34 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_geodo
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

33
bambenek_hesperbot.ipset Normal file
View File

@ -0,0 +1,33 @@
#
# bambenek_hesperbot
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of hesperbot C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/hesperbot-iplist.txt
# Source File Date: Sat Jul 18 10:07:53 UTC 2020
#
# Category : malware
# Version : 234
#
# This File Date : Sat Jul 18 10:12:32 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 2 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_hesperbot
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
72.5.161.7
164.155.219.11

32
bambenek_matsnu.ipset Normal file
View File

@ -0,0 +1,32 @@
#
# bambenek_matsnu
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of matsnu C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/matsnu-iplist.txt
# Source File Date: Mon Jul 27 04:09:06 UTC 2020
#
# Category : malware
# Version : 522
#
# This File Date : Mon Jul 27 04:12:41 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_matsnu
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
64.207.152.130

44
bambenek_necurs.ipset Normal file
View File

@ -0,0 +1,44 @@
#
# bambenek_necurs
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of necurs C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/necurs-iplist.txt
# Source File Date: Wed Jul 29 01:11:02 UTC 2020
#
# Category : malware
# Version : 10186
#
# This File Date : Wed Jul 29 01:16:08 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 13 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_necurs
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
40.121.206.97
64.47.209.23
64.63.188.85
64.231.250.149
65.79.10.48
65.159.138.178
66.7.34.215
66.247.157.54
68.199.246.20
69.47.125.180
69.79.159.208
70.23.145.183
70.63.91.183

31
bambenek_p2pgoz.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_p2pgoz
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of p2pgoz C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/p2pgoz-iplist.txt
# Source File Date: Sun Jul 26 15:10:57 UTC 2020
#
# Category : malware
# Version : 478
#
# This File Date : Sun Jul 26 15:16:09 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_p2pgoz
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

31
bambenek_pushdo.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_pushdo
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of pushdo C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/pushdo-iplist.txt
# Source File Date: Sat Jun 20 05:15:31 UTC 2020
#
# Category : malware
# Version : 12
#
# This File Date : Sat Jun 20 05:20:06 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_pushdo
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

36
bambenek_pykspa.ipset Normal file
View File

@ -0,0 +1,36 @@
#
# bambenek_pykspa
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of pykspa C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/pykspa-iplist.txt
# Source File Date: Wed Jul 29 04:13:10 UTC 2020
#
# Category : malware
# Version : 1373
#
# This File Date : Wed Jul 29 04:16:06 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 5 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_pykspa
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
40.255.0.62
78.47.106.15
169.50.13.61
189.50.110.40
193.146.253.37

33
bambenek_qakbot.ipset Normal file
View File

@ -0,0 +1,33 @@
#
# bambenek_qakbot
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of qakbot C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/qakbot-iplist.txt
# Source File Date: Sun Jul 26 12:13:39 UTC 2020
#
# Category : malware
# Version : 453
#
# This File Date : Sun Jul 26 12:16:47 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 2 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_qakbot
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
72.26.218.72
199.21.76.82

129
bambenek_ramnit.ipset Normal file
View File

@ -0,0 +1,129 @@
#
# bambenek_ramnit
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of ramnit C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/ramnit-iplist.txt
# Source File Date: Wed Jul 29 20:18:04 UTC 2020
#
# Category : malware
# Version : 3671
#
# This File Date : Wed Jul 29 20:24:06 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 98 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_ramnit
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.180.102.147
13.90.196.81
18.213.250.117
18.215.128.143
34.197.76.50
34.225.182.233
35.224.11.86
46.17.47.67
46.165.220.141
46.165.220.142
46.165.220.143
46.165.220.144
46.165.220.145
46.165.220.146
46.165.220.147
46.165.220.148
46.165.220.149
46.165.220.150
46.165.220.151
46.165.220.152
46.165.220.153
46.165.220.154
46.165.220.155
46.165.221.136
46.165.221.144
46.165.221.154
46.165.229.164
46.165.229.165
46.165.229.166
46.165.229.167
46.165.254.193
46.165.254.194
46.165.254.195
46.165.254.196
46.165.254.197
46.165.254.198
46.165.254.199
46.165.254.200
46.165.254.201
46.165.254.202
46.165.254.203
46.165.254.204
46.165.254.205
46.165.254.206
46.165.254.207
46.165.254.208
46.165.254.209
46.165.254.210
46.165.254.211
46.165.254.212
46.165.254.213
46.165.254.214
47.91.170.222
52.4.209.250
72.26.218.70
82.112.184.197
88.212.208.67
109.248.10.176
154.216.211.122
160.16.199.126
160.16.223.90
164.155.216.31
169.50.13.61
173.239.5.6
173.239.8.164
178.33.69.68
193.146.253.36
193.146.253.38
193.146.253.44
194.67.71.41
194.67.71.114
208.91.197.66
213.186.33.19
213.247.47.190
217.20.116.129
217.20.116.130
217.20.116.131
217.20.116.132
217.20.116.133
217.20.116.134
217.20.116.135
217.20.116.136
217.20.116.137
217.20.116.138
217.20.116.139
217.20.116.140
217.20.116.141
217.20.116.142
217.20.116.143
217.20.116.145
217.20.116.146
217.20.116.147
217.20.116.148
217.20.116.149
217.20.116.150
217.20.116.151
217.20.116.152
217.20.116.153

31
bambenek_ranbyus.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_ranbyus
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of ranbyus C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/ranbyus-iplist.txt
# Source File Date: Thu Feb 14 14:06:27 UTC 2019
#
# Category : malware
# Version : 101
#
# This File Date : Thu Feb 14 14:12:10 UTC 2019
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_ranbyus
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

162
bambenek_simda.ipset Normal file
View File

@ -0,0 +1,162 @@
#
# bambenek_simda
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of simda C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/simda-iplist.txt
# Source File Date: Wed Jul 29 20:19:03 UTC 2020
#
# Category : malware
# Version : 17362
#
# This File Date : Wed Jul 29 20:24:07 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 131 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_simda
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.157.84.170
14.128.136.68
23.89.102.127
23.236.62.147
31.11.32.144
31.186.169.41
31.217.192.121
34.98.99.30
34.102.136.180
45.82.253.244
46.28.105.107
46.30.215.127
46.30.215.202
46.242.242.252
46.249.43.105
52.25.92.0
52.58.78.16
54.65.172.3
62.97.115.37
62.129.200.14
62.149.128.72
62.149.128.74
62.149.128.151
62.149.128.154
62.149.128.157
62.149.128.160
62.149.128.163
62.149.128.166
62.149.181.236
62.153.122.95
67.229.36.115
69.162.80.54
69.162.80.58
77.111.240.49
77.111.240.59
79.170.40.236
80.85.86.6
80.237.132.180
81.2.194.62
81.2.194.128
81.2.194.176
81.169.145.68
81.169.145.84
81.169.145.93
81.169.145.94
81.169.145.105
81.169.145.161
81.177.165.51
82.98.135.43
82.100.220.53
84.38.224.155
85.13.129.76
85.13.132.239
85.114.135.128
85.128.185.12
85.236.47.218
87.98.230.60
88.198.56.106
89.31.143.1
89.46.108.57
91.121.59.137
91.121.154.229
91.174.205.10
91.195.241.136
91.199.77.50
91.212.28.29
91.223.145.130
92.43.203.171
92.61.39.239
93.185.103.42
93.190.48.3
94.152.8.56
95.211.117.215
95.211.219.65
104.27.180.160
104.27.181.160
104.28.26.243
104.28.27.243
104.28.28.252
104.28.29.252
116.202.231.184
141.105.126.87
146.148.34.125
149.216.106.61
157.7.188.207
162.217.99.134
162.255.119.102
163.172.86.124
169.50.13.61
172.67.156.67
172.67.157.206
172.67.184.127
173.236.178.74
178.254.10.14
185.26.105.244
185.51.65.38
185.66.237.14
185.114.108.15
185.181.104.74
185.183.8.67
185.232.248.163
188.93.150.101
188.165.143.5
192.64.147.231
193.41.64.176
194.9.94.85
194.9.94.86
194.150.113.18
194.242.61.31
195.74.38.62
195.110.124.188
199.34.228.76
199.59.242.153
205.144.171.124
208.91.197.91
209.140.30.61
210.172.183.32
211.43.203.53
212.57.32.149
212.85.106.71
213.186.33.5
217.70.184.38
217.74.71.168
217.116.16.235
217.160.0.59
217.160.0.97
217.160.0.169
217.160.0.225
217.160.0.239
217.160.122.61
217.160.233.84

139
bambenek_suppobox.ipset Normal file
View File

@ -0,0 +1,139 @@
#
# bambenek_suppobox
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of suppobox C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/suppobox-iplist.txt
# Source File Date: Wed Jul 29 20:19:32 UTC 2020
#
# Category : malware
# Version : 9682
#
# This File Date : Wed Jul 29 20:24:08 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 108 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_suppobox
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
18.216.20.136
23.83.35.75
23.227.38.65
23.236.62.147
34.102.136.180
34.198.7.77
34.202.122.77
34.225.38.128
35.169.225.248
35.186.238.101
35.231.184.193
39.106.40.57
43.226.23.42
45.133.2.132
45.192.23.245
45.199.245.19
46.30.213.209
46.166.189.98
52.0.7.30
54.36.56.87
54.84.104.245
62.233.121.5
63.251.235.71
66.6.44.4
66.96.161.157
67.195.197.24
67.227.226.240
69.163.184.176
69.172.201.218
72.26.218.72
74.96.70.52
74.208.236.135
75.2.37.224
80.77.123.65
81.28.232.67
83.140.241.13
84.49.232.107
87.98.242.65
89.106.12.49
94.136.40.82
95.143.172.148
97.74.182.1
98.124.199.77
103.67.235.120
104.16.12.194
104.16.13.194
104.16.14.194
104.16.15.194
104.16.16.194
104.27.188.229
104.27.189.229
104.248.50.87
104.248.60.43
104.248.63.231
104.248.63.248
106.249.28.73
112.216.156.206
121.42.239.99
121.78.197.82
121.254.178.233
137.220.193.208
138.207.69.72
139.129.156.33
150.95.255.38
151.80.184.231
154.208.167.236
157.65.171.29
157.245.130.6
159.8.210.35
161.47.102.211
162.217.99.134
162.217.99.139
162.217.99.141
162.241.194.34
162.241.224.134
162.241.224.200
162.243.212.245
162.255.119.8
162.255.119.250
172.67.154.177
173.231.184.119
173.231.189.30
173.236.166.37
185.55.85.123
192.64.119.20
192.64.119.148
192.64.119.202
192.227.107.19
193.93.253.54
194.59.222.76
198.54.117.197
198.54.117.198
198.54.117.199
198.54.117.200
199.34.228.69
199.59.242.153
206.191.152.37
206.191.152.49
207.96.1.77
208.91.197.26
208.91.197.27
208.91.197.46
208.91.197.91
208.91.197.194
212.96.137.160
213.186.33.5
213.250.113.193
217.160.0.16

32
bambenek_symmi.ipset Normal file
View File

@ -0,0 +1,32 @@
#
# bambenek_symmi
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of symmi C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/symmi-iplist.txt
# Source File Date: Fri Jun 26 10:49:11 UTC 2020
#
# Category : malware
# Version : 14
#
# This File Date : Fri Jun 26 10:56:26 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_symmi
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
208.100.26.245

35
bambenek_tinba.ipset Normal file
View File

@ -0,0 +1,35 @@
#
# bambenek_tinba
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of tinba C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/tinba-iplist.txt
# Source File Date: Wed Jul 29 16:20:23 UTC 2020
#
# Category : malware
# Version : 3576
#
# This File Date : Wed Jul 29 16:24:10 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 4 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_tinba
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
198.54.117.197
198.54.117.198
198.54.117.199
198.54.117.200

32
bambenek_volatile.ipset Normal file
View File

@ -0,0 +1,32 @@
#
# bambenek_volatile
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of volatile C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/volatile-iplist.txt
# Source File Date: Fri Feb 7 15:08:38 UTC 2020
#
# Category : malware
# Version : 10
#
# This File Date : Fri Feb 7 15:12:21 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_volatile
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
169.50.13.61

2717
bbcan177_ms1.netset Normal file
View File

File diff suppressed because it is too large Load Diff

1175
bbcan177_ms3.netset Normal file
View File

File diff suppressed because it is too large Load Diff

651
bds_atif.ipset Normal file
View File

@ -0,0 +1,651 @@
#
# bds_atif
#
# ipv4 hash:ip ipset
#
# Artillery Threat Intelligence Feed and Banlist Feed
#
# Maintainer : Binary Defense Systems
# Maintainer URL : https://www.binarydefense.com/
# List source URL : https://www.binarydefense.com/banlist.txt
# Source File Date: Sun May 19 16:57:00 UTC 2024
#
# Category : reputation
# Version : 2087
#
# This File Date : Sun May 19 17:08:42 UTC 2024
# Update Frequency: 1 day
# Aggregation : none
# Entries : 622 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bds_atif
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.41.36.173
1.84.89.56
1.179.153.18
2.60.243.50
2.182.1.32
2.182.1.198
3.8.3.244
4.151.219.112
4.246.247.107
5.20.243.162
5.32.176.110
5.113.90.176
5.147.79.84
5.200.73.114
8.130.40.101
8.137.55.67
13.91.164.0
13.91.165.251
13.91.166.22
13.91.180.187
14.97.235.138
14.152.70.100
14.204.167.184
20.15.229.56
20.118.69.178
20.118.71.64
20.223.168.112
23.94.28.170
24.144.96.191
24.234.55.153
27.64.26.96
31.170.49.10
34.76.96.55
34.76.158.233
35.187.125.4
35.203.211.245
35.216.153.140
36.32.3.235
36.88.16.31
36.91.222.100
38.255.32.225
39.49.101.45
39.91.167.2
39.153.252.196
41.38.39.221
41.205.77.46
41.220.231.243
42.51.227.67
43.134.66.207
43.230.202.34
44.220.185.68
44.220.188.137
45.33.80.243
45.64.166.105
45.77.219.154
45.79.181.104
45.79.181.179
45.79.181.251
45.83.65.26
45.88.186.115
45.95.169.105
45.128.232.152
45.142.182.70
45.147.250.233
45.156.128.45
45.156.129.17
45.156.129.20
45.156.129.46
45.186.203.209
45.227.254.8
45.227.254.9
45.227.254.26
45.227.254.49
45.227.254.54
45.227.254.55
45.245.213.10
46.10.20.145
46.19.143.42
46.105.132.55
46.217.214.59
47.74.96.31
47.76.140.201
47.117.134.97
47.236.97.175
47.236.198.172
47.237.95.176
49.206.113.229
49.231.13.136
50.193.87.252
51.8.97.78
51.36.227.142
51.79.253.49
58.27.230.131
58.218.204.183
58.220.24.41
59.57.183.116
59.125.213.161
59.153.18.93
59.184.54.220
60.13.138.94
60.248.136.147
61.158.26.7
61.177.172.136
61.177.172.140
61.177.172.160
61.177.172.179
62.210.136.165
62.213.82.18
64.62.156.67
64.62.156.68
64.62.156.108
64.62.197.4
64.62.197.31
64.62.197.163
64.62.197.187
64.62.197.217
64.124.50.139
64.222.77.122
65.49.1.10
65.49.1.57
65.49.1.116
65.49.20.69
65.49.20.70
65.49.20.74
66.175.213.4
66.240.236.116
68.183.4.174
69.10.62.82
71.6.134.232
71.6.134.233
71.60.31.70
71.251.217.67
74.50.94.158
74.82.47.2
74.82.47.4
74.82.47.5
74.82.47.38
74.82.47.62
74.208.133.180
74.221.147.117
78.30.197.146
78.38.46.93
78.109.53.125
78.184.140.13
79.124.59.10
79.127.96.237
80.60.53.235
80.66.66.17
80.66.76.66
80.66.76.121
80.66.76.134
80.75.212.75
80.76.49.131
80.76.49.133
80.82.37.71
81.19.135.47
81.30.157.101
81.209.147.6
81.209.179.151
81.209.179.152
81.209.179.153
81.209.179.157
81.209.179.158
83.97.73.245
84.54.51.13
84.195.90.253
85.193.65.55
85.209.11.27
85.209.11.227
85.209.11.254
87.98.138.142
87.121.69.25
87.121.69.52
87.236.176.28
87.236.176.31
87.236.176.43
87.236.176.44
87.236.176.47
87.236.176.76
87.236.176.98
87.236.176.109
87.236.176.153
87.236.176.165
87.236.176.170
87.236.176.185
87.236.176.209
87.236.176.216
87.236.176.247
87.246.7.62
87.251.75.145
88.121.196.192
88.247.139.213
88.248.135.117
89.165.2.25
89.245.98.115
90.153.95.158
90.154.15.226
91.92.245.67
91.92.248.133
91.92.251.110
91.92.251.164
91.144.130.67
91.185.16.106
91.238.181.71
91.243.50.206
92.51.72.10
92.118.39.120
92.118.39.229
92.118.57.249
93.61.76.164
93.158.228.88
93.174.95.106
94.134.165.21
94.154.35.97
94.156.66.92
94.156.68.241
94.156.68.243
94.156.68.244
94.156.68.250
94.156.68.251
94.156.68.253
94.156.68.254
94.156.71.233
94.231.192.184
94.232.46.148
95.57.218.103
95.214.53.107
95.214.55.144
101.24.125.217
102.129.138.53
102.129.139.237
103.42.205.11
103.54.12.18
103.73.102.106
103.88.112.162
103.115.236.19
103.132.170.9
103.168.97.11
103.179.184.81
103.237.87.24
103.241.100.145
103.245.236.243
103.249.204.170
103.250.146.90
104.131.144.24
104.152.52.124
104.152.52.213
104.156.155.18
105.156.173.34
106.75.18.235
106.75.92.88
106.75.98.123
106.75.173.108
106.75.173.226
106.75.174.148
107.11.227.152
107.170.208.5
107.170.208.23
107.170.235.19
107.170.241.7
107.170.241.11
107.170.242.19
107.170.245.12
107.170.248.13
107.170.249.19
107.170.254.28
107.174.45.13
109.123.242.76
109.206.237.69
109.206.237.100
109.206.237.207
109.206.237.232
111.67.193.162
111.173.80.107
112.4.139.162
112.170.231.166
112.220.104.18
112.220.104.19
113.22.85.22
113.104.10.160
113.117.105.98
113.179.140.213
113.222.236.38
115.231.78.12
115.238.44.234
116.7.97.218
116.140.196.215
116.193.221.34
117.54.18.44
117.119.85.54
117.187.124.131
117.204.206.155
117.240.158.77
118.26.39.172
118.161.19.206
118.193.32.92
118.193.39.183
118.193.59.10
118.194.229.98
118.194.250.2
118.195.180.63
118.212.120.37
119.45.118.68
119.96.55.122
119.147.212.2
119.200.18.235
120.46.54.173
120.82.67.17
120.224.132.168
121.35.254.78
121.224.67.188
122.172.80.226
122.173.29.245
122.224.37.86
123.25.240.175
123.214.144.50
123.247.103.12
124.107.138.186
124.217.125.212
125.143.254.221
125.228.185.114
128.1.43.245
128.199.4.111
128.254.192.17
129.213.17.61
131.234.28.53
136.226.250.113
137.184.255.42
138.0.216.10
138.197.177.111
139.59.23.204
139.59.212.88
141.95.141.217
141.98.7.152
141.98.7.181
141.98.11.176
142.4.218.114
142.115.248.29
143.110.159.86
143.110.228.8
143.110.230.36
143.198.98.179
143.198.142.187
144.126.212.189
144.217.53.236
146.190.119.189
146.190.174.211
147.135.75.138
147.182.204.168
149.28.37.33
149.50.110.239
152.32.159.180
152.32.174.186
152.32.183.213
152.32.206.246
152.32.215.244
152.32.216.28
152.230.127.126
154.53.51.229
154.212.141.176
154.212.141.203
154.213.17.252
156.196.139.230
157.97.121.191
157.245.92.19
157.245.98.245
158.69.238.253
159.89.173.204
159.89.239.238
159.203.72.133
159.203.208.34
159.223.73.195
161.35.32.85
161.129.37.59
162.142.125.8
162.142.125.113
162.142.125.117
162.142.125.215
162.142.125.217
162.142.125.220
162.216.149.73
162.243.131.15
162.243.135.40
162.243.138.50
162.243.187.214
163.179.126.128
164.92.92.104
164.92.108.184
164.92.111.165
164.155.205.109
165.22.34.73
165.154.42.209
165.154.138.33
165.154.182.72
165.227.87.78
167.71.136.189
167.71.160.126
167.94.138.53
167.94.138.61
167.94.138.62
167.94.138.113
167.94.138.116
167.94.138.119
167.94.145.98
167.94.145.101
167.94.145.104
167.94.145.105
167.94.145.107
167.94.145.109
167.94.145.111
167.94.146.48
167.94.146.52
167.94.146.53
167.94.146.56
167.94.146.60
167.94.146.61
167.99.124.104
167.248.133.40
167.248.133.56
167.248.133.115
167.248.133.124
167.248.133.179
168.149.62.66
172.89.65.248
172.104.11.4
172.104.11.51
172.105.77.209
172.105.128.11
172.105.128.12
172.212.59.227
172.212.60.93
172.232.250.114
172.233.26.204
173.255.221.189
175.196.233.106
175.200.58.141
176.236.79.238
177.71.101.168
178.128.66.56
178.128.249.105
178.244.230.74
179.43.188.106
179.127.252.234
180.92.238.69
180.101.88.196
180.101.88.197
180.101.88.205
180.101.88.218
180.167.46.169
180.246.102.107
180.249.196.101
180.251.159.46
181.115.156.154
181.129.13.100
181.212.89.146
182.73.11.238
182.176.117.190
182.181.138.3
182.232.211.196
183.2.185.124
183.26.2.189
183.26.2.191
183.81.169.139
183.81.169.238
183.107.174.187
183.134.88.66
183.134.104.170
184.88.140.81
184.105.139.69
184.105.139.70
184.105.139.113
184.105.139.121
184.105.247.254
184.168.31.252
185.16.38.111
185.74.5.181
185.74.6.207
185.91.127.46
185.122.204.169
185.139.228.190
185.156.175.171
185.170.144.3
185.180.140.4
185.180.140.6
185.180.143.178
185.196.8.151
185.234.216.122
185.242.226.25
185.242.226.46
186.4.233.202
187.75.152.79
187.135.64.214
187.217.183.149
187.224.20.235
187.235.186.151
187.251.108.233
188.170.73.246
189.39.66.220
189.112.8.204
189.115.34.54
189.129.86.160
189.203.207.15
189.254.197.174
190.107.216.3
190.151.5.180
191.180.168.68
192.99.31.245
192.155.90.220
192.241.146.194
192.241.207.46
192.241.209.25
192.241.218.40
192.241.222.67
193.34.216.137
193.201.9.156
194.0.127.102
194.165.16.10
194.165.16.11
194.165.16.37
194.165.16.72
194.165.16.73
194.165.16.76
194.165.16.78
194.169.175.19
194.169.175.35
194.169.175.36
194.242.122.223
195.1.144.107
195.245.152.246
196.188.115.241
196.189.185.250
196.202.50.244
197.156.67.166
197.248.54.193
198.199.94.6
198.199.101.116
198.199.107.110
198.199.115.27
198.235.24.8
198.235.24.18
198.235.24.40
198.235.24.43
198.235.24.46
198.235.24.48
198.235.24.64
198.235.24.81
198.235.24.91
198.235.24.114
198.235.24.123
198.235.24.129
198.235.24.134
198.235.24.168
198.235.24.174
198.235.24.195
198.235.24.196
198.235.24.201
198.235.24.203
198.235.24.206
198.235.24.217
198.235.24.221
198.235.24.239
198.235.24.240
199.45.154.17
199.45.154.19
199.45.154.57
199.45.154.75
199.45.154.79
200.24.217.90
201.6.220.6
201.71.2.28
201.97.144.56
202.59.160.130
202.72.242.139
202.107.226.5
202.125.139.10
203.55.196.146
203.146.190.62
203.210.240.63
205.210.31.41
205.210.31.45
205.210.31.75
205.210.31.94
205.210.31.98
205.210.31.101
205.210.31.107
205.210.31.130
205.210.31.162
205.210.31.217
205.210.31.220
205.210.31.225
205.210.31.234
205.210.31.236
205.210.31.242
206.206.107.15
207.192.215.26
207.201.196.35
211.252.164.21
212.70.149.142
213.6.195.66
213.32.39.43
213.109.202.230
213.165.233.124
216.218.206.66
218.13.128.236
218.92.0.22
218.92.0.24
218.92.0.27
218.92.0.29
218.92.0.31
218.92.0.34
218.92.0.56
218.92.0.76
218.92.0.107
218.92.0.112
218.92.0.113
218.92.0.118
220.82.146.218
220.82.166.157
221.122.67.75
222.186.13.132
222.216.206.99
223.206.55.89

1016
bitcoin_blockchain_info_1d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

8148
bitcoin_blockchain_info_30d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

2653
bitcoin_blockchain_info_7d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

5778
bitcoin_nodes.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

6929
bitcoin_nodes_1d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

13838
bitcoin_nodes_30d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

8713
bitcoin_nodes_7d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

24640
blocklist_de.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

9005
blocklist_de_apache.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

152
blocklist_de_bots.ipset Normal file
View File

@ -0,0 +1,152 @@
#
# blocklist_de_bots
#
# ipv4 hash:ip ipset
#
# [Blocklist.de] (https://www.blocklist.de/) All IP addresses
# which have been reported within the last 48 hours as having
# run attacks on the RFI-Attacks, REG-Bots, IRC-Bots or
# BadBots (BadBots = it has posted a Spam-Comment on a open
# Forum or Wiki).
#
# Maintainer : Blocklist.de
# Maintainer URL : https://www.blocklist.de/
# List source URL : http://lists.blocklist.de/lists/bots.txt
# Source File Date: Mon May 20 09:24:03 UTC 2024
#
# Category : attacks
# Version : 81381
#
# This File Date : Mon May 20 09:28:13 UTC 2024
# Update Frequency: 15 mins
# Aggregation : none
# Entries : 119 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=blocklist_de_bots
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.101.156.211
14.225.8.141
27.20.175.5
27.124.42.160
27.128.246.110
31.220.87.230
31.220.89.56
34.175.145.201
36.182.48.152
36.182.48.191
36.182.49.75
38.68.134.6
38.91.106.96
38.121.43.104
38.242.210.185
39.101.185.186
45.119.85.208
45.125.239.179
47.96.108.64
47.109.189.45
47.115.220.127
49.235.65.73
51.75.194.249
51.77.117.102
51.195.216.60
61.160.215.149
65.108.2.171
65.108.78.33
65.108.128.54
65.108.203.133
66.249.79.105
66.249.79.107
67.222.157.170
67.225.138.255
68.183.179.236
78.111.2.100
78.128.8.148
78.142.63.248
79.172.16.97
81.167.26.57
81.181.60.32
81.181.62.44
84.247.105.106
87.249.132.28
89.187.171.141
89.187.182.13
91.92.244.81
91.92.244.113
91.92.248.52
91.92.254.72
91.148.168.81
92.204.139.118
101.132.158.55
104.200.151.49
104.247.165.250
106.52.153.250
107.170.47.77
109.123.243.216
109.205.46.4
110.154.100.48
110.154.102.153
116.179.32.23
116.179.32.131
116.179.32.132
116.179.37.7
116.179.37.16
116.179.37.22
116.179.37.31
116.179.37.59
116.179.37.130
116.179.37.142
116.179.37.167
116.179.37.168
116.179.37.184
116.179.37.197
116.179.37.215
116.179.37.243
121.36.241.28
122.112.249.136
123.244.130.244
135.181.74.243
135.181.75.58
135.181.213.219
139.59.35.248
139.59.69.59
139.162.21.71
140.228.21.67
150.95.140.248
150.95.183.194
150.230.58.58
152.32.253.248
152.42.247.226
154.53.58.16
159.65.3.42
159.65.14.244
159.223.48.186
165.232.176.90
165.232.181.255
167.172.64.61
171.6.12.55
171.244.49.8
172.98.89.178
172.105.124.122
174.138.29.63
175.22.83.182
175.178.35.245
178.25.242.225
178.128.124.180
182.92.152.95
182.204.141.80
182.204.142.200
185.177.116.125
193.176.86.41
194.104.9.204
194.233.75.180
195.191.219.131
199.189.225.248
213.232.124.78
217.76.48.3

940
blocklist_de_bruteforce.ipset Normal file
View File

@ -0,0 +1,940 @@
#
# blocklist_de_bruteforce
#
# ipv4 hash:ip ipset
#
# [Blocklist.de] (https://www.blocklist.de/) All IPs which
# attacks Joomla, Wordpress and other Web-Logins with
# Brute-Force Logins.
#
# Maintainer : Blocklist.de
# Maintainer URL : https://www.blocklist.de/
# List source URL : http://lists.blocklist.de/lists/bruteforcelogin.txt
# Source File Date: Mon May 20 10:00:08 UTC 2024
#
# Category : attacks
# Version : 142189
#
# This File Date : Mon May 20 10:00:26 UTC 2024
# Update Frequency: 15 mins
# Aggregation : none
# Entries : 909 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=blocklist_de_bruteforce
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.13.253.53
1.14.93.149
3.6.215.27
3.23.178.53
3.110.122.77
3.110.247.192
3.230.74.18
4.151.218.179
4.241.20.201
5.2.16.222
5.61.25.34
5.101.157.166
5.189.169.121
5.252.101.96
8.134.166.22
8.138.106.233
8.142.9.180
8.210.200.209
8.210.225.126
8.217.113.196
8.217.129.114
8.217.209.92
8.218.115.242
13.43.87.3
13.48.237.230
13.65.42.183
13.84.181.47
13.84.188.162
13.91.177.99
13.201.114.133
13.235.168.85
15.235.97.191
15.235.97.192
15.235.182.182
15.235.212.111
20.37.127.236
20.101.152.211
20.174.8.108
20.205.110.167
20.231.250.161
20.253.155.235
23.97.205.210
23.98.122.35
23.102.164.125
23.227.169.235
27.254.146.2
31.24.128.55
31.24.129.103
31.25.90.170
31.31.196.108
31.46.27.10
31.131.20.146
31.135.241.21
31.177.95.85
34.16.223.79
34.23.191.54
34.64.218.102
34.65.234.0
34.75.65.218
34.75.225.10
34.81.4.25
34.89.50.230
34.94.13.165
34.94.57.30
34.94.203.226
34.106.55.237
34.106.140.212
34.106.180.75
34.133.21.133
34.143.140.159
34.148.155.44
34.151.224.164
34.159.198.20
35.194.205.144
35.194.244.118
35.199.25.228
35.199.94.174
35.205.108.44
35.209.165.149
35.228.178.136
35.235.112.220
35.235.115.213
35.236.100.5
36.68.221.125
37.27.44.106
37.60.251.68
38.47.108.208
38.60.204.243
38.242.154.172
38.242.206.179
38.242.218.110
38.242.238.228
38.242.254.91
39.98.44.46
39.99.144.229
39.100.104.223
39.106.57.146
40.77.63.65
41.57.124.54
42.96.47.22
43.129.200.178
43.136.39.92
43.136.69.239
43.138.16.177
43.153.50.177
43.163.224.182
43.240.28.51
43.240.73.16
45.40.133.116
45.61.184.25
45.61.186.121
45.61.186.166
45.61.187.70
45.61.187.129
45.61.188.192
45.67.218.215
45.76.160.179
45.79.209.150
45.81.232.20
45.115.243.155
45.127.101.193
45.131.60.10
45.141.215.245
45.147.197.239
45.149.76.44
45.158.14.229
45.162.169.217
45.195.204.97
46.101.158.184
46.105.29.21
46.105.39.241
46.105.97.186
46.242.233.37
47.88.90.156
47.88.93.237
47.89.155.39
47.92.214.184
47.96.97.97
47.99.136.132
47.102.219.208
47.104.68.112
47.109.84.249
47.113.116.29
47.113.196.78
47.206.148.125
47.243.191.115
47.254.41.150
49.212.207.156
49.232.145.205
49.234.23.207
50.62.139.196
50.62.142.2
50.62.146.145
50.62.176.51
50.62.185.30
50.62.220.192
50.62.223.73
50.63.1.228
50.63.25.125
50.63.27.58
51.15.149.83
51.38.41.215
51.68.11.207
51.68.11.215
51.68.11.239
51.68.229.100
51.68.230.210
51.75.91.32
51.75.122.244
51.77.231.194
51.79.145.19
51.83.189.204
51.89.153.66
51.91.253.32
51.161.32.21
51.178.136.164
51.178.146.199
51.195.88.79
51.195.104.87
51.210.236.48
52.77.171.13
52.171.217.147
52.173.28.95
52.173.36.83
52.176.165.69
52.180.156.200
52.201.126.123
52.210.188.219
52.242.231.141
54.36.174.69
54.37.121.239
54.74.96.61
54.93.111.33
54.207.25.155
58.209.53.130
59.93.181.171
59.110.124.139
59.144.126.180
60.211.52.19
61.14.234.31
61.246.38.5
62.99.143.79
62.106.95.155
62.149.215.110
62.171.134.22
62.171.173.95
62.221.251.137
64.23.197.32
64.23.239.199
64.85.10.10
64.93.80.34
64.176.37.239
64.176.39.186
64.227.78.129
64.227.155.92
64.227.161.151
65.21.29.43
65.109.30.118
65.109.98.180
66.29.134.113
66.29.141.32
66.115.142.157
67.43.12.75
67.222.30.121
67.222.134.13
67.222.142.146
68.178.132.165
68.178.133.139
68.178.145.44
68.178.145.78
68.178.145.176
68.178.145.184
68.178.145.199
68.178.145.238
68.178.147.186
68.178.148.72
68.178.148.82
68.178.148.155
68.178.149.184
68.178.149.187
68.178.151.51
68.178.153.39
68.178.156.94
68.178.156.164
68.178.156.188
68.178.157.98
68.178.158.82
68.178.159.203
68.178.167.83
68.178.192.201
68.178.193.228
68.178.194.48
68.178.196.104
68.178.220.63
68.178.221.66
68.178.222.76
68.178.223.37
68.178.224.37
68.178.224.109
68.178.225.54
68.178.229.254
68.178.230.66
68.178.231.11
68.178.245.28
68.178.246.137
68.183.63.211
68.183.210.185
68.235.48.108
69.16.221.37
69.46.21.234
72.167.44.205
72.167.56.190
72.167.57.110
72.167.58.252
72.167.59.206
72.167.64.115
72.167.70.23
72.167.87.150
72.167.102.233
72.167.207.15
72.167.207.142
75.119.141.150
75.119.143.18
75.247.187.9
77.66.124.101
77.92.156.145
77.237.247.37
78.128.8.22
78.135.107.100
79.232.58.193
80.66.201.98
80.88.84.235
80.88.87.154
80.88.87.157
80.201.104.111
80.239.141.135
80.243.180.14
81.8.91.220
81.19.215.165
81.69.170.51
81.70.248.169
81.88.53.6
81.168.120.187
81.181.54.25
81.186.225.115
82.77.184.46
82.118.30.95
82.157.174.41
83.171.227.242
84.110.34.14
84.200.41.9
84.239.37.18
84.247.117.40
85.10.216.137
85.158.181.17
86.105.14.19
86.111.241.88
88.99.106.172
88.119.176.89
88.198.133.15
89.46.110.127
89.107.188.89
89.111.20.52
89.238.188.21
91.82.84.179
91.103.219.225
91.103.219.226
91.134.248.192
91.134.248.211
91.134.248.230
91.196.124.14
91.203.110.224
91.203.111.18
91.204.46.34
91.204.46.244
91.212.213.24
91.216.169.189
91.223.116.15
92.42.33.77
92.53.96.108
92.53.96.221
92.204.55.130
92.204.210.0
92.204.218.63
92.204.218.253
92.204.220.49
92.204.220.50
92.204.220.56
92.204.221.135
92.204.223.205
92.204.239.74
92.205.0.192
92.205.1.133
92.205.2.7
92.205.3.60
92.205.3.107
92.205.4.19
92.205.5.169
92.205.6.58
92.205.6.69
92.205.6.175
92.205.6.232
92.205.9.18
92.205.9.191
92.205.10.243
92.205.11.218
92.205.12.83
92.205.12.241
92.205.14.36
92.205.14.159
92.205.19.74
92.205.29.137
92.205.50.235
92.205.52.99
92.205.64.105
92.205.109.21
92.205.144.130
92.205.170.153
92.205.170.212
92.205.171.137
92.205.174.245
93.82.140.137
93.93.202.44
94.32.111.10
94.46.22.120
94.46.25.107
94.46.167.106
94.72.115.227
94.72.120.15
94.73.148.62
94.126.174.28
94.156.68.28
94.245.105.127
94.250.203.70
95.132.186.86
96.8.122.166
97.74.206.146
97.74.209.243
101.33.210.56
101.43.206.70
101.101.97.11
101.132.146.159
101.132.149.179
101.133.163.146
102.23.122.251
102.165.48.45
102.165.48.97
102.219.23.37
102.219.189.67
103.12.77.128
103.20.102.10
103.20.220.48
103.23.155.137
103.24.219.26
103.28.36.108
103.28.36.210
103.28.36.212
103.29.214.238
103.38.161.170
103.48.193.205
103.57.221.31
103.67.163.199
103.75.198.42
103.77.160.125
103.108.45.105
103.118.27.128
103.118.28.120
103.118.29.48
103.118.29.117
103.127.133.239
103.130.219.128
103.131.196.81
103.133.214.160
103.142.26.32
103.145.50.139
103.154.184.42
103.159.51.186
103.159.84.241
103.159.85.205
103.160.144.45
103.169.34.238
103.171.181.119
103.175.206.43
103.176.179.125
103.195.238.71
104.131.181.172
104.156.245.141
104.197.215.237
104.198.248.243
104.200.151.188
104.210.152.122
104.214.237.53
104.219.248.8
104.224.178.231
104.237.129.242
104.248.120.146
106.14.0.195
106.14.30.24
106.15.54.35
106.58.178.247
106.58.218.32
107.172.95.219
107.174.186.74
107.180.112.34
107.180.112.77
107.180.114.28
107.180.115.120
107.180.116.0
107.180.117.76
107.180.117.168
107.180.117.184
107.180.117.241
107.180.119.161
107.180.121.48
107.189.1.142
107.189.4.33
107.189.10.151
107.189.10.160
107.190.132.194
109.75.164.71
109.235.174.4
109.235.174.18
110.40.135.44
111.230.202.147
112.126.68.81
112.213.38.81
113.190.233.5
114.33.57.221
114.55.90.149
114.55.95.129
114.67.236.185
115.245.68.131
116.12.48.101
116.62.206.174
116.91.197.189
116.118.49.209
116.202.245.141
117.50.200.109
117.213.87.239
117.222.253.99
118.27.125.59
118.89.200.37
118.123.4.248
118.139.176.46
118.139.176.62
118.139.179.30
118.139.179.71
118.139.179.186
118.139.179.247
118.194.238.196
118.195.251.11
119.23.104.179
119.23.236.73
120.46.137.204
120.76.188.95
120.76.193.63
120.77.44.173
120.77.202.101
120.78.175.141
122.201.124.55
122.201.124.71
123.56.86.45
123.149.100.52
124.123.76.210
124.217.226.207
125.65.113.214
125.88.207.79
125.212.214.217
125.212.218.5
128.199.204.18
128.199.224.77
128.199.255.13
130.180.75.42
130.185.75.31
132.145.17.149
132.148.79.237
132.148.103.140
132.148.106.155
132.148.120.57
132.148.120.64
132.148.178.73
132.148.185.13
132.148.185.19
132.148.185.21
132.148.185.32
134.119.183.211
135.125.133.168
135.125.183.119
136.144.243.177
136.244.64.198
137.117.65.231
137.184.88.156
137.184.220.235
138.68.133.144
138.68.133.171
138.91.16.18
138.128.174.26
138.197.142.166
139.59.6.180
139.59.43.165
139.59.66.178
139.59.70.236
139.59.73.72
139.59.124.194
139.162.210.205
139.180.135.123
139.196.113.223
140.238.226.252
140.238.227.240
141.94.247.170
141.95.3.58
142.4.25.179
142.93.5.215
142.93.192.140
142.93.208.228
142.93.221.51
142.93.252.11
142.132.137.91
142.132.178.45
142.171.116.231
143.110.190.136
143.198.154.65
143.244.133.139
143.244.133.158
143.244.134.222
144.24.193.251
144.126.142.236
144.217.96.196
144.217.181.137
146.70.98.45
146.190.40.30
147.182.173.77
148.66.130.195
148.66.146.2
148.66.147.20
148.66.147.33
148.66.147.183
148.72.18.32
148.72.18.36
148.72.74.49
148.72.120.187
148.72.123.228
148.72.215.37
148.72.244.147
148.113.175.246
148.135.4.40
148.153.45.234
148.202.23.189
149.102.132.136
149.129.132.87
149.210.250.206
149.255.62.116
150.158.77.170
150.162.233.150
151.106.38.166
152.42.220.34
152.231.106.251
154.0.170.193
154.12.242.81
154.26.128.57
154.26.129.20
154.26.159.47
155.133.26.215
156.239.199.92
157.7.184.12
157.90.19.183
157.230.242.225
157.245.36.108
157.245.70.141
159.65.84.119
159.65.155.57
159.65.184.0
159.65.204.162
159.89.104.182
159.89.120.164
159.89.194.195
159.89.203.182
159.196.169.10
159.203.38.145
159.203.117.149
159.203.120.152
159.223.102.228
160.153.147.15
160.153.153.141
160.153.153.167
160.153.154.4
161.34.5.2
161.35.23.58
161.35.236.228
161.97.104.42
161.97.120.207
161.97.150.180
162.0.215.232
162.14.71.142
162.19.18.78
162.19.230.241
162.144.238.177
162.214.197.33
162.240.17.77
162.250.127.222
162.254.35.97
164.68.127.196
164.68.127.208
165.22.70.82
165.22.213.130
165.227.84.253
165.227.172.117
165.232.32.235
167.71.39.144
167.86.93.242
167.86.99.149
167.88.61.92
167.99.113.123
167.99.241.140
167.114.206.241
167.172.88.14
167.172.115.176
167.235.162.162
167.250.193.188
170.64.238.90
170.106.199.211
170.187.238.204
171.33.132.16
171.244.0.91
172.187.160.160
172.211.240.123
172.233.81.147
173.201.177.205
173.201.178.74
173.201.178.160
173.201.183.213
173.201.185.104
173.201.186.239
173.201.190.138
173.212.214.118
173.231.229.252
173.231.247.36
173.236.210.255
173.237.189.235
173.239.194.178
173.249.15.33
173.249.54.227
173.249.144.83
173.254.30.226
175.27.212.157
175.126.232.150
175.178.150.231
176.187.15.100
178.128.108.144
178.128.221.28
178.128.255.55
178.175.130.243
178.210.68.1
178.236.246.60
178.238.235.185
178.239.150.4
178.239.158.65
178.254.0.77
179.43.191.18
181.214.94.11
181.214.164.12
182.43.64.48
182.43.68.38
182.43.69.56
182.43.79.24
182.44.26.220
182.50.151.3
183.56.195.224
184.168.97.21
184.168.97.83
184.168.97.99
184.168.97.145
184.168.102.133
184.168.108.77
184.168.108.80
184.168.110.37
184.168.113.58
184.168.114.42
184.168.114.92
184.168.115.171
184.168.116.87
184.168.116.155
184.168.117.210
184.168.119.144
184.168.119.178
185.4.142.91
185.10.74.100
185.10.75.23
185.15.121.126
185.18.197.85
185.18.213.84
185.18.237.55
185.23.72.14
185.30.32.173
185.50.25.49
185.91.69.34
185.93.70.133
185.98.5.122
185.98.5.148
185.98.5.160
185.98.5.202
185.107.90.29
185.107.112.207
185.107.113.117
185.107.113.137
185.107.113.247
185.111.208.170
185.112.149.234
185.133.207.31
185.160.182.220
185.165.31.183
185.176.40.212
185.177.116.42
185.182.56.148
185.182.185.82
185.205.184.2
185.216.113.142
185.220.101.59
185.231.57.82
185.243.218.89
185.253.219.219
186.234.80.110
187.0.210.61
188.40.94.109
188.68.47.247
188.128.140.205
188.128.233.143
188.165.0.1
188.166.1.163
188.212.102.8
188.244.106.81
191.101.210.113
191.252.194.31
192.99.0.218
192.169.144.251
192.169.145.218
192.169.150.185
192.169.165.47
192.241.130.228
192.250.231.25
193.25.252.31
193.122.6.102
193.202.110.17
193.202.110.24
193.202.110.26
193.202.110.27
194.5.188.121
194.50.16.192
194.233.78.255
194.233.81.142
194.243.52.155
195.26.250.126
195.175.22.38
195.242.102.131
198.12.216.33
198.12.216.121
198.12.217.103
198.12.217.245
198.12.221.104
198.12.223.195
198.12.232.59
198.12.232.103
198.12.233.20
198.12.233.41
198.12.234.180
198.12.235.32
198.12.236.127
198.12.238.123
198.12.240.54
198.12.241.102
198.12.242.136
198.12.243.38
198.12.243.56
198.12.245.7
198.12.245.248
198.12.246.102
198.12.246.179
198.38.83.104
198.54.120.110
198.54.126.44
198.71.229.132
198.71.229.169
198.71.231.40
198.71.231.60
198.100.155.150
198.134.104.126
199.89.53.206
199.192.20.40
199.195.250.250
200.58.118.110
201.144.34.204
202.29.14.73
202.178.127.57
203.161.61.119
205.174.25.88
205.185.113.116
205.185.126.168
206.189.92.235
206.189.129.241
206.189.138.254
206.189.142.11
207.148.19.37
207.148.87.131
208.109.23.237
208.109.25.77
208.109.34.85
208.109.41.218
208.109.41.232
208.109.41.233
208.109.42.254
208.109.43.74
208.109.51.85
208.109.57.122
208.109.60.53
208.109.61.111
208.109.74.59
208.109.75.188
208.109.76.72
208.109.76.254
208.109.174.117
208.109.201.1
208.109.226.157
209.38.165.225
209.38.220.98
209.97.159.40
209.97.185.182
209.124.88.26
209.126.13.169
209.126.13.171
209.126.102.185
209.141.42.189
209.141.58.96
209.145.52.101
209.145.53.102
210.16.189.15
211.149.224.77
211.149.242.221
212.90.148.126
212.91.97.45
212.102.49.17
213.105.81.211
213.152.162.154
213.163.113.46
213.186.4.109
213.230.127.224
216.238.76.73
217.76.52.186
217.182.182.66
221.118.210.41

67
blocklist_de_ftp.ipset Normal file
View File

@ -0,0 +1,67 @@
#
# blocklist_de_ftp
#
# ipv4 hash:ip ipset
#
# [Blocklist.de] (https://www.blocklist.de/) All IP addresses
# which have been reported within the last 48 hours for
# attacks on the Service FTP.
#
# Maintainer : Blocklist.de
# Maintainer URL : https://www.blocklist.de/
# List source URL : http://lists.blocklist.de/lists/ftp.txt
# Source File Date: Mon May 20 09:42:03 UTC 2024
#
# Category : attacks
# Version : 98044
#
# This File Date : Mon May 20 09:44:12 UTC 2024
# Update Frequency: 15 mins
# Aggregation : none
# Entries : 36 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=blocklist_de_ftp
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.94.17.34
14.37.12.17
34.22.213.78
36.90.43.161
39.105.18.87
47.236.154.193
49.170.184.43
49.249.146.154
61.223.194.251
62.217.187.51
84.247.147.143
89.36.76.52
101.36.116.45
114.55.116.142
114.89.198.25
115.199.181.108
117.88.103.90
118.119.81.93
120.26.46.22
120.26.117.50
120.26.119.172
120.27.108.180
123.58.207.151
125.122.20.135
125.212.239.144
139.201.249.108
165.154.12.82
175.138.65.57
177.102.20.98
182.92.154.6
182.135.101.31
185.133.252.143
187.217.186.28
188.134.83.204
211.150.84.20
222.109.168.160

2191
blocklist_de_imap.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

13993
blocklist_de_mail.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

74
blocklist_de_sip.ipset Normal file
View File

@ -0,0 +1,74 @@
#
# blocklist_de_sip
#
# ipv4 hash:ip ipset
#
# [Blocklist.de] (https://www.blocklist.de/) All IP addresses
# that tried to login in a SIP, VOIP or Asterisk Server and
# are included in the IPs list from infiltrated.net
#
# Maintainer : Blocklist.de
# Maintainer URL : https://www.blocklist.de/
# List source URL : http://lists.blocklist.de/lists/sip.txt
# Source File Date: Mon May 20 10:00:06 UTC 2024
#
# Category : attacks
# Version : 134195
#
# This File Date : Mon May 20 10:00:23 UTC 2024
# Update Frequency: 15 mins
# Aggregation : none
# Entries : 43 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=blocklist_de_sip
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
2.83.61.37
5.182.26.170
23.95.246.152
43.129.158.215
43.130.28.218
43.133.7.191
43.134.95.40
43.153.47.81
43.155.160.137
43.156.8.152
43.159.45.36
43.163.194.3
45.238.232.2
49.7.154.4
64.227.177.112
68.183.193.11
81.4.110.216
101.126.3.175
103.73.163.82
103.198.172.10
104.248.159.207
104.250.34.22
104.250.50.3
117.34.125.173
122.114.10.232
128.199.137.110
129.226.155.246
139.224.60.82
151.80.118.222
152.89.198.106
154.221.21.234
157.230.7.5
159.65.154.18
159.89.104.107
159.89.187.235
162.241.121.220
165.22.227.46
188.213.128.151
192.44.68.143
192.44.68.169
193.32.162.38
196.0.120.6
196.189.21.247

9469
blocklist_de_ssh.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

351
blocklist_de_strongips.ipset Normal file
View File

@ -0,0 +1,351 @@
#
# blocklist_de_strongips
#
# ipv4 hash:ip ipset
#
# [Blocklist.de] (https://www.blocklist.de/) All IPs which
# are older then 2 month and have more then 5.000 attacks.
#
# Maintainer : Blocklist.de
# Maintainer URL : https://www.blocklist.de/
# List source URL : http://lists.blocklist.de/lists/strongips.txt
# Source File Date: Mon May 20 08:25:04 UTC 2024
#
# Category : attacks
# Version : 54058
#
# This File Date : Mon May 20 08:28:12 UTC 2024
# Update Frequency: 15 mins
# Aggregation : none
# Entries : 321 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=blocklist_de_strongips
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
13.74.46.65
13.80.7.122
14.63.162.98
14.102.74.99
14.177.239.168
20.194.60.135
27.254.137.144
27.254.149.199
31.184.198.71
34.91.0.68
34.92.176.182
35.199.95.142
35.207.98.222
35.209.160.244
35.219.62.194
35.223.246.35
35.244.25.124
36.66.151.17
36.91.166.34
36.110.228.254
36.155.130.6
40.115.18.231
41.72.219.102
41.82.208.182
41.191.116.18
42.200.66.164
42.200.78.78
45.129.14.128
45.129.14.173
45.161.176.1
45.232.244.5
46.101.5.100
46.101.23.51
46.101.171.235
47.180.114.229
49.51.183.1
49.247.198.162
50.214.100.27
51.178.137.178
52.160.46.145
52.183.128.237
52.227.167.147
58.27.95.2
59.3.76.218
60.199.224.55
61.80.179.118
61.83.148.111
61.93.186.125
61.102.42.5
61.177.172.136
61.177.172.140
61.177.172.160
61.177.172.179
61.177.172.181
62.28.222.221
64.227.122.198
64.227.126.250
65.181.73.155
65.190.102.226
68.183.88.186
72.167.52.254
72.167.55.58
72.240.125.133
74.94.234.151
81.28.167.30
81.192.87.130
82.200.65.218
85.209.11.27
85.209.11.227
85.209.11.254
88.214.25.16
89.97.218.142
90.168.201.25
91.144.20.198
91.238.181.247
93.190.106.139
96.67.59.65
96.69.13.140
96.78.175.36
97.74.83.185
101.207.113.73
103.16.202.187
103.26.136.173
103.48.192.48
103.48.193.7
103.63.108.25
103.86.180.10
103.92.24.242
103.226.248.146
103.231.46.66
103.240.110.130
103.248.60.70
103.255.216.43
104.248.159.207
105.96.11.65
106.51.3.214
106.241.54.211
107.0.200.227
107.175.33.240
107.180.88.176
111.68.98.152
112.31.56.247
112.133.228.250
112.217.207.26
113.31.116.250
113.200.60.74
114.204.218.154
114.206.23.151
115.79.35.110
116.92.213.114
117.220.15.119
118.40.248.20
118.69.161.67
118.70.170.120
118.101.192.62
118.201.79.222
119.28.105.34
119.28.118.4
119.29.136.114
119.73.179.114
119.252.143.6
120.88.46.226
120.224.50.233
121.142.87.218
122.155.0.205
122.176.52.13
123.30.249.49
123.31.29.192
124.152.118.194
124.160.96.242
125.46.85.154
125.99.173.162
128.199.33.46
128.199.73.168
128.199.80.214
128.199.95.60
128.199.120.146
128.199.150.10
128.199.179.36
128.199.182.19
128.199.194.1
128.199.225.7
128.201.78.253
129.226.158.246
134.122.8.241
136.228.161.66
136.228.161.67
138.68.9.83
138.68.91.192
139.59.23.154
139.59.25.164
139.59.127.73
139.59.127.178
139.59.188.13
140.86.12.31
140.86.39.162
143.244.144.227
143.244.162.174
146.190.227.169
148.66.132.190
154.68.39.6
154.72.194.207
157.230.113.181
157.230.185.9
157.245.157.93
159.65.41.104
159.65.91.105
159.65.220.18
159.203.170.197
160.153.234.75
161.35.108.241
164.77.117.10
164.177.31.66
165.22.16.134
165.22.101.75
165.22.217.96
165.22.242.64
165.227.68.95
165.227.84.172
165.227.85.21
165.227.87.78
165.227.101.226
165.227.166.247
165.227.228.212
165.232.158.187
167.172.112.115
171.244.140.174
175.203.61.33
175.207.13.22
177.91.80.11
179.43.180.108
180.71.47.198
180.101.88.196
180.101.88.197
180.101.88.200
180.101.88.201
180.101.88.205
180.101.88.218
180.101.88.219
180.101.88.220
180.101.88.221
180.101.88.222
180.101.88.223
180.101.88.224
180.101.88.225
180.101.88.235
180.101.88.236
180.101.88.239
180.101.88.240
180.101.88.241
180.101.88.244
180.101.88.246
180.101.88.248
180.101.88.254
180.101.184.85
180.167.207.234
180.168.95.234
181.48.60.50
181.48.99.155
182.16.245.79
182.16.245.85
182.75.216.74
182.93.50.90
183.81.169.238
183.177.132.157
183.240.157.2
185.17.229.65
185.74.4.17
185.74.4.20
185.74.4.189
185.217.1.246
185.246.130.20
186.10.125.209
186.38.26.5
186.67.248.5
186.67.248.6
186.67.248.8
187.102.174.154
188.166.211.7
190.12.102.58
190.85.15.251
190.104.25.210
190.128.230.98
190.129.60.125
190.144.14.170
190.145.192.106
190.153.249.99
190.181.25.210
191.242.105.133
192.241.157.126
194.152.206.17
194.169.175.10
194.169.175.17
194.169.175.35
194.169.175.36
195.19.4.22
195.88.120.62
197.5.145.68
197.5.145.102
197.227.8.186
198.12.85.199
198.12.114.231
200.105.183.118
201.116.3.194
201.149.49.146
201.163.162.179
201.226.239.98
202.21.123.124
202.21.123.196
202.55.175.236
202.158.139.57
203.66.168.81
203.98.76.172
203.106.164.74
203.113.167.3
203.172.76.4
203.205.37.233
205.185.113.140
206.217.131.233
208.109.34.15
209.97.186.17
210.3.92.14
210.65.88.51
211.75.19.210
211.115.93.98
211.193.31.52
211.253.9.49
211.253.10.96
212.49.70.200
212.70.149.150
212.83.144.11
213.109.202.127
218.56.160.82
218.92.0.22
218.92.0.24
218.92.0.27
218.92.0.29
218.92.0.31
218.92.0.32
218.92.0.34
218.92.0.39
218.92.0.56
218.92.0.76
218.92.0.100
218.92.0.102
218.92.0.107
218.92.0.112
218.92.0.113
218.92.0.118
218.92.0.123
218.92.0.124
218.150.246.42
218.255.245.10
220.80.223.144
220.86.29.35
221.156.126.1
221.213.129.46
222.107.156.227
223.197.151.55
223.197.186.7
223.197.188.206

78594
blocklist_net_ua.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

91
botscout.ipset Normal file
View File

@ -0,0 +1,91 @@
#
# botscout
#
# ipv4 hash:ip ipset
#
# [BotScout] (http://botscout.com/) helps prevent automated
# web scripts, known as bots, from registering on forums,
# polluting databases, spreading spam, and abusing forms on
# web sites. They do this by tracking the names, IPs, and
# email addresses that bots use and logging them as unique
# signatures for future reference. They also provide a simple
# yet powerful API that you can use to test forms when
# they're submitted on your site. This list is composed of
# the most recently-caught bots.
#
# Maintainer : BotScout.com
# Maintainer URL : http://botscout.com/
# List source URL : http://botscout.com/last_caught_cache.htm
# Source File Date: Mon May 20 09:44:29 UTC 2024
#
# Category : abuse
# Version : 88557
#
# This File Date : Mon May 20 09:44:29 UTC 2024
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 54 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=botscout
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.6.98.140
5.62.60.15
5.142.200.34
23.94.81.244
23.94.153.2
23.94.153.40
23.94.153.44
37.115.216.33
45.8.17.88
45.13.191.22
46.29.251.63
46.29.251.202
46.29.251.203
47.56.110.204
49.148.245.140
64.43.91.201
66.56.83.133
77.232.41.202
89.22.232.206
89.22.234.3
89.22.237.210
89.149.93.17
91.223.126.188
94.25.170.220
104.160.17.250
107.172.130.71
120.40.130.70
146.70.111.132
162.158.222.23
168.151.226.8
172.70.86.185
172.245.251.160
178.159.37.55
181.177.76.60
191.102.164.207
196.57.225.54
196.57.225.165
196.58.225.77
196.58.225.228
196.196.160.249
196.198.211.10
196.198.211.33
196.198.211.50
196.198.211.180
196.247.18.232
198.46.169.49
198.46.208.139
198.240.115.87
209.242.209.141
209.242.209.163
209.242.210.41
209.242.210.100
216.158.205.68
217.66.159.30

988
botscout_1d.ipset Normal file
View File

@ -0,0 +1,988 @@
#
# botscout_1d
#
# ipv4 hash:ip ipset
#
# [BotScout] (http://botscout.com/) helps prevent automated
# web scripts, known as bots, from registering on forums,
# polluting databases, spreading spam, and abusing forms on
# web sites. They do this by tracking the names, IPs, and
# email addresses that bots use and logging them as unique
# signatures for future reference. They also provide a simple
# yet powerful API that you can use to test forms when
# they're submitted on your site. This list is composed of
# the most recently-caught bots.
#
# Maintainer : BotScout.com
# Maintainer URL : http://botscout.com/
# List source URL : http://botscout.com/last_caught_cache.htm
# Source File Date: Mon May 20 09:44:29 UTC 2024
#
# Category : abuse
# Version : 88557
#
# This File Date : Mon May 20 09:44:30 UTC 2024
# Update Frequency: 30 mins
# Aggregation : 1 day
# Entries : 957 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=botscout_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.6.98.140
1.52.197.171
1.231.27.148
5.17.27.113
5.18.176.192
5.35.33.229
5.42.65.4
5.62.43.182
5.62.43.203
5.62.60.15
5.78.67.73
5.142.200.34
5.154.253.134
5.157.14.145
5.157.32.137
5.161.197.144
5.173.208.37
5.180.242.21
5.183.130.123
5.188.210.91
5.196.78.175
5.253.161.54
5.253.161.62
5.253.161.94
5.253.161.128
5.253.161.134
5.253.161.140
5.253.161.174
5.253.161.182
5.253.161.194
8.209.255.13
14.229.67.12
14.241.227.181
23.81.80.5
23.81.127.151
23.81.227.22
23.81.229.115
23.81.229.235
23.82.184.84
23.82.186.40
23.82.186.112
23.82.186.234
23.83.87.85
23.83.87.219
23.83.87.241
23.83.89.119
23.83.89.234
23.94.6.11
23.94.6.85
23.94.6.254
23.94.81.244
23.94.153.2
23.94.153.40
23.94.153.44
23.94.168.164
23.94.230.200
23.94.230.216
23.94.230.232
23.95.97.200
23.95.117.13
23.104.162.45
23.104.162.107
23.105.159.231
23.105.159.232
23.106.216.251
23.108.2.237
23.108.2.250
23.108.252.17
23.109.208.34
23.109.219.69
23.229.9.30
23.229.11.227
23.229.34.233
23.229.52.11
23.229.56.30
23.229.62.204
23.236.132.133
23.236.149.124
23.236.156.223
23.236.167.143
23.236.210.218
23.236.214.111
23.236.221.217
23.236.229.239
23.236.229.242
23.236.232.172
24.106.221.230
27.213.210.38
31.6.46.30
31.6.52.70
31.173.83.37
31.173.85.244
31.173.86.96
37.46.113.215
37.47.188.189
37.60.237.251
37.115.216.33
37.139.53.32
37.139.53.46
37.139.53.167
37.139.53.195
37.140.254.67
38.15.140.125
38.15.141.78
38.80.150.200
38.152.2.102
38.152.2.249
38.152.3.240
38.152.8.215
38.152.9.212
38.152.11.56
38.152.11.233
38.152.12.184
38.152.12.219
38.152.12.239
38.152.13.242
38.152.14.99
38.152.14.115
38.152.36.65
38.152.37.47
38.152.37.102
38.152.38.76
38.152.41.93
38.152.42.133
38.152.42.161
38.152.42.227
38.152.47.114
38.152.253.8
38.152.253.13
38.152.253.36
38.152.253.41
38.152.253.104
38.152.253.122
38.152.253.135
38.152.253.212
38.152.253.215
38.153.66.71
38.153.66.104
38.153.66.124
38.153.66.147
38.153.66.182
38.153.66.222
38.153.66.230
38.153.134.4
38.154.6.222
38.154.166.31
38.154.166.134
38.154.173.180
38.170.159.19
38.170.175.128
38.170.175.172
38.242.216.92
42.113.61.123
43.245.117.112
45.8.17.54
45.8.17.71
45.8.17.77
45.8.17.88
45.8.17.111
45.13.191.22
45.13.191.29
45.13.191.46
45.13.191.49
45.41.162.170
45.43.64.153
45.43.65.125
45.43.68.114
45.43.68.245
45.43.177.58
45.43.183.84
45.43.184.191
45.43.190.249
45.61.116.26
45.66.35.35
45.74.44.194
45.87.69.125
45.87.212.184
45.87.243.193
45.95.116.13
45.95.173.59
45.114.12.214
45.128.246.237
45.131.195.172
45.131.195.234
45.132.39.117
45.133.193.35
45.135.36.170
45.136.228.107
45.138.117.4
45.139.124.38
45.146.28.166
45.146.30.159
45.146.91.144
45.147.192.147
45.152.200.47
45.158.76.62
45.158.187.227
45.192.147.94
45.192.147.229
45.192.152.72
45.192.157.163
45.199.142.66
45.199.142.70
45.251.63.124
45.252.59.70
46.8.16.146
46.8.57.209
46.8.110.98
46.8.111.119
46.8.212.91
46.29.251.52
46.29.251.63
46.29.251.134
46.29.251.187
46.29.251.202/31
46.147.219.81
46.191.225.111
46.246.8.123
46.246.122.123
47.56.110.204
49.148.245.140
49.228.122.187
50.3.164.72
50.3.196.184
50.3.221.210
54.67.93.169
58.20.248.139
58.246.58.150
60.12.168.114
62.217.182.26
64.43.91.201
64.44.48.206
64.137.48.209
64.137.71.245
64.137.95.11
65.21.205.253
65.109.27.210
65.109.65.55
65.109.108.104
66.56.83.17
66.56.83.30
66.56.83.42
66.56.83.83
66.56.83.133
66.56.83.243
66.78.34.193
67.216.237.58
67.227.119.181
69.4.94.108
69.58.7.168
70.53.11.42
70.166.167.38
77.94.1.134
77.232.37.33
77.232.41.202
80.71.229.140
80.95.45.39
80.239.140.196
82.144.66.59
83.11.71.14
84.17.42.51
84.17.62.164
84.239.37.5
84.239.37.20
84.239.40.222
84.239.41.15
84.247.59.186
84.247.59.189
85.193.65.155
85.203.15.61
85.203.44.172
85.203.44.184
85.203.44.201
85.203.44.203
85.203.44.209
85.209.129.39
87.117.225.148
89.22.232.186
89.22.232.206
89.22.234.3
89.22.234.115
89.22.235.136
89.22.235.226
89.22.237.210
89.149.37.143
89.149.38.103
89.149.87.92
89.149.93.17
91.121.91.91
91.149.233.252
91.188.244.33
91.210.59.57
91.217.72.88
91.217.72.125
91.217.72.225
91.223.126.188
91.226.154.4
91.237.124.149
91.246.193.62
91.246.193.141
91.246.195.119
93.185.162.24
94.25.170.220
94.25.172.5
94.25.225.202
94.29.11.244
95.25.72.25
95.104.193.129
95.164.89.123
95.182.126.159
95.217.100.221
101.2.179.139
102.129.145.96
102.129.153.81
102.129.235.35
102.129.235.122
102.165.1.151
102.165.1.231
102.165.16.78
102.165.54.227
103.67.187.236
103.76.117.139
103.76.117.166
103.87.142.204
103.113.148.219
103.115.101.13
103.136.201.30
103.155.118.190
103.204.110.154
103.240.99.181
104.28.197.9
104.28.205.70
104.28.222.75
104.143.229.15
104.143.229.66
104.160.17.250
104.167.28.239
104.168.134.63
104.168.140.130
104.206.81.174
104.233.53.46
104.238.8.139
104.238.9.22
104.238.37.15
104.239.78.92
104.239.84.54
104.239.93.220
104.239.113.229
107.77.87.19
107.77.237.231
107.172.35.182
107.172.52.69
107.172.52.76
107.172.52.84
107.172.52.100
107.172.52.207
107.172.52.218
107.172.81.235
107.172.81.241
107.172.81.247
107.172.130.71
107.172.130.117
107.172.130.224
107.172.132.87
107.172.163.82
107.172.238.174
107.172.246.201
107.172.246.214
107.172.246.242
107.172.246.250
107.173.204.137
107.173.204.138
107.174.5.202
107.174.150.16
107.175.13.13
107.175.13.102
107.175.65.10
107.175.65.93
107.175.67.225
107.175.77.158
107.175.86.237
107.175.152.110
107.179.26.243
107.181.142.16
107.181.152.45
107.189.132.37
107.189.164.215
107.189.165.99
107.189.174.131
108.177.131.73
108.177.131.177
109.69.109.22
109.70.100.1
109.70.100.4
109.70.100.68
109.107.175.11
109.125.100.49
109.207.130.115
109.207.130.126
109.207.130.168
109.236.87.67
109.248.13.14
109.248.15.27
109.248.142.166
109.248.166.205
113.23.42.187
116.202.116.111
118.179.168.83
119.42.36.164
119.42.38.221
119.42.39.46
119.42.39.55
119.42.39.147
120.37.121.209
120.40.130.70
125.228.216.16
130.0.236.22
130.44.200.161
130.44.200.217
130.44.202.134
130.185.156.112
131.108.18.14
131.108.18.28
131.108.18.110
131.108.18.204
131.108.19.168
131.108.19.175
134.255.243.207
135.181.125.113
138.122.195.57
138.199.59.39
138.219.73.178
138.219.73.182
142.111.245.100
142.147.129.204
146.70.111.132
146.70.111.138
147.78.141.82
147.92.36.42
147.236.231.253
148.72.212.198
148.163.24.6
149.34.245.204
149.40.50.12
149.40.50.50
149.71.180.230
149.71.181.27
149.71.181.109
149.71.181.232
154.3.129.83
154.13.96.76
154.13.99.34
154.13.100.141
154.13.100.171
154.13.103.102
154.13.103.242
154.13.105.66
154.13.107.198
154.13.108.141
154.13.108.159
154.13.108.179
154.13.108.250
154.13.110.47
154.13.110.132
154.13.110.161
154.13.111.136
154.13.125.108
154.13.125.204
154.13.126.245
154.21.223.38
154.21.223.114
154.22.60.117
154.29.239.59
154.30.213.51
154.30.213.53
154.30.213.65
154.30.213.74
154.30.213.78
154.30.213.109
154.30.213.123
154.30.213.140
154.30.213.149
154.30.213.168
154.30.213.247
154.30.213.251
154.95.0.130
154.95.32.42
154.95.32.92
154.118.228.210
154.127.240.6
154.201.62.230
156.146.41.206
156.146.55.170
156.146.60.131
156.146.60.137
156.146.63.171
156.238.7.75
156.238.10.203
156.239.55.185
156.239.62.142
159.242.227.2
159.242.227.96
161.0.20.124
161.123.101.49
161.123.131.52
161.123.152.176
161.123.209.58
161.123.209.113
162.19.43.90
162.158.129.124
162.158.222.23
162.212.169.96
162.212.169.118
162.212.173.178
162.247.74.200
163.5.71.127
163.172.189.23
165.231.35.85
165.231.35.214
165.231.45.104
165.231.45.214
165.231.84.70
165.231.84.78
165.231.97.60
165.231.159.146
165.231.164.67
165.231.164.178
165.231.164.184
165.231.165.54
165.231.165.85
165.231.165.241
165.231.182.128
166.1.11.32
166.88.58.85
167.160.74.107
168.151.226.8
168.151.226.47
168.151.228.41
168.151.242.69
168.151.242.74
168.151.242.86
168.228.45.96
170.83.177.235
170.130.178.3
170.130.178.20
171.22.248.146
171.25.193.235
171.233.230.115
171.234.9.174
172.64.236.139
172.68.10.188
172.68.50.22
172.68.50.36
172.68.50.212
172.68.102.47
172.68.110.201
172.68.243.82
172.69.130.72
172.69.150.225
172.69.151.19
172.69.151.84
172.69.214.84
172.69.222.190
172.70.86.185
172.70.114.120
172.70.160.141
172.70.210.195
172.70.211.67
172.70.230.154
172.70.247.107
172.71.30.210
172.71.90.7
172.71.90.8
172.71.99.148
172.71.102.163
172.71.114.14/31
172.71.122.57
172.71.122.207
172.71.123.93
172.71.123.137
172.71.126.183
172.71.131.14
172.71.134.219
172.71.182.14/31
172.71.250.140
172.96.95.132
172.96.95.150
172.98.33.22
172.98.33.25
172.98.33.50
172.98.33.53
172.98.33.58
172.98.181.83
172.241.171.132
172.241.171.186
172.245.73.22
172.245.113.251
172.245.193.76
172.245.193.246
172.245.251.160
172.255.93.69
172.255.93.136
172.255.93.146
173.213.93.210
173.214.177.193
173.234.100.218
173.239.196.193
173.239.196.195
173.239.196.197
174.230.159.211
176.36.227.158
176.125.230.18
176.126.111.237
177.234.138.168
177.234.138.173
177.234.139.107
177.234.139.110
178.20.44.240
178.74.104.214
178.159.37.55
178.175.130.243
178.176.73.165
178.176.73.211
178.176.75.99
178.176.76.22
178.176.76.107
178.176.77.26
178.176.77.60
178.176.77.247
178.176.78.8
178.176.79.50
181.41.206.128
181.41.206.168
181.177.76.60
181.177.100.123
181.214.94.52
181.214.167.63
181.214.167.105
184.170.242.147
184.170.252.173
184.174.27.200
184.174.44.69
185.28.180.213
185.28.181.43
185.28.181.93
185.28.181.157
185.77.223.193
185.94.189.202
185.121.138.148
185.136.160.213
185.162.35.18
185.172.128.138
185.173.38.225
185.181.245.141
185.192.70.8
185.192.70.152/31
185.192.70.161
185.192.70.168/31
185.196.191.157
185.197.74.94
185.220.101.65
185.220.101.110
185.225.28.236
185.244.182.6
185.253.160.8
185.253.162.3
186.179.3.40
186.179.6.5
186.179.6.58
186.179.6.233
186.179.20.90
186.179.21.185
186.179.33.80
186.179.52.56
186.179.52.125
186.179.52.157
186.179.52.180
188.130.128.196
188.130.142.248
188.130.185.118
188.130.219.173
188.187.46.70
188.212.135.10
188.232.28.226
191.96.67.120
191.96.67.176
191.96.150.23
191.96.168.59
191.101.114.72
191.102.153.254
191.102.156.2
191.102.164.33
191.102.164.207
192.3.56.54
192.3.57.229
192.3.142.126
192.3.143.171
192.3.147.119
192.3.183.52
192.3.188.245
192.3.220.175
192.3.220.185
192.3.255.194
192.42.116.179
192.71.249.82
192.111.130.5
192.186.136.243
192.186.159.221
192.186.182.10
192.198.98.49
192.198.115.200
192.198.119.70
192.210.200.136
192.210.201.154
192.210.241.109
192.227.128.203
192.241.72.118
192.241.73.170
192.241.80.233
192.241.80.253
192.241.105.129
192.241.105.215
193.8.231.139
193.35.18.77
193.93.194.69
193.114.128.183
193.188.20.66
193.188.20.238
193.188.21.49
193.188.21.238
193.233.142.71
193.233.142.241
193.233.211.113
194.5.82.35
194.32.122.48
194.32.122.71
194.39.32.53
194.39.33.148
194.113.106.9
194.113.119.161
195.146.4.81
195.201.29.129
195.201.88.58
196.51.140.2
196.51.140.20
196.51.140.102
196.51.140.136
196.51.140.166
196.51.140.175
196.51.190.156
196.51.201.47
196.51.201.71
196.51.201.74
196.51.201.96
196.51.201.116
196.51.201.161
196.51.201.170
196.51.201.187
196.51.201.240
196.51.204.50
196.51.204.86
196.51.204.94
196.51.204.124
196.51.204.138
196.51.204.159
196.51.204.175
196.51.204.205
196.51.204.229
196.51.207.82
196.51.249.35
196.51.249.66
196.51.249.89
196.51.249.93
196.51.249.102
196.51.249.155
196.51.249.170
196.51.249.219
196.51.249.255
196.51.252.44
196.51.252.88
196.51.252.121
196.51.252.125
196.51.252.131
196.51.252.151
196.51.252.182
196.51.252.221
196.51.252.238
196.57.225.48
196.57.225.54
196.57.225.165
196.58.225.13
196.58.225.77
196.58.225.87
196.58.225.126
196.58.225.149
196.58.225.165
196.58.225.194
196.58.225.200
196.58.225.228
196.58.229.104
196.58.229.110
196.196.34.10
196.196.34.81
196.196.34.153
196.196.35.33
196.196.35.41
196.196.35.206
196.196.37.38
196.196.37.147
196.196.53.89
196.196.68.22
196.196.160.96
196.196.160.249
196.196.222.46
196.197.10.66
196.197.10.181
196.197.10.193
196.198.211.10
196.198.211.31
196.198.211.33
196.198.211.50
196.198.211.180
196.199.40.43
196.199.104.233
196.240.51.43
196.240.51.67
196.240.51.88
196.240.51.126
196.240.51.186
196.240.51.214
196.240.51.240
196.240.104.26
196.240.104.100
196.240.105.122
196.240.105.166
196.240.143.23
196.240.143.210
196.240.173.3
196.240.173.119
196.240.173.138
196.240.173.184
196.240.237.16
196.240.237.73
196.240.237.140
196.240.237.211
196.240.237.223
196.240.254.200
196.241.86.144
196.242.21.209
196.242.47.79
196.242.47.138
196.242.57.9
196.242.57.123
196.242.57.210
196.242.84.106
196.242.89.92
196.242.89.126
196.242.89.210
196.242.114.11
196.242.114.100
196.242.114.104
196.242.141.6/31
196.242.141.24
196.242.141.199
196.242.178.111
196.242.178.162
196.242.178.231
196.242.195.55
196.242.195.65
196.242.195.187
196.242.195.217
196.242.200.47
196.243.240.140
196.243.240.240
196.245.186.143
196.245.216.243
196.247.18.124
196.247.18.141
196.247.18.232
196.247.160.164
196.247.212.156
198.20.179.207
198.23.152.237
198.23.170.169
198.23.170.192
198.46.148.38
198.46.161.24
198.46.161.158
198.46.169.49
198.46.169.89
198.46.184.21
198.46.208.139
198.96.95.165
198.144.187.114
198.154.89.38
198.181.163.249
198.240.115.87
198.245.67.27
198.245.72.87
199.188.102.34
203.80.167.62
206.41.169.64
206.206.73.195
206.220.175.2
207.244.217.182
207.244.254.27
208.91.64.41
209.99.165.221
209.127.17.171
209.127.17.176
209.127.28.160
209.242.209.94
209.242.209.141
209.242.209.163
209.242.209.242
209.242.210.41
209.242.210.71
209.242.210.76
209.242.210.100
209.242.210.152
209.242.210.158
210.212.39.138
212.18.126.183
212.30.36.56
212.30.36.60
212.30.36.66
212.30.36.86
212.30.36.124
212.30.36.144
212.30.36.167
212.102.35.98
212.102.37.185
212.102.39.143
212.102.49.207
213.219.247.106
213.219.247.125
216.19.216.137
216.19.216.150
216.19.217.251
216.131.105.120
216.158.205.68
216.173.76.10
216.173.103.2
216.213.27.168
217.66.159.30
217.170.202.237
220.134.249.220
222.252.21.69
223.29.254.4
223.224.16.65
223.224.23.220

14247
botscout_30d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

4975
botscout_7d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

249
botvrij_dst.ipset Normal file
View File

@ -0,0 +1,249 @@
#
# botvrij_dst
#
# ipv4 hash:ip ipset
#
# [botvrij.eu] (http://www.botvrij.eu/) Indicators of
# Compromise (IOCS) about malicious destination IPs, gathered
# via open source information feeds (blog pages and PDF
# documents) and then consolidated into different datasets.
# To ensure the quality of the data all entries older than
# approx. 6 months are removed.
#
# Maintainer : botvrij.eu
# Maintainer URL : http://www.botvrij.eu/
# List source URL : http://www.botvrij.eu/data/ioclist.ip-dst.raw
# Source File Date: Sat May 4 11:22:52 UTC 2024
#
# Category : attacks
# Version : 82
#
# This File Date : Sat May 4 21:36:05 UTC 2024
# Update Frequency: 1 day
# Aggregation : none
# Entries : 215 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=botvrij_dst
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.92.240.113
3.144.135.247
5.183.95.95
14.225.210.97
14.225.210.98
14.225.210.209
14.225.210.222
18.215.238.53
20.120.249.43
20.151.89.252
20.237.166.161
23.95.209.148
23.159.160.88
23.224.99.242
23.224.99.243
23.224.99.244
23.224.99.245
23.224.99.246
23.225.35.234
23.225.35.235
23.225.35.236
23.225.35.237
23.225.35.238
34.135.1.100
37.120.237.204
37.120.237.248
37.139.129.145
38.180.2.23
38.180.3.57
38.180.76.31
43.153.75.48
43.153.106.236
43.155.173.104
43.157.58.203
43.157.63.199
43.163.221.160
43.254.217.165
45.9.148.193
45.9.149.215
45.63.119.131
45.67.230.91
45.76.118.87
45.77.52.253
45.77.54.14
45.86.163.224
45.86.163.244
45.89.106.147
45.95.11.134
45.128.134.189
45.128.232.143
45.142.166.112
45.153.240.73
45.251.240.55
46.8.198.196
49.51.49.54
51.15.145.37
51.79.208.192
52.161.154.239
54.219.169.167
62.84.100.225
62.115.255.163
63.79.171.112
64.31.63.70
64.31.63.194
65.20.97.203
65.21.51.58
66.70.160.251
70.62.153.174
74.124.219.71
77.246.96.204
79.134.225.17
82.102.19.88
82.180.150.197
84.32.189.74
85.239.54.190
86.105.18.113
89.44.198.16
89.44.198.189
89.44.198.196
91.92.247.212
91.92.254.31
91.235.234.81
91.235.234.251
93.115.22.212
94.131.3.160
94.131.98.14
94.131.109.65
94.156.71.115
95.164.38.99
95.164.46.199
95.179.176.250
96.44.159.46
103.20.222.218
103.27.132.69
103.27.202.85
103.51.140.101
103.56.53.46
103.76.128.34
103.114.200.230
103.119.3.230
103.125.218.198
103.127.43.208
103.212.81.155
103.212.81.157
104.156.232.22
104.193.88.123
107.148.19.88
107.148.41.146
107.172.16.208
107.172.79.5
107.173.140.111
118.193.40.42
121.37.174.139
121.227.168.69
131.196.252.148
134.122.197.80
139.99.23.9
139.162.135.12
145.239.54.169
146.70.124.102
146.70.149.61
149.28.166.244
152.70.83.47
154.22.235.13
154.22.235.17
154.39.142.47
156.241.86.2
162.62.225.65
167.114.4.175
167.114.138.249
170.106.196.76
172.86.66.165
172.105.90.154
172.105.94.93
172.105.124.34
172.233.245.241
173.233.137.36
173.233.137.44
173.233.137.52
173.233.137.60
173.233.139.164
176.31.18.153
176.97.66.57
176.97.76.118
176.97.76.129
176.99.6.152
176.119.195.113
176.119.195.115
176.124.32.84
178.21.13.3
178.21.13.32
178.21.13.33
178.21.13.34
178.21.13.35
178.21.14.92
178.21.14.93
178.21.15.41
178.21.15.42
178.21.15.85
178.21.15.183
178.21.15.204
178.162.227.180
179.43.172.127
179.43.172.191
183.134.93.171
185.44.81.147
185.123.101.250
185.162.235.206
185.167.60.85
185.180.223.48
185.220.101.58
185.227.111.17
185.228.72.38
185.241.208.83
185.241.208.104
185.244.30.218
185.244.210.65
185.244.210.120
190.2.145.24
192.36.57.181
192.210.137.35
192.243.59.12
192.243.59.13
192.243.59.20
192.243.61.225
192.243.61.227
193.34.167.245
193.142.58.126
194.4.49.6
194.32.78.183
195.10.205.23
198.50.170.72
198.98.56.93
198.244.174.214
199.34.27.196
203.95.8.98
203.95.9.54
205.147.101.170
205.209.102.218
205.234.232.196
207.148.74.250
212.193.2.48
213.156.138.68
213.156.138.77
213.156.138.78
216.155.157.136
216.238.66.251
216.238.71.49
216.238.72.201
216.238.74.95
216.238.75.155
216.238.81.149
216.238.85.220
216.238.86.24
217.57.80.18

34
botvrij_src.ipset Normal file
View File

@ -0,0 +1,34 @@
#
# botvrij_src
#
# ipv4 hash:ip ipset
#
# [botvrij.eu] (http://www.botvrij.eu/) Indicators of
# Compromise (IOCS) about malicious source IPs, gathered via
# open source information feeds (blog pages and PDF
# documents) and then consolidated into different datasets.
# To ensure the quality of the data all entries older than
# approx. 6 months are removed.
#
# Maintainer : botvrij.eu
# Maintainer URL : http://www.botvrij.eu/
# List source URL : http://www.botvrij.eu/data/ioclist.ip-src.raw
# Source File Date: Tue Mar 8 13:55:10 UTC 2022
#
# Category : attacks
# Version : 7
#
# This File Date : Tue Mar 8 16:40:02 UTC 2022
# Update Frequency: 1 day
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=botvrij_src
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

345
bruteforceblocker.ipset Normal file
View File

@ -0,0 +1,345 @@
#
# bruteforceblocker
#
# ipv4 hash:ip ipset
#
# [danger.rulez.sk bruteforceblocker]
# (http://danger.rulez.sk/index.php/bruteforceblocker/)
# (fail2ban alternative for SSH on OpenBSD). This is an
# automatically generated list from users reporting failed
# authentication attempts. An IP seems to be included if 3 or
# more users report it. Its retention pocily seems 30 days.
#
# Maintainer : danger.rulez.sk
# Maintainer URL : http://danger.rulez.sk/index.php/bruteforceblocker/
# List source URL : http://danger.rulez.sk/projects/bruteforceblocker/blist.php
# Source File Date: Mon May 20 08:11:23 UTC 2024
#
# Category : attacks
# Version : 11448
#
# This File Date : Mon May 20 08:12:38 UTC 2024
# Update Frequency: 3 hours
# Aggregation : none
# Entries : 311 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bruteforceblocker
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
3.101.146.240
8.222.151.199
18.144.155.44
23.90.23.234
23.231.76.210
34.133.25.254
34.219.85.230
35.229.71.59
36.64.232.117
36.85.110.5
37.9.170.115
42.112.26.170
45.125.66.43
45.155.91.99
51.159.5.101
54.67.0.252
54.193.167.244
54.212.192.235
54.244.62.166
58.144.233.25
64.23.145.49
64.23.167.46
64.23.171.169
64.23.171.251
64.23.174.32
64.23.190.155
64.23.244.28
64.226.101.215
64.226.109.23
64.227.105.172
64.227.111.98
64.227.132.252
64.227.138.44
64.227.138.66
64.227.144.154
64.227.149.52
64.227.153.88
64.227.162.229
64.227.170.41
76.187.181.62
85.133.151.219
85.208.117.104
85.209.133.186
87.98.242.187
89.32.41.104
92.118.39.120
92.118.39.229
92.118.39.245
93.42.124.2
94.156.10.184
94.156.79.60
94.156.79.135
102.64.66.222
103.155.193.186
104.248.10.89
106.105.212.133
107.172.39.71
112.169.51.142
112.169.152.30
115.241.74.34
116.98.161.211
116.98.164.96
116.98.165.5
116.98.165.43
116.98.166.205
116.98.169.138
116.98.172.248
116.98.173.91
116.98.174.61
116.105.209.191
116.105.213.181
116.105.223.11
116.110.4.113
116.110.7.215
116.110.9.9
116.110.79.18
116.110.81.51
116.110.84.171
116.110.87.144
116.110.90.217
116.110.91.36
116.110.92.146
116.110.123.235
116.110.215.63
116.110.220.205
128.199.44.78
128.199.255.247
130.61.35.0
132.145.185.47
134.122.33.224
134.209.36.163
134.209.152.32
134.209.159.112
134.209.169.16
137.184.7.237
137.184.116.244
137.184.172.91
137.184.224.6
137.184.227.120
138.197.126.79
138.197.146.41
138.197.159.168
138.197.163.28
139.59.69.243
139.59.93.177
141.94.207.254
141.98.10.106
141.255.167.250
142.93.217.96
143.110.177.211
143.110.223.32
143.110.248.193
143.198.140.5
143.198.203.33
143.244.130.0
146.190.55.2
146.190.130.11
146.190.229.254
146.190.250.4
146.190.250.190
146.190.250.240
152.89.245.140
154.12.187.10
156.241.188.80
157.230.32.23
157.245.98.202
158.220.112.173
159.65.129.182
159.65.171.74
159.65.171.117
159.203.1.160
159.203.98.85
159.203.134.148
159.223.66.124
159.223.87.140
159.223.221.13
159.223.227.249
161.35.33.123
161.35.154.16
161.35.181.61
161.35.185.128
161.35.235.140
164.90.237.98
165.232.137.13
165.232.165.149
165.232.181.254
165.232.189.12
167.71.13.205
170.64.130.28
170.64.130.243
170.64.131.133
170.64.137.171
170.64.139.130
170.64.143.139
170.64.143.168
170.64.145.115
170.64.147.177
170.64.151.128
170.64.151.131
170.64.151.137
170.64.151.148
170.64.151.153
170.64.151.182
170.64.152.11
170.64.152.106
170.64.152.245
170.64.156.146
170.64.157.31
170.64.157.42
170.64.158.169
170.64.159.129
170.64.161.61
170.64.165.18
170.64.165.29
170.64.166.132
170.64.169.157
170.64.173.99
170.64.175.115
170.64.178.151
170.64.179.184
170.64.179.186
170.64.183.131
170.64.185.147
170.64.185.179
170.64.188.34
170.64.188.83
170.64.191.11
170.64.192.54
170.64.194.45
170.64.196.95
170.64.197.57
170.64.198.214
170.64.198.228
170.64.201.55
170.64.204.77
170.64.204.145
170.64.204.203
170.64.205.5
170.64.206.32
170.64.210.127
170.64.212.204
170.64.214.23
170.64.216.63
170.64.216.179
170.64.218.4
170.64.220.211
170.64.221.103
170.64.221.234
170.64.222.78
170.64.222.223
170.64.225.105
170.64.225.175
170.64.226.37
170.64.226.55
170.64.227.75
170.64.227.140
170.64.228.80
170.64.228.179
170.64.229.8
170.64.229.110
170.64.229.236
170.64.229.237
170.64.229.249
170.64.229.250
170.64.229.252
170.64.230.42
170.64.230.103
170.64.231.52
170.64.232.213
170.64.233.87
170.64.233.88
170.64.233.90
170.64.234.173
170.64.234.216
170.64.236.66
170.64.238.15
171.251.17.22
171.251.18.104
171.251.19.8
171.251.19.248
171.251.20.185
171.251.20.233
171.251.21.233
171.251.22.0
171.251.23.169
171.251.29.39
171.251.29.139
171.251.31.170
172.233.57.157
174.138.5.127
174.138.8.137
174.138.14.89
174.138.15.119
174.138.78.199
175.202.13.55
176.10.248.195
178.128.37.192
178.150.14.144
182.155.43.159
183.14.90.94
183.81.169.139
185.22.65.186
185.196.8.151
185.196.11.132
185.234.216.97
188.166.7.42
188.166.11.148
188.166.27.237
188.166.29.90
188.166.31.47
188.166.155.155
192.227.148.214
193.32.162.15
193.32.162.29
193.32.162.38
193.32.162.63
193.32.162.76
193.32.162.79
193.32.162.83
193.222.96.163
194.59.31.163
194.147.58.73
197.248.193.134
200.58.107.201
206.189.17.193
206.189.33.119
206.189.123.161
206.201.3.228
209.38.16.105
209.38.16.160
209.38.16.207
209.38.24.35
209.38.24.51
209.38.24.74
209.38.24.148
209.38.24.193
209.38.24.200
209.38.24.227
209.38.28.46
209.38.28.251
209.38.32.79
209.38.144.4
209.38.154.209
209.38.230.248
209.97.134.50
209.97.186.73
212.233.49.104
213.136.73.226
213.168.248.141
222.107.240.107
223.82.83.34

15031
ciarmy.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

9175
cidr_report_bogons.netset Normal file
View File

File diff suppressed because it is too large Load Diff

4549
cleanmx_phishing.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

12221
cleanmx_viruses.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

521
cleantalk.ipset Normal file
View File

@ -0,0 +1,521 @@
#
# cleantalk
#
# ipv4 hash:ip ipset
#
# [CleanTalk] (https://cleantalk.org/) Today's HTTP Spammers
# (includes: cleantalk_new cleantalk_updated)
#
# Maintainer : CleanTalk
# Maintainer URL : https://cleantalk.org/
# List source URL :
# Source File Date: Mon May 20 08:29:01 UTC 2024
#
# Category : abuse
# Version : 28872
#
# This File Date : Mon May 20 08:29:03 UTC 2024
# Update Frequency: 1 min
# Aggregation : none
# Entries : 491 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=cleantalk
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.0.249.103
1.169.108.111
1.191.127.93
2.99.116.48
3.14.10.113
3.16.67.43
3.19.242.46
3.21.104.24
3.21.171.92
3.25.219.165
3.84.208.193
3.89.210.27
3.123.132.169
3.138.191.252
3.142.43.43
3.142.186.14
3.149.29.189
3.215.186.30
3.216.46.22
3.229.58.107
3.234.232.3
4.236.19.32
4.236.22.205
4.236.23.243
5.3.190.34
5.102.101.79
5.142.215.62
5.181.156.155
12.27.99.162
14.228.149.90
15.235.66.211
18.116.89.81
18.188.187.58
18.191.159.139
18.216.0.212
18.217.135.23
18.222.104.196
18.223.122.15
18.224.38.43
18.224.228.71
20.56.12.169
20.244.93.206
23.22.162.121
23.94.228.225
23.109.208.101
23.236.100.205
23.236.142.106
23.236.152.119
23.236.166.193
23.236.167.218
24.199.156.118
24.229.103.242
31.6.43.241
31.6.46.117
31.173.83.160
31.187.78.89
34.38.54.97
34.212.156.71
34.230.45.101
35.173.188.126
36.70.237.146
36.95.122.45
37.130.40.20
37.165.255.26
37.193.212.3
37.212.87.93
37.214.26.57
38.15.141.162
38.75.136.147
38.80.73.64
38.152.42.69
38.152.42.161
38.152.253.54
38.154.138.46
38.154.139.34
38.240.37.203
39.35.53.46
39.35.245.223
40.85.182.251
40.121.233.64
41.211.122.108
42.113.75.218
43.128.111.142
43.128.117.84
43.134.1.40
44.207.116.11
44.215.112.255
45.15.237.175
45.39.72.66
45.43.184.147
45.80.158.24
45.81.136.120
45.146.26.81
45.146.26.101
45.196.62.62
46.8.56.92
46.8.111.185
46.33.140.37
46.72.254.134
46.116.220.11
46.159.91.187
46.159.242.157
46.232.13.60
47.128.113.97
47.236.238.103
47.237.92.197
49.64.148.107
49.72.87.43
49.76.32.171
49.81.50.172
49.81.229.41
49.146.237.10
49.228.122.187
52.0.6.57
52.12.143.212
52.14.232.232
52.15.174.19
52.34.76.65
52.90.210.107
52.204.202.121
54.38.61.106
54.91.241.70
54.158.130.255
54.162.1.240
54.204.161.139
54.226.155.216
54.234.36.253
58.186.130.93
58.240.46.36
59.153.249.190
61.1.51.226
61.74.141.83
61.191.146.30
62.16.50.3
62.16.57.11
62.16.62.67
62.138.14.84
64.222.142.210
65.17.189.119
65.108.20.174
65.109.181.251
65.154.226.166
65.154.226.167
65.154.226.168
65.154.226.169
65.154.226.170
65.154.226.171
66.146.234.211
66.248.217.43
67.20.138.162
67.20.149.70
68.190.58.205
69.171.251.6
74.103.171.120
75.128.138.9
76.20.131.170
76.79.177.230
76.138.249.182
77.34.229.128
77.35.175.49
77.43.230.17
77.66.180.75
77.83.1.144
77.83.1.175
77.83.169.117
77.94.211.222
77.111.247.44
77.242.156.23
78.51.23.157
78.149.214.252
78.243.48.222
79.104.11.18
81.177.23.163
82.162.121.28
83.40.79.184
84.9.114.216
84.239.42.2
84.239.42.134
85.25.74.28
85.25.103.161
85.25.237.38
85.25.237.114
85.175.22.180
85.196.146.54
86.38.154.20
86.38.154.189
87.74.150.79
87.75.97.119
88.254.0.241
89.58.72.70
89.136.247.92
89.149.26.49
89.149.41.117
89.254.202.110
89.254.203.247
91.72.159.198
91.84.125.255
91.92.241.27
91.107.164.186
91.238.99.134
91.238.99.140
92.9.157.242
92.23.97.80
92.24.184.241
92.27.72.112
92.27.251.198
92.31.104.5
92.49.147.186
92.49.149.236
92.49.150.117
92.252.148.86
93.99.159.25
93.113.154.234
93.124.7.29
93.124.26.86
93.152.210.214
93.175.248.196
94.25.178.43
94.158.245.14
94.158.245.33
94.158.245.37
94.158.245.40
95.37.197.206
95.67.137.128
95.67.139.54
95.67.192.144
95.68.132.47
95.68.158.52
95.68.182.116
95.104.176.121
95.152.59.162
95.164.110.45
96.64.47.190
98.182.50.216
98.190.153.195
98.204.134.124
101.2.187.48
103.53.165.26
103.88.238.84
103.109.238.112
103.109.238.114
103.120.135.53
103.122.85.105
103.150.52.140
103.176.173.19
103.180.240.215
103.182.135.140
103.190.253.213
103.207.2.131
103.215.249.121
103.233.100.234
103.255.9.30
104.28.208.42
104.165.169.165
104.206.32.193
104.233.20.80
104.234.211.100
104.234.211.124
104.239.105.165
106.92.112.60
106.213.4.46
107.150.0.244
107.172.181.68
107.175.149.147
108.30.111.50
109.62.209.110
109.127.155.200
109.169.189.7
109.248.14.106
109.248.129.253
109.248.166.175
110.139.75.50
111.72.195.123
111.72.198.173
111.72.198.213
111.72.201.22
111.72.201.243
111.88.45.195
111.90.191.121
111.224.34.162
111.224.35.251
113.88.201.156
113.190.161.189
114.218.29.111
114.218.152.117
114.218.152.225
114.229.32.46
115.77.24.141
115.84.91.250
117.0.197.226
117.81.108.95
117.82.84.209
117.83.72.234
117.92.233.220
117.92.233.251
117.120.9.29
117.194.119.196
117.211.138.87
117.221.225.23
117.245.89.128
117.254.34.103
119.4.175.79
119.28.103.74
119.41.192.174
119.41.193.242
119.41.195.227
119.41.197.251
119.41.201.143
119.123.75.89
121.224.217.228
121.227.91.73
121.227.91.76
121.227.91.144
121.239.67.126
121.239.153.25
121.239.153.139
121.239.249.68
122.52.181.120
122.180.181.203
122.180.181.212
122.180.181.221
124.167.244.226
125.83.163.255
126.153.212.226
131.108.18.218
131.255.104.50
134.236.20.69
134.236.232.84
136.228.129.152
136.243.228.179
136.243.228.194
138.219.179.32
138.229.98.160
139.59.238.66
139.84.154.204
139.84.213.188
139.180.7.50
139.228.50.128
141.11.172.49
142.93.31.251
143.55.131.234
147.45.69.84
147.45.69.209
147.45.69.238
148.113.162.204
150.230.97.30
154.13.126.170
154.38.180.194
154.127.83.86
154.131.106.127
154.201.33.219
154.201.47.222
155.138.156.38
156.146.54.73
156.239.36.146
156.239.39.40
156.248.88.221
156.248.89.18
156.248.89.57
156.248.89.110
156.248.90.94
156.248.90.199
156.248.91.18
156.248.91.86
156.248.91.229
156.255.4.38
156.255.6.138
156.255.6.200
156.255.6.245
156.255.7.48
156.255.7.152
156.255.7.154
156.255.7.196
159.203.81.197
160.119.154.34
162.0.192.65
162.0.205.32
162.223.94.164
163.172.238.140
164.52.217.121
164.90.229.199
165.227.221.120
167.160.72.203
168.151.226.210
171.76.47.136
171.228.153.235
172.111.145.67
172.121.142.20
172.232.237.14
176.124.198.6
176.124.198.18
176.124.198.22
177.234.138.16
178.44.111.60
178.44.143.180
178.44.207.60
178.45.11.208
178.89.183.76
178.141.27.100
178.141.67.82
178.176.72.49
178.176.77.218
178.229.245.186
179.97.40.38
180.117.59.35
180.117.59.62
180.117.59.137
180.117.76.28
180.127.202.118
180.210.178.74
180.244.162.209
181.205.30.194
182.53.246.61
184.152.226.97
185.28.182.246
185.56.144.9
185.162.53.171
186.179.59.65
188.68.47.99
188.138.57.53
188.138.57.86
188.138.102.17
190.145.150.146
192.3.243.137
192.53.69.185
192.126.197.147
192.126.200.15
192.144.25.25
192.152.152.97
192.171.91.18
192.177.93.81
192.186.175.26
192.210.224.172
192.241.65.176
192.241.76.98
193.9.34.26
193.237.131.82
195.140.177.168
196.18.175.42
196.41.60.58
196.196.35.26
196.241.86.79
197.146.27.178
197.211.61.141
198.23.206.39
199.34.87.13
199.250.188.38
200.39.146.0
200.40.61.38
200.142.127.204
202.125.72.110
202.137.154.142
202.137.155.29
202.166.206.138
202.184.114.91
203.176.129.56
203.189.136.143
206.206.119.239
206.206.124.176
207.246.100.253
210.206.51.54
211.24.100.95
212.119.44.85
212.253.212.164
213.14.233.147
213.77.99.69
213.147.202.174
213.238.167.7
216.213.27.11
217.113.194.48
217.113.194.49
217.113.194.50
217.113.194.56
217.113.194.57
217.113.194.58
217.113.194.60
217.113.194.62
217.113.194.63
217.113.194.64
217.113.194.65
217.113.194.67
217.113.194.70
217.113.194.73
217.113.194.76
217.113.194.77
217.113.194.78
217.113.194.79
217.113.194.86
217.113.194.87
217.172.189.37
222.252.21.69

1628
cleantalk_1d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

47791
cleantalk_30d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

10629
cleantalk_7d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

279
cleantalk_new.ipset Normal file
View File

@ -0,0 +1,279 @@
#
# cleantalk_new
#
# ipv4 hash:ip ipset
#
# [CleanTalk] (https://cleantalk.org/) Recent HTTP Spammers
#
# Maintainer : CleanTalk
# Maintainer URL : https://cleantalk.org/
# List source URL : https://cleantalk.org/blacklists/submited_today
# Source File Date: Mon May 20 08:28:53 UTC 2024
#
# Category : abuse
# Version : 27194
#
# This File Date : Mon May 20 08:28:54 UTC 2024
# Update Frequency: 15 mins
# Aggregation : none
# Entries : 250 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=cleantalk_new
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.0.249.103
1.169.108.111
1.191.127.93
2.99.116.48
3.14.10.113
3.16.67.43
3.19.242.46
3.21.104.24
3.21.171.92
3.84.208.193
3.89.210.27
3.123.132.169
3.138.191.252
3.142.43.43
3.142.186.14
3.149.29.189
4.236.19.32
4.236.22.205
4.236.23.243
5.3.190.34
5.142.215.62
14.228.149.90
18.116.89.81
18.188.187.58
18.191.159.139
18.216.0.212
18.224.228.71
20.56.12.169
20.244.93.206
23.109.208.101
24.229.103.242
34.212.156.71
34.230.45.101
35.173.188.126
36.70.237.146
37.165.255.26
37.212.87.93
38.152.42.161
38.152.253.54
39.35.53.46
39.35.245.223
40.121.233.64
42.113.75.218
43.134.1.40
44.215.112.255
45.43.184.147
46.72.254.134
46.116.220.11
46.159.91.187
46.159.242.157
46.232.13.60
47.236.238.103
47.237.92.197
49.64.148.107
49.72.87.43
49.81.50.172
49.81.229.41
49.146.237.10
52.12.143.212
52.14.232.232
52.15.174.19
52.90.210.107
54.91.241.70
54.204.161.139
54.226.155.216
54.234.36.253
58.186.130.93
58.240.46.36
59.153.249.190
61.1.51.226
61.74.141.83
61.191.146.30
62.16.50.3
62.16.57.11
62.16.62.67
64.222.142.210
65.108.20.174
65.109.181.251
66.248.217.43
67.20.149.70
68.190.58.205
74.103.171.120
75.128.138.9
76.79.177.230
76.138.249.182
77.34.229.128
77.35.175.49
77.43.230.17
77.83.169.117
77.94.211.222
77.242.156.23
78.51.23.157
78.149.214.252
78.243.48.222
82.162.121.28
83.40.79.184
84.9.114.216
86.38.154.20
86.38.154.189
87.74.150.79
87.75.97.119
88.254.0.241
89.58.72.70
89.149.41.117
89.254.202.110
89.254.203.247
91.84.125.255
91.92.241.27
91.107.164.186
92.9.157.242
92.23.97.80
92.24.184.241
92.27.72.112
92.27.251.198
92.31.104.5
92.49.147.186
92.49.149.236
92.49.150.117
92.252.148.86
93.124.7.29
93.124.26.86
94.25.178.43
95.37.197.206
95.67.139.54
95.67.192.144
95.68.132.47
95.68.182.116
95.104.176.121
95.152.59.162
98.182.50.216
98.190.153.195
98.204.134.124
101.2.187.48
103.150.52.140
103.176.173.19
103.182.135.140
103.215.249.121
104.206.32.193
106.92.112.60
106.213.4.46
109.62.209.110
109.127.155.200
109.169.189.7
110.139.75.50
111.72.195.123
111.72.198.173
111.72.198.213
111.72.201.22
111.72.201.243
111.224.34.162
111.224.35.251
113.88.201.156
114.218.29.111
114.218.152.117
114.218.152.225
114.229.32.46
115.77.24.141
117.0.197.226
117.81.108.95
117.82.84.209
117.83.72.234
117.92.233.220
117.92.233.251
117.194.119.196
117.211.138.87
117.221.225.23
117.245.89.128
117.254.34.103
119.4.175.79
119.41.192.174
119.41.193.242
119.41.195.227
119.41.197.251
119.41.201.143
121.224.217.228
121.227.91.73
121.227.91.76
121.227.91.144
121.239.67.126
121.239.153.25
121.239.153.139
121.239.249.68
122.180.181.203
122.180.181.212
125.83.163.255
134.236.20.69
134.236.232.84
139.59.238.66
139.84.154.204
139.84.213.188
139.228.50.128
142.93.31.251
143.55.131.234
154.13.126.170
154.38.180.194
154.127.83.86
154.131.106.127
156.248.88.221
156.248.89.18
156.248.89.57
156.248.89.110
156.248.90.94
156.248.90.199
156.248.91.18
156.248.91.86
156.248.91.229
156.255.4.38
156.255.6.138
156.255.6.200
156.255.6.245
156.255.7.48
156.255.7.152
156.255.7.154
156.255.7.196
162.0.192.65
162.0.205.32
171.76.47.136
171.228.153.235
172.111.145.67
178.44.111.60
178.44.207.60
178.45.11.208
178.89.183.76
178.141.27.100
178.141.67.82
178.229.245.186
180.117.59.35
180.117.59.62
180.117.59.137
180.117.76.28
180.127.202.118
182.53.246.61
184.152.226.97
185.28.182.246
190.145.150.146
192.126.197.147
192.126.200.15
192.144.25.25
192.152.152.97
193.237.131.82
196.196.35.26
196.241.86.79
197.146.27.178
202.184.114.91
206.206.119.239
206.206.124.176
210.206.51.54
212.253.212.164
213.147.202.174
213.238.167.7

793
cleantalk_new_1d.ipset Normal file
View File

@ -0,0 +1,793 @@
#
# cleantalk_new_1d
#
# ipv4 hash:ip ipset
#
# [CleanTalk] (https://cleantalk.org/) Recent HTTP Spammers
#
# Maintainer : CleanTalk
# Maintainer URL : https://cleantalk.org/
# List source URL : https://cleantalk.org/blacklists/submited_today
# Source File Date: Mon May 20 08:28:53 UTC 2024
#
# Category : abuse
# Version : 27142
#
# This File Date : Mon May 20 08:28:54 UTC 2024
# Update Frequency: 15 mins
# Aggregation : 1 day
# Entries : 766 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=cleantalk_new_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.0.249.103
1.52.197.171
1.169.108.111
1.191.127.93
2.99.116.48
3.14.8.206
3.14.10.113
3.15.169.122
3.15.209.57
3.16.67.43
3.16.158.3
3.16.158.161
3.17.4.153
3.19.242.46
3.21.104.24
3.21.128.173
3.21.171.92
3.21.236.231
3.81.167.157
3.84.208.193
3.85.15.221
3.87.41.137
3.87.97.214
3.89.210.27
3.91.93.42
3.92.127.78
3.93.69.111
3.123.132.169
3.129.15.234
3.131.36.247
3.131.93.76
3.131.142.171
3.133.92.215
3.133.99.151
3.135.249.23
3.138.191.252
3.139.94.225
3.141.152.99
3.142.43.43
3.142.49.59
3.142.95.121
3.142.186.14
3.143.0.89
3.143.25.144
3.143.253.149
3.144.193.231
3.144.254.138
3.145.180.71
3.149.29.189
3.237.88.173
4.236.19.32
4.236.22.205
4.236.23.153
4.236.23.243
5.3.190.34
5.14.194.168
5.138.162.135
5.142.215.62
5.227.186.54
5.227.188.32
5.227.220.6
5.227.243.182
5.227.248.225
5.253.117.215
13.53.197.204
13.58.57.244
13.58.132.97
14.165.158.162
14.228.149.90
14.237.129.106
14.251.215.143
15.185.97.255
18.116.89.81
18.117.115.142
18.130.159.244
18.188.80.123
18.188.113.80
18.188.187.58
18.188.221.90
18.191.159.139
18.212.144.171
18.216.0.212
18.217.29.234
18.218.89.173
18.221.186.159
18.222.122.185
18.222.169.139
18.222.178.240
18.222.204.247
18.222.237.114
18.223.122.15
18.224.29.201
18.224.228.71
18.232.91.196
18.232.109.240
18.234.89.72
20.51.203.111
20.56.12.169
20.217.210.145
20.244.93.206
23.106.131.228
23.109.208.101
23.113.148.104
24.46.57.60
24.162.216.36
24.162.217.136
24.191.88.193
24.228.8.229
24.229.103.242
24.236.99.58
27.64.4.214
27.65.115.43
31.29.142.11
31.29.169.32
31.29.206.34
31.181.44.95
31.181.49.61
31.181.74.120
34.212.156.71
34.228.229.204
34.229.212.99
34.230.45.101
35.173.188.126
36.70.237.146
36.148.143.27
36.232.8.21
37.165.255.26
37.170.93.47
37.212.87.93
37.214.26.57
37.217.29.68
37.228.141.92
38.152.42.161
38.152.253.54
38.180.48.117
38.183.10.147
39.35.53.46
39.35.245.223
39.73.46.74
40.121.222.66
40.121.233.64
41.111.53.69
42.112.96.189
42.113.75.218
42.117.168.219
42.118.0.17
43.134.1.40
43.153.35.80
43.153.207.93
44.215.112.255
45.43.68.183
45.43.184.147
45.79.170.82
45.95.116.195
45.125.18.27
45.207.49.141
46.72.254.134
46.116.220.11
46.117.98.173
46.158.107.2
46.158.170.106
46.159.35.34
46.159.91.187
46.159.224.85
46.159.242.157
46.232.13.60
47.17.181.126
47.36.132.51
47.220.223.164
47.236.126.16
47.236.238.103
47.237.92.197
49.64.148.43
49.64.148.107
49.64.148.128
49.64.159.152
49.64.159.161
49.72.87.43
49.72.87.137
49.81.50.164
49.81.50.172
49.81.147.16
49.81.229.41
49.81.229.56
49.146.237.10
50.3.221.107
50.116.60.12
52.12.143.212
52.14.232.232
52.15.158.80
52.15.174.19
52.90.210.107
52.91.59.82
52.91.209.183
54.87.128.75
54.91.241.70
54.92.186.193
54.152.70.218
54.158.204.221
54.167.224.51
54.167.233.54
54.172.82.233
54.173.235.40
54.198.223.51
54.204.161.139
54.208.75.234
54.218.39.150
54.224.75.28
54.224.175.44
54.226.155.216
54.227.45.57
54.234.36.253
54.236.9.98
58.186.130.93
58.240.46.36
59.99.5.14
59.153.249.190
60.24.188.137
61.1.51.226
61.74.141.83
61.191.146.30
62.16.45.190
62.16.50.3
62.16.51.230
62.16.57.11
62.16.62.67
64.222.142.210
64.222.200.182
64.234.51.104
65.17.189.107
65.25.156.111
65.28.7.246
65.35.148.217
65.108.20.174
65.108.251.182
65.109.65.55
65.109.181.251
65.242.95.190
66.153.136.92
66.232.51.46
66.248.217.43
67.20.149.70
68.55.19.10
68.131.122.154
68.169.171.99
68.190.58.205
68.197.108.65
68.204.107.165
68.248.122.83
69.53.221.80
69.138.3.210
69.140.203.11
69.141.223.148
69.251.20.161
70.178.132.134
71.112.153.21
71.125.20.64
71.126.137.221
71.143.232.152
71.146.47.174
71.178.179.229
72.69.142.75
72.183.114.28
73.184.42.67
73.210.20.11
73.221.190.203
74.71.160.123
74.73.65.182
74.103.171.120
75.31.194.192
75.65.73.193
75.68.223.33
75.107.252.130
75.128.138.9
75.210.171.47
75.226.30.180
76.79.177.230
76.98.79.190
76.138.249.182
76.145.199.142
76.154.198.145
77.34.47.77
77.34.80.87
77.34.229.128
77.35.163.122
77.35.175.49
77.43.176.230
77.43.215.106
77.43.221.133
77.43.230.17
77.83.169.117
77.94.211.222
77.242.156.23
78.51.23.157
78.149.214.252
78.174.0.21
78.243.48.222
79.247.239.186
80.41.86.242
80.47.179.96
80.97.40.28
80.234.5.223
80.234.24.39
80.234.49.142
80.234.58.194
80.234.65.119
81.2.8.23
81.39.129.41
82.162.121.28
82.162.123.137
83.11.44.156
83.40.79.184
83.135.118.114
84.9.114.216
84.43.40.205
85.175.22.180
86.38.154.20
86.38.154.189
86.107.110.34
87.74.150.79
87.75.97.119
87.75.188.252
88.200.243.64
88.226.204.95
88.236.67.84
88.237.227.225
88.254.0.241
89.6.254.233
89.36.231.128
89.58.72.70
89.58.72.80
89.116.77.237
89.148.218.189
89.148.250.112
89.149.41.117
89.201.170.220
89.240.113.5
89.241.82.54
89.241.82.122
89.241.82.157
89.241.85.24
89.254.202.110
89.254.203.247
89.254.206.187
89.254.244.252
91.39.178.44
91.84.125.255
91.90.126.3
91.92.241.27
91.107.164.186
91.126.132.83
91.132.114.85
91.199.223.196
91.201.245.188
92.6.203.29
92.9.157.242
92.16.232.198
92.18.110.70
92.23.97.80
92.24.184.241
92.27.72.112
92.27.251.198
92.29.43.204
92.31.104.5
92.49.137.127
92.49.140.220
92.49.147.186
92.49.149.236
92.49.150.117
92.49.155.66
92.49.165.244
92.49.166.233
92.49.171.134
92.49.177.154
92.252.129.237
92.252.139.151
92.252.148.86
92.252.176.214
92.252.208.116
92.252.226.218
92.252.234.59
92.252.236.172
93.84.207.109
93.120.153.58
93.124.7.29
93.124.26.86
93.124.92.235
93.221.184.39
94.25.178.43
94.58.132.250
94.133.189.110
94.241.200.70
94.241.213.91
94.241.217.234
94.241.238.83
95.25.254.210
95.37.191.195
95.37.197.206
95.37.198.62
95.67.139.54
95.67.143.230
95.67.146.106
95.67.181.251
95.67.192.144
95.68.132.47
95.68.163.228
95.68.182.116
95.68.183.207
95.68.197.33
95.68.210.173
95.71.42.128
95.71.75.103
95.71.201.54
95.71.202.96
95.71.231.198
95.71.254.6
95.83.9.128
95.104.141.225
95.104.176.121
95.152.59.162
97.81.243.16
98.168.182.229
98.182.50.216
98.190.153.195
98.204.134.124
98.217.108.15
99.43.161.102
99.120.108.87
99.145.51.20
100.11.192.26
101.2.187.48
101.115.7.97
103.137.45.7
103.150.52.140
103.165.28.211
103.176.173.19
103.182.135.140
103.215.249.121
104.168.134.63
104.196.100.245
104.206.32.193
104.247.113.186
106.92.112.60
106.110.94.22
106.110.94.25
106.110.94.30
106.110.94.39
106.110.94.58
106.213.4.46
107.10.38.34
108.41.155.199
108.202.68.134
108.227.110.119
108.231.4.19
109.62.182.227
109.62.209.110
109.69.109.16
109.127.155.200
109.127.185.194
109.169.185.48
109.169.189.7
109.184.79.164
109.184.100.80
109.184.217.207
109.184.218.116
109.184.228.103
110.139.75.50
111.72.195.123
111.72.196.81
111.72.196.100
111.72.196.116
111.72.197.25
111.72.198.6
111.72.198.173
111.72.198.213
111.72.199.81
111.72.200.46
111.72.200.230
111.72.201.22
111.72.201.243
111.224.34.162
111.224.35.100
111.224.35.251
113.88.201.156
114.218.29.111
114.218.72.36
114.218.152.117
114.218.152.225
114.229.32.32
114.229.32.46
115.77.24.141
116.97.216.196
116.99.226.104
116.100.220.194
116.105.66.38
116.107.177.182
117.0.197.226
117.0.217.115
117.81.60.23
117.81.60.161
117.81.108.95
117.81.108.150
117.81.108.184/31
117.82.84.70
117.82.84.150
117.82.84.188
117.82.84.209
117.82.84.242
117.83.72.234
117.83.165.136
117.92.233.220
117.92.233.235
117.92.233.251
117.194.119.196
117.207.101.240
117.211.138.87
117.221.225.23
117.233.140.10
117.245.89.128
117.254.34.103
117.254.34.160
119.4.175.79
119.41.192.14
119.41.192.174
119.41.193.242
119.41.195.227
119.41.195.242
119.41.197.251
119.41.198.85
119.41.199.69
119.41.200.232
119.41.201.143
119.41.201.255
119.41.203.118
119.41.207.48
119.41.207.176
121.224.140.96
121.224.140.196
121.224.217.228
121.227.91.28
121.227.91.73
121.227.91.76
121.227.91.110
121.227.91.117
121.227.91.144
121.227.91.221
121.239.60.4
121.239.60.141
121.239.60.174
121.239.60.192
121.239.67.80
121.239.67.126
121.239.153.25
121.239.153.139
121.239.249.68
121.239.249.86
121.239.249.142
121.239.249.159
121.239.249.209
121.239.249.217
122.176.197.184
122.176.197.225
122.176.203.220
122.180.179.1
122.180.181.203
122.180.181.212
122.180.185.232
122.180.189.37
123.141.51.187
123.141.90.56
123.141.110.91
123.141.126.6
123.141.181.62
125.24.182.13
125.82.65.235
125.82.69.136
125.82.69.183
125.82.78.237
125.83.116.171
125.83.124.160
125.83.163.59
125.83.163.255
125.83.166.179
129.205.124.186
130.185.154.10
131.108.18.83
131.108.19.163
131.108.19.180
131.108.19.206
134.22.122.146
134.236.20.69
134.236.232.84
139.59.238.66
139.84.154.204
139.84.213.188
139.185.56.140
139.228.50.128
140.228.24.150
142.93.31.251
143.55.131.234
150.230.222.81
154.13.126.170
154.29.232.131
154.38.180.194
154.127.83.86
154.131.106.127
154.136.122.115
154.240.144.49
156.248.88.221
156.248.89.18
156.248.89.57
156.248.89.110
156.248.90.94
156.248.90.199
156.248.91.18
156.248.91.86
156.248.91.229
156.255.4.38
156.255.6.138
156.255.6.200
156.255.6.245
156.255.7.48
156.255.7.152
156.255.7.154
156.255.7.196
159.100.17.187
160.177.124.95
161.142.240.169
162.0.192.65
162.0.203.6
162.0.205.32
162.62.52.153
162.220.164.71
162.228.244.109
163.53.183.77
165.231.165.200
167.99.116.183
167.248.28.56
168.228.45.77
171.4.212.76
171.76.47.136
171.97.70.158
171.227.241.122
171.228.153.235
171.233.128.89
172.94.19.165
172.111.145.67
172.112.98.1
172.221.18.182
172.232.111.150
172.232.114.25
172.232.162.85
172.232.164.52
173.64.92.190
173.171.193.31
173.239.217.32
173.248.222.52
174.72.161.177
174.110.4.65
174.166.35.79
174.247.144.172
176.193.78.233
176.194.207.124
176.194.249.80
177.188.146.239
177.188.150.196
177.234.139.36
178.44.0.42
178.44.4.99
178.44.83.184
178.44.93.83
178.44.111.60
178.44.146.61
178.44.195.165
178.44.207.60
178.44.228.27
178.44.232.43
178.44.245.221
178.45.11.208
178.45.101.135
178.45.158.127
178.45.173.21
178.45.178.177
178.45.226.143
178.66.209.248
178.89.183.76
178.127.24.36
178.141.27.100
178.141.38.230
178.141.67.82
178.141.74.208
178.141.107.21
178.141.108.142
178.141.220.70
178.141.231.26
178.229.245.186
180.106.246.189
180.117.59.35
180.117.59.62
180.117.59.137
180.117.59.236
180.117.76.28
180.127.202.70
180.127.202.118
180.253.95.184
182.52.33.128
182.53.246.61
184.72.214.247
184.152.226.97
185.28.182.224
185.28.182.246
185.126.216.58
185.158.106.58
185.158.106.103
185.223.234.38
190.145.150.146
191.55.217.7
191.102.178.116
192.126.197.147
192.126.200.15
192.140.51.151
192.144.25.25
192.152.152.97
193.32.2.135
193.237.131.82
194.102.38.235
196.51.190.5
196.51.255.62
196.57.217.245
196.58.13.41
196.58.214.133
196.58.214.160
196.58.214.201
196.58.229.65
196.113.25.129
196.196.35.26
196.241.86.79
197.146.27.178
198.240.90.197
202.168.85.246
202.184.114.91
206.123.150.8
206.206.119.239
206.206.124.176
207.38.182.46
207.183.179.92
210.206.51.54
210.206.242.19
210.206.242.20
210.207.146.78
210.207.207.29
211.50.166.40/31
211.53.151.12
211.53.185.38
211.95.152.50
211.116.50.8
211.118.11.83
211.118.11.99
212.64.167.251
212.253.212.164
213.147.202.174
213.238.167.7
217.66.208.125
221.200.208.118

15966
cleantalk_new_30d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

4694
cleantalk_new_7d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

49
cleantalk_top20.ipset Normal file
View File

@ -0,0 +1,49 @@
#
# cleantalk_top20
#
# ipv4 hash:ip ipset
#
# [CleanTalk] (https://cleantalk.org/) Top 20 HTTP Spammers
#
# Maintainer : CleanTalk
# Maintainer URL : https://cleantalk.org/
# List source URL : https://cleantalk.org/blacklists/top20
# Source File Date: Sun May 19 13:57:18 UTC 2024
#
# Category : abuse
# Version : 1674
#
# This File Date : Sun May 19 13:57:18 UTC 2024
# Update Frequency: 1 day
# Aggregation : none
# Entries : 20 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=cleantalk_top20
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.210.25
5.188.210.87
45.86.202.70
45.86.202.85
62.122.184.194
62.210.80.33
89.234.157.254
156.146.63.163
178.159.37.4
178.159.37.15
178.159.37.34
185.190.42.200
185.192.69.81
188.126.94.176
188.241.178.25
191.101.31.25
191.101.31.29
199.167.138.22
212.102.57.17
213.159.38.90

279
cleantalk_updated.ipset Normal file
View File

@ -0,0 +1,279 @@
#
# cleantalk_updated
#
# ipv4 hash:ip ipset
#
# [CleanTalk] (https://cleantalk.org/) Recurring HTTP Spammers
#
# Maintainer : CleanTalk
# Maintainer URL : https://cleantalk.org/
# List source URL : https://cleantalk.org/blacklists/updated_today
# Source File Date: Mon May 20 08:29:01 UTC 2024
#
# Category : abuse
# Version : 27141
#
# This File Date : Mon May 20 08:29:01 UTC 2024
# Update Frequency: 15 mins
# Aggregation : none
# Entries : 250 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=cleantalk_updated
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
3.25.219.165
3.215.186.30
3.216.46.22
3.229.58.107
3.234.232.3
5.3.190.34
5.102.101.79
5.181.156.155
12.27.99.162
15.235.66.211
18.217.135.23
18.222.104.196
18.223.122.15
18.224.38.43
23.22.162.121
23.94.228.225
23.236.100.205
23.236.142.106
23.236.152.119
23.236.166.193
23.236.167.218
24.199.156.118
31.6.43.241
31.6.46.117
31.173.83.160
31.187.78.89
34.38.54.97
36.95.122.45
37.130.40.20
37.193.212.3
37.214.26.57
38.15.141.162
38.75.136.147
38.80.73.64
38.152.42.69
38.154.138.46
38.154.139.34
38.240.37.203
40.85.182.251
41.211.122.108
43.128.111.142
43.128.117.84
44.207.116.11
45.15.237.175
45.39.72.66
45.80.158.24
45.81.136.120
45.146.26.81
45.146.26.101
45.196.62.62
46.8.56.92
46.8.111.185
46.33.140.37
46.72.254.134
46.159.242.157
47.128.113.97
49.76.32.171
49.228.122.187
52.0.6.57
52.34.76.65
52.204.202.121
54.38.61.106
54.158.130.255
54.162.1.240
62.138.14.84
65.17.189.119
65.154.226.166
65.154.226.167
65.154.226.168
65.154.226.169
65.154.226.170
65.154.226.171
66.146.234.211
67.20.138.162
69.171.251.6
76.20.131.170
76.138.249.182
77.66.180.75
77.83.1.144
77.83.1.175
77.111.247.44
79.104.11.18
81.177.23.163
84.239.42.2
84.239.42.134
85.25.74.28
85.25.103.161
85.25.237.38
85.25.237.114
85.175.22.180
85.196.146.54
89.136.247.92
89.149.26.49
91.72.159.198
91.238.99.134
91.238.99.140
92.27.72.112
93.99.159.25
93.113.154.234
93.124.7.29
93.152.210.214
93.175.248.196
94.158.245.14
94.158.245.33
94.158.245.37
94.158.245.40
95.67.137.128
95.68.158.52
95.164.110.45
96.64.47.190
103.53.165.26
103.88.238.84
103.109.238.112
103.109.238.114
103.120.135.53
103.122.85.105
103.180.240.215
103.190.253.213
103.207.2.131
103.233.100.234
103.255.9.30
104.28.208.42
104.165.169.165
104.233.20.80
104.234.211.100
104.234.211.124
104.239.105.165
106.213.4.46
107.150.0.244
107.172.181.68
107.175.149.147
108.30.111.50
109.248.14.106
109.248.129.253
109.248.166.175
111.88.45.195
111.90.191.121
113.190.161.189
115.84.91.250
117.120.9.29
119.28.103.74
119.123.75.89
122.52.181.120
122.180.181.212
122.180.181.221
124.167.244.226
126.153.212.226
131.108.18.218
131.255.104.50
136.228.129.152
136.243.228.179
136.243.228.194
138.219.179.32
138.229.98.160
139.180.7.50
141.11.172.49
147.45.69.84
147.45.69.209
147.45.69.238
148.113.162.204
150.230.97.30
154.201.33.219
154.201.47.222
155.138.156.38
156.146.54.73
156.239.36.146
156.239.39.40
159.203.81.197
160.119.154.34
162.223.94.164
163.172.238.140
164.52.217.121
164.90.229.199
165.227.221.120
167.160.72.203
168.151.226.210
172.121.142.20
172.232.237.14
176.124.198.6
176.124.198.18
176.124.198.22
177.234.138.16
178.44.143.180
178.176.72.49
178.176.77.218
179.97.40.38
180.210.178.74
180.244.162.209
181.205.30.194
185.56.144.9
185.162.53.171
186.179.59.65
188.68.47.99
188.138.57.53
188.138.57.86
188.138.102.17
192.3.243.137
192.53.69.185
192.144.25.25
192.171.91.18
192.177.93.81
192.186.175.26
192.210.224.172
192.241.65.176
192.241.76.98
193.9.34.26
195.140.177.168
196.18.175.42
196.41.60.58
197.211.61.141
198.23.206.39
199.34.87.13
199.250.188.38
200.39.146.0
200.40.61.38
200.142.127.204
202.125.72.110
202.137.154.142
202.137.155.29
202.166.206.138
203.176.129.56
203.189.136.143
207.246.100.253
211.24.100.95
212.119.44.85
213.14.233.147
213.77.99.69
216.213.27.11
217.113.194.48
217.113.194.49
217.113.194.50
217.113.194.56
217.113.194.57
217.113.194.58
217.113.194.60
217.113.194.62
217.113.194.63
217.113.194.64
217.113.194.65
217.113.194.67
217.113.194.70
217.113.194.73
217.113.194.76
217.113.194.77
217.113.194.78
217.113.194.79
217.113.194.86
217.113.194.87
217.172.189.37
222.252.21.69

917
cleantalk_updated_1d.ipset Normal file
View File

@ -0,0 +1,917 @@
#
# cleantalk_updated_1d
#
# ipv4 hash:ip ipset
#
# [CleanTalk] (https://cleantalk.org/) Recurring HTTP Spammers
#
# Maintainer : CleanTalk
# Maintainer URL : https://cleantalk.org/
# List source URL : https://cleantalk.org/blacklists/updated_today
# Source File Date: Mon May 20 08:29:01 UTC 2024
#
# Category : abuse
# Version : 27237
#
# This File Date : Mon May 20 08:29:02 UTC 2024
# Update Frequency: 15 mins
# Aggregation : 1 day
# Entries : 907 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=cleantalk_updated_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.58.159.254
2.59.50.134
2.59.163.104
3.15.190.182
3.16.41.142
3.22.209.120
3.25.219.165
3.80.233.87
3.89.68.91
3.90.237.169
3.129.59.176
3.133.132.43
3.136.17.105
3.136.234.163
3.144.135.69
3.145.59.165
3.145.64.235
3.145.110.176
3.145.195.198
3.215.186.30
3.216.46.22
3.229.58.107
3.234.232.3
3.237.88.173
5.3.190.34
5.42.65.52
5.102.101.79
5.102.117.80
5.102.119.236
5.104.176.21
5.157.20.166
5.157.23.34
5.161.197.144
5.181.156.117
5.181.156.155
5.181.156.246
5.181.156.253
12.27.99.162
12.186.205.120
13.58.39.129
13.58.57.244
14.176.84.48
14.224.144.221
14.241.66.50
15.235.11.139
15.235.13.219
15.235.66.211
18.117.156.113
18.118.37.240
18.119.130.231
18.206.186.120
18.215.244.28
18.217.135.23
18.218.89.173
18.219.15.112
18.219.218.186
18.222.104.196
18.223.122.15
18.223.182.235
18.223.185.228
18.224.38.43
18.225.149.136
18.232.70.111
18.232.93.179
20.27.86.185
23.22.162.121
23.27.240.68
23.83.130.133
23.83.179.61
23.83.179.146
23.94.6.11
23.94.146.132
23.94.228.225
23.106.56.22
23.113.148.104
23.230.167.22
23.230.167.102
23.230.167.105
23.230.167.149
23.230.167.181
23.236.100.205
23.236.142.106
23.236.152.119
23.236.166.193
23.236.167.218
23.236.232.172
23.236.233.40
23.236.239.59
23.247.7.58
23.247.137.128
24.199.156.118
31.6.26.35
31.6.43.241
31.6.46.117
31.6.46.153
31.173.81.166
31.173.83.160
31.187.78.89
34.38.54.97
34.72.176.129
34.207.248.199
34.227.95.68
34.228.208.14
34.230.52.117
34.230.56.123
34.238.160.53
35.175.236.10
35.175.239.88
36.37.153.136
36.88.31.42
36.91.45.12
36.95.122.45
37.19.221.51
37.46.113.181
37.130.40.20
37.193.212.3
37.214.26.57
38.15.141.162
38.75.136.147
38.80.73.64
38.130.38.14
38.152.3.240
38.152.11.26
38.152.42.69
38.154.130.214
38.154.138.46
38.154.139.34
38.154.164.126
38.154.164.209
38.154.164.213
38.240.37.203
39.62.17.2
40.85.182.251
41.111.53.69
41.175.21.254
41.191.224.226
41.211.122.108
41.215.17.122
43.128.85.28
43.128.111.142
43.128.111.243
43.128.117.84
43.130.3.13
43.130.27.148
43.130.32.150
43.133.57.14
43.134.16.221
43.135.153.185
43.135.158.230
43.135.177.80
43.153.17.240
43.153.41.229
43.153.44.55
43.153.50.27
43.153.85.215
43.153.112.216
43.153.196.68
43.153.207.149
43.153.244.15
43.153.244.160
43.156.31.106
43.156.38.206
43.156.61.42
43.156.121.150
43.156.143.59
43.156.155.156
43.156.230.101
43.156.237.110
43.159.145.92
43.159.160.9
43.224.116.242
43.245.119.128
44.199.176.56
44.207.116.11
44.210.83.132
44.221.70.232
44.222.250.89
44.223.39.67
45.8.19.199
45.8.19.216/31
45.8.19.232
45.8.125.120
45.11.21.248
45.13.191.31
45.13.191.36
45.13.191.38
45.13.191.41
45.13.191.58
45.15.237.175
45.39.72.66
45.61.118.86
45.77.87.58
45.79.170.82
45.80.158.24
45.81.136.48
45.81.136.120
45.86.200.91
45.87.253.189
45.89.242.9
45.95.118.35
45.119.85.216
45.129.183.14
45.131.195.39
45.135.241.228
45.141.81.59
45.146.26.10
45.146.26.31
45.146.26.36
45.146.26.81
45.146.26.101
45.170.14.249
45.190.168.35
45.192.145.219
45.196.62.62
45.230.126.33
45.249.104.175
45.251.61.37
45.252.59.149
46.8.11.161
46.8.22.175
46.8.23.15
46.8.56.92
46.8.106.6
46.8.106.27
46.8.111.185
46.8.156.60
46.8.213.113
46.8.213.151
46.24.40.120
46.33.140.37
46.72.254.134
46.159.242.157
46.246.122.105
46.246.122.164
47.128.98.103
47.128.111.214
47.128.113.97
47.158.236.106
49.51.36.40
49.51.46.92
49.51.68.80
49.51.179.1
49.51.201.166
49.51.202.229
49.51.204.242
49.51.207.114
49.51.232.248
49.76.32.171
49.76.41.224
49.228.122.187
50.3.159.231
50.3.164.88
50.3.183.238
50.117.66.214
52.0.6.57
52.4.104.152
52.34.76.65
52.55.26.94
52.70.63.136
52.91.137.210
52.91.209.39
52.124.19.25
52.204.202.121
54.38.61.106
54.80.163.20
54.82.203.216
54.89.90.60
54.145.147.114
54.145.184.34
54.146.40.83
54.147.192.120
54.158.130.255
54.161.1.165
54.162.1.240
54.174.58.227
54.174.86.97
54.196.58.82
54.197.204.26
54.198.136.125
54.198.216.12
54.209.11.144
54.211.204.140
54.227.45.57
59.91.245.51
59.153.228.252
62.109.21.68
62.138.14.84
62.149.24.50
63.238.156.220
64.64.115.156
64.137.58.116
65.17.189.119
65.20.142.161
65.20.249.180
65.108.75.167
65.108.100.62
65.154.226.166/31
65.154.226.168/30
66.97.179.31
66.146.234.211
66.146.238.43
67.20.138.162
67.73.245.146
68.248.122.83
69.4.81.90
69.58.12.246
69.160.160.56
69.160.160.60
69.171.249.16/31
69.171.251.6
69.171.251.118
73.209.130.219
74.116.3.122
76.20.131.170
76.32.82.146
76.138.249.182
77.34.229.128
77.43.176.230
77.66.180.75
77.83.1.48
77.83.1.122
77.83.1.144
77.83.1.175
77.83.1.183
77.111.247.44
77.238.229.165
77.238.245.180
78.47.143.200
78.148.205.6
79.9.150.129
79.104.11.18
79.124.72.23
80.85.155.19
80.97.40.28
80.97.43.150
80.210.58.112
81.19.220.168
81.177.23.73
81.177.23.163
83.11.44.156
83.142.52.217
83.217.9.81
83.220.237.233
84.232.112.76
84.239.42.2
84.239.42.12
84.239.42.134
84.247.114.91
84.247.116.131
85.25.74.28
85.25.74.117
85.25.103.161
85.25.237.38
85.25.237.114
85.92.178.111
85.121.204.12
85.122.180.229
85.175.22.180
85.196.146.54
86.105.237.43
87.101.82.151
88.99.86.100
88.151.58.51
88.151.58.174
88.151.101.211
88.218.47.58
89.40.142.216
89.46.100.43
89.136.247.92
89.148.250.112
89.149.26.49
91.72.159.198
91.108.240.52
91.201.245.188
91.217.249.109
91.238.99.134
91.238.99.140
91.246.192.201
92.27.72.112
92.222.249.48
93.99.159.25
93.113.154.234
93.120.216.203
93.124.7.29
93.152.210.214
93.175.248.196
94.141.156.235
94.158.190.191
94.158.245.14
94.158.245.33
94.158.245.37
94.158.245.40
94.230.70.247
95.25.72.25
95.67.137.128
95.68.158.52
95.71.201.54
95.164.110.45
96.64.47.190
96.82.165.254
97.71.215.181
99.88.208.82
100.24.51.81
101.32.254.44
101.44.249.3
102.0.4.64
102.128.131.5
102.223.221.212
103.30.13.214
103.36.10.0
103.53.165.26
103.63.190.115
103.68.86.217
103.80.86.140
103.88.238.84
103.107.132.205
103.109.238.112
103.109.238.114
103.120.135.53
103.122.85.105
103.122.85.108
103.139.66.54
103.147.92.9
103.147.190.6
103.162.57.81
103.174.12.146
103.180.240.215
103.190.253.213
103.207.2.131
103.221.235.48
103.230.63.42
103.233.100.234
103.255.9.30
104.28.205.248
104.28.208.42
104.28.213.40
104.28.245.40
104.148.5.252
104.160.8.92
104.165.169.165
104.165.169.251
104.168.134.63
104.233.12.41
104.233.20.80
104.234.211.100
104.234.211.124
104.234.211.225
104.238.36.41
104.238.132.38
104.239.28.27
104.239.84.79
104.239.84.230
104.239.105.165
104.243.213.72
105.27.162.82
105.27.181.2
105.27.185.130
106.213.4.46
107.23.248.240
107.150.0.244
107.152.32.68
107.172.181.2
107.172.181.68
107.172.181.142
107.175.26.141
107.175.67.208
107.175.77.139
107.175.149.147
108.30.111.50
109.69.108.180
109.69.109.16
109.230.220.203
109.248.14.106
109.248.129.253
109.248.165.215
109.248.166.175
109.248.167.184
109.248.204.127
110.44.117.110
110.77.146.58
110.235.248.195
110.235.255.126
111.72.195.223
111.88.45.195
111.90.181.112
111.90.191.121
113.160.115.119
113.160.183.11
113.161.201.32
113.176.14.74
113.190.161.189
114.4.246.246
114.132.202.246
115.23.28.157
115.74.104.102
115.79.59.196
115.84.91.250
115.85.84.238
116.106.104.15
116.204.148.193
116.212.152.126
116.212.155.237
117.120.9.29
117.207.101.240
117.221.225.23
117.250.199.145
118.179.5.78
119.28.103.74
119.28.106.237
119.123.75.89
120.50.19.246
122.52.181.120
122.180.178.226
122.180.181.212
122.180.181.221
123.205.148.229
124.41.228.243
124.105.206.124
124.167.244.226
126.153.212.226
129.226.146.77
129.226.149.179
129.226.192.252
129.226.208.41
129.226.222.161
130.44.200.38
130.44.202.194
131.108.18.195
131.108.18.218
131.255.104.50
132.226.47.230
134.209.183.190
136.228.129.152
136.243.123.217
136.243.155.105
136.243.228.179
136.243.228.194
138.199.53.246
138.219.179.32
138.229.98.160
138.229.104.24
139.162.249.209
139.180.7.50
139.180.225.70
139.180.227.30
141.11.172.49
142.147.111.22
142.147.128.71
142.147.128.189
143.244.41.232
143.244.41.238
144.48.139.206
146.70.65.150
147.28.155.23
147.45.69.84
147.45.69.209
147.45.69.238/31
147.53.120.91
148.72.152.120
148.72.152.213
148.113.162.204
149.20.243.10
149.56.160.183
150.109.10.166
150.109.18.116
150.230.97.30
152.44.100.25
152.44.104.14
152.44.105.168
152.44.109.2
152.59.95.165
154.13.104.127
154.13.125.211
154.13.126.232
154.16.4.207
154.21.154.46
154.30.227.27
154.54.249.196/31
154.84.143.136
154.95.32.92
154.159.243.92
154.201.33.219
154.201.47.204
154.201.47.222
154.202.99.128
154.202.99.206
154.202.111.195
154.202.113.236
154.202.114.31
154.202.115.14
154.202.116.217
154.202.117.238
154.202.118.166
154.202.124.124
155.138.156.38
156.146.54.73
156.239.36.146
156.239.36.175
156.239.39.40
156.239.48.131
156.239.49.239
156.239.50.205
156.239.52.133
156.239.53.216
156.252.23.189
156.255.6.213
156.255.7.114
159.203.81.197
160.119.154.34
161.38.44.239
161.123.33.39
161.123.154.97
162.19.21.173
162.212.169.118
162.212.173.192
162.223.94.164
162.244.148.1
162.247.74.74
162.247.74.204
162.247.74.216
162.250.127.135
163.5.71.248
163.5.138.92
163.172.238.140
164.52.217.121
164.90.229.199
164.163.188.67
165.227.221.120
165.231.84.103
165.231.182.47
165.231.182.68
166.1.55.93
166.88.122.228
167.160.67.44
167.160.72.203
167.160.78.33
168.91.35.34
168.91.38.91
168.91.41.85
168.91.45.39
168.91.46.10
168.151.226.210
168.195.186.131
168.228.45.120
170.83.177.207
170.106.141.111
170.106.169.164
170.106.187.53
170.106.193.58
172.81.112.106
172.93.142.53
172.94.19.165
172.96.80.201
172.96.94.102
172.121.142.20
172.121.142.125
172.232.237.14
172.245.25.57
172.245.90.148
172.245.194.48
172.252.163.77
173.239.196.198
173.244.41.215
175.29.197.34
176.124.198.6
176.124.198.18
176.124.198.22
176.125.229.29
176.194.249.80
177.92.101.73
177.152.66.200
177.234.138.16
177.234.139.53
178.44.143.180
178.44.228.27
178.62.246.116
178.127.24.36
178.176.72.49
178.176.77.218
178.206.68.32
178.239.175.230
179.97.40.38
180.92.239.210
180.127.202.79
180.210.176.250
180.210.178.74
180.244.162.209
181.177.112.25
181.205.30.194
182.16.162.90
184.73.57.62
184.94.115.194
184.174.56.3
185.25.35.9
185.28.182.224
185.34.130.59
185.56.144.9
185.99.33.180
185.104.216.228
185.126.216.58
185.132.187.120
185.132.187.136
185.132.187.142
185.158.68.9
185.162.53.171
185.181.244.65
185.184.155.5
185.192.69.7
185.192.69.17
185.192.69.39
185.195.212.213
185.199.117.128
185.206.249.74
185.216.178.59
185.220.103.4
185.242.160.154
185.245.25.184
186.96.100.240
186.179.59.65
187.16.109.104
188.68.47.99
188.72.238.94
188.130.137.8
188.130.142.149
188.130.185.140
188.130.218.3
188.130.221.82
188.138.9.37
188.138.57.53
188.138.57.86
188.138.102.17
188.173.163.40
189.17.174.2
190.61.4.86
190.223.53.234
191.96.95.31
191.96.168.75
191.101.92.5
191.101.109.35
192.3.144.31
192.3.178.22
192.3.243.137
192.53.69.185
192.53.137.50
192.67.161.35
192.67.161.55
192.67.162.83
192.126.191.243
192.126.192.114
192.144.25.25
192.171.82.159
192.171.91.18
192.177.93.35
192.177.93.81
192.177.93.143
192.186.160.120
192.186.160.194
192.186.169.58
192.186.175.26
192.186.181.122
192.186.181.124
192.186.185.175
192.198.119.75
192.198.125.209
192.210.128.231
192.210.224.172
192.241.65.176
192.241.76.98
193.9.34.26
193.34.73.80
193.36.172.129
193.56.252.35
193.148.92.242
193.161.3.176
194.31.162.54
194.32.229.62
195.78.54.240
195.78.54.249
195.140.177.168
196.18.175.42
196.41.60.58
196.41.63.42
196.57.225.158
196.196.34.153
196.196.53.84
196.196.53.137
196.196.147.76
196.196.160.37
196.199.40.217
196.242.114.236
196.242.134.135
196.242.200.125
196.244.48.96
196.245.231.64
196.247.160.192
197.44.64.74
197.211.61.141
198.20.168.229
198.20.174.134
198.23.206.39
198.23.239.243
198.46.150.60
198.105.100.96
198.144.190.173
198.202.171.137
198.245.69.186
199.34.86.236
199.34.87.13
199.34.88.1
199.250.188.38
200.39.146.0
200.40.61.38
200.142.127.204
201.219.250.61
202.62.37.206
202.62.47.167
202.63.241.70
202.63.242.119
202.74.242.121
202.124.43.19
202.125.72.110
202.137.154.142
202.137.155.29
202.166.206.62
202.166.206.138
203.112.211.126
203.176.129.56
203.176.141.9
203.189.135.213
203.189.136.143
203.210.241.222
206.123.150.8
206.198.219.18
206.206.67.65
207.182.24.13
207.182.25.68
207.244.217.156
207.246.100.253
209.126.120.141
209.251.19.5
209.251.21.28
210.212.39.138
211.24.100.95
211.24.105.71
212.30.33.211
212.102.35.85
212.102.35.134
212.102.37.185
212.102.57.95
212.115.49.166
212.119.44.85
212.119.47.163
213.14.233.147
213.77.99.69
213.155.160.239
216.10.27.71
216.41.232.5
216.158.208.230
216.173.72.164
216.173.76.28
216.180.106.8
216.185.47.138
216.213.27.11
216.213.29.120
217.113.194.48/31
217.113.194.50
217.113.194.56/30
217.113.194.60
217.113.194.62/31
217.113.194.64/31
217.113.194.67
217.113.194.70
217.113.194.73
217.113.194.76/30
217.113.194.83
217.113.194.86/31
217.113.194.89
217.113.194.93
217.113.194.123
217.113.194.206
217.113.194.215
217.172.189.36/31
217.174.226.117
221.200.208.118
222.252.21.69
223.29.253.147
223.165.4.57
223.206.249.151

37301
cleantalk_updated_30d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

6675
cleantalk_updated_7d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

10464
coinbl_hosts.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

661
coinbl_hosts_browser.ipset Normal file
View File

@ -0,0 +1,661 @@
#
# coinbl_hosts_browser
#
# ipv4 hash:ip ipset
#
# [CoinBlockerLists]
# (https://gitlab.com/ZeroDot1/CoinBlockerLists) Simple lists
# that can help prevent cryptomining in the browser or other
# applications. A hosts list to prevent browser mining only.
# The maintainer's file contains hostnames, which have been
# DNS resolved to IP addresses.
#
# Maintainer : CoinBlockerLists
# Maintainer URL : https://gitlab.com/ZeroDot1/CoinBlockerLists
# List source URL : https://zerodot1.gitlab.io/CoinBlockerLists/hosts_browser
# Source File Date: Mon Mar 4 10:58:09 UTC 2024
#
# Category : organizations
# Version : 53
#
# This File Date : Mon Mar 4 20:32:08 UTC 2024
# Update Frequency: 1 day
# Aggregation : none
# Entries : 627 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=coinbl_hosts_browser
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
3.5.3.185
3.5.20.209
3.18.7.81
3.19.116.195
3.20.137.44
3.33.130.190
3.33.152.147
3.33.243.145
3.64.163.50
3.70.101.28
3.72.140.173
3.130.204.160
3.130.253.23
3.140.13.188
3.141.96.53
3.209.172.72
3.210.192.5
3.216.88.24
3.219.96.23
3.229.186.102
5.35.170.72
5.79.79.211
5.135.131.112
5.206.224.162
5.252.178.30
13.32.99.92
13.32.172.43
13.32.172.77
13.32.172.85
13.32.172.122
13.39.145.251
13.58.215.234
13.224.222.15
13.224.222.25
13.224.222.33
13.224.222.109
13.224.227.45
13.224.227.87
13.224.227.131
13.224.227.205
13.248.148.254
13.248.169.48
13.248.213.45
15.188.219.54
15.197.142.173
15.197.148.33
15.197.192.55
15.197.204.56
18.119.154.66
18.192.94.96
18.192.231.252
18.193.115.229
18.208.60.216
18.211.231.38
18.220.2.62
18.233.173.50
18.244.115.31
18.244.115.84
18.244.115.91
18.244.115.150
23.22.52.7
23.22.130.173
23.22.144.165
23.82.12.30
23.88.53.29
23.101.76.219
23.236.55.104
23.239.5.88
31.11.36.28
31.31.196.245
34.128.82.12
34.203.33.230
34.241.115.67
34.249.160.71
35.156.224.161
35.157.241.235
35.181.89.222
35.184.126.39
35.186.223.180
35.187.160.226
35.192.89.115
35.197.8.113
35.198.107.58
35.199.54.100
35.229.196.203
35.231.101.114
37.48.65.136
37.48.65.144
37.48.65.149
37.48.65.150
37.48.65.151
37.48.65.152
37.48.65.155
37.48.76.140
37.221.212.115
38.48.131.173
44.196.193.227
44.227.65.245
44.227.76.166
45.33.2.79
45.33.18.44
45.33.20.235
45.33.23.183
45.33.28.34
45.33.30.197
45.33.110.230
45.56.79.23
45.56.81.204
45.58.190.82
45.79.0.55
45.79.19.196
45.79.70.13
45.79.73.145
45.79.81.15
45.79.81.196
45.79.97.218
45.79.130.66
45.79.163.250
45.79.199.14
45.79.203.37
45.79.218.212
45.126.210.34
46.4.34.174
46.8.8.100
46.8.8.200
46.38.243.234
46.105.88.234
47.254.33.193
49.212.235.29
50.28.56.190
50.116.24.178
51.75.146.174
51.91.14.108
51.138.9.198
52.5.82.174
52.20.84.62
52.29.9.68
52.57.47.41
52.57.140.222
52.58.3.82
52.58.78.16
52.58.254.253
52.59.100.80
52.59.171.33
52.59.174.115
52.71.57.184
52.216.217.185
52.217.13.124
52.217.133.177
52.217.207.41
54.36.108.36
54.36.108.37
54.36.108.38
54.36.108.39
54.36.168.61
54.36.168.211
54.36.168.213
54.36.175.162
54.36.175.163
54.37.83.70
54.37.84.221
54.37.206.58
54.38.33.16
54.38.192.132
54.38.192.133
54.38.226.140
54.39.52.205
54.39.243.181
54.67.42.145
54.78.134.111
54.83.6.65
54.146.248.82
54.159.116.102
54.165.58.209
54.205.8.205
54.205.31.215
54.209.32.212
54.228.42.199
54.231.162.89
54.231.171.49
54.235.77.118
54.243.238.66
62.138.18.13
64.32.22.102
64.70.19.203
64.91.248.15
64.91.248.18
64.91.249.20
64.190.63.222
64.225.91.73
65.21.140.250
65.21.240.245
66.254.114.211
69.16.230.42
69.16.230.227
69.85.85.20
69.162.95.2
70.32.1.32
70.39.125.243
72.14.178.174
72.14.185.43
72.52.179.174
74.63.241.21
74.207.247.136
75.2.37.224
76.76.21.9
76.76.21.22
76.76.21.61
76.76.21.93
76.76.21.98
76.76.21.123
76.76.21.142
76.76.21.164
76.76.21.241
76.223.26.96
76.223.54.146
76.223.67.189
77.247.182.242
78.46.5.205
78.47.161.84
80.209.230.221
81.171.8.143
81.171.28.43
82.180.157.75
82.192.82.226
83.242.236.76
84.22.115.32
84.32.84.33
84.255.242.136
85.17.26.67
86.105.245.69
87.236.16.207
88.80.191.137
88.86.123.38
88.191.185.113
89.46.102.6
89.58.14.251
89.58.15.35
89.58.15.169
89.252.133.125
91.193.180.124
91.195.240.12
91.195.240.19
91.195.240.123
91.239.200.44
92.222.94.129
93.115.28.104
93.190.139.217
94.23.29.144
94.23.161.19
94.130.138.161
94.229.72.122
94.237.99.118
94.237.103.119
95.168.216.7
95.168.216.9
95.216.77.205
95.216.161.60
95.217.57.182
96.45.82.32
96.45.82.215
96.45.83.19
96.45.83.223
96.126.123.244
100.38.9.220
103.224.182.240
103.224.182.250
103.224.182.253
103.224.212.210
103.224.212.211
103.224.212.213
103.224.212.214
103.224.212.215
103.224.212.216
103.224.212.217
104.16.164.101
104.17.151.12
104.21.3.251
104.21.5.136
104.21.6.144
104.21.14.18
104.21.25.12
104.21.25.70
104.21.25.184
104.21.25.228
104.21.27.195
104.21.28.242
104.21.30.41
104.21.30.115
104.21.32.63
104.21.33.141
104.21.33.168
104.21.34.227
104.21.38.104
104.21.38.218
104.21.39.74
104.21.39.244
104.21.44.248
104.21.45.44
104.21.46.157
104.21.46.191
104.21.48.22
104.21.48.175
104.21.51.238
104.21.53.92
104.21.56.113
104.21.57.121
104.21.57.186
104.21.58.10
104.21.58.197
104.21.59.245
104.21.60.32
104.21.61.200
104.21.63.111
104.21.66.19
104.21.66.49
104.21.66.61
104.21.70.6
104.21.72.157
104.21.75.140
104.21.76.5
104.21.81.117
104.21.82.45
104.21.83.69
104.21.85.170
104.21.86.88
104.21.86.114
104.21.86.228
104.21.88.26
104.21.92.20
104.21.92.27
104.21.92.144
104.21.93.72
104.21.233.213
104.21.233.214
104.22.56.80
104.22.57.80
104.26.0.139
104.26.1.139
104.26.4.31
104.26.5.31
104.31.16.1
104.155.138.21
104.198.14.52
104.198.108.234
104.238.249.57
104.248.84.141
107.6.169.59
107.22.57.98
107.161.23.204
107.178.223.183
108.58.121.94
108.198.190.75
109.123.254.50
116.202.9.166
116.202.21.136
116.203.213.72
127.0.0.1
127.0.0.2
130.211.161.97
134.122.109.150
134.122.174.133
136.243.80.170
138.68.36.34
138.68.67.193
138.68.71.37
138.68.112.220
138.201.35.59
138.201.83.215
139.45.197.250
139.45.197.251
139.99.121.222
139.162.223.125
141.94.96.71
141.94.96.144
141.94.96.195
141.95.72.59
141.95.72.60
141.95.72.61
141.95.206.77
142.44.138.161
142.132.202.70
142.250.200.33
143.204.192.134
143.204.192.161
143.204.192.166
143.204.192.225
143.244.42.32
144.76.35.207
145.239.0.218
145.239.7.163
145.239.70.127
145.239.70.128
145.239.70.129
145.239.141.5
145.239.206.122
145.239.244.5
145.239.244.9
145.239.244.13
145.239.244.74
145.239.253.103
145.239.253.125
146.59.26.8
146.148.34.125
147.135.253.210
148.251.139.94
148.251.178.132
149.56.19.3
149.56.19.43
149.56.20.201
149.56.89.160
149.102.143.109
149.202.83.240
149.202.84.228
154.41.237.70
154.222.233.225
156.224.207.148
156.232.219.34
157.90.144.85
157.230.168.89
157.245.174.176
159.69.42.212
159.69.83.207
159.69.112.37
159.69.152.150
159.69.186.9
162.19.139.184
162.55.172.212
162.240.48.238
162.254.207.52
162.255.119.213
163.172.103.102
164.132.95.123
165.22.209.237
165.232.114.226
168.119.141.228
168.119.185.228
168.119.245.137
168.235.88.209
169.47.130.72
170.39.226.155
170.178.183.18
172.66.41.13
172.66.42.243
172.67.5.10
172.67.68.60
172.67.71.15
172.67.131.100
172.67.133.127
172.67.133.197
172.67.134.118
172.67.134.218
172.67.137.109
172.67.139.83
172.67.140.108
172.67.141.144
172.67.143.168
172.67.145.100
172.67.145.205
172.67.147.232
172.67.150.137
172.67.152.116
172.67.153.103
172.67.153.223
172.67.155.39
172.67.155.78
172.67.159.208
172.67.165.9
172.67.165.117
172.67.165.240
172.67.169.161
172.67.171.251
172.67.172.43
172.67.172.224
172.67.176.30
172.67.177.121
172.67.184.61
172.67.184.200
172.67.184.223
172.67.184.252
172.67.185.87
172.67.186.72
172.67.187.107
172.67.190.93
172.67.191.29
172.67.191.181
172.67.195.50
172.67.201.29
172.67.201.133
172.67.202.6
172.67.206.103
172.67.206.152
172.67.207.56
172.67.208.133
172.67.209.176
172.67.211.53
172.67.214.70
172.67.216.92
172.67.217.49
172.67.217.69
172.67.218.149
172.67.221.141
172.67.221.252
172.98.192.36
172.104.11.229
172.104.21.26
172.104.153.105
172.105.77.223
172.217.16.244
172.234.25.151
173.44.37.208
173.176.230.167
173.255.194.134
173.255.253.174
174.129.128.48
176.9.147.178
178.32.111.67
178.63.8.69
178.79.150.219
178.79.180.12
185.39.18.98
185.53.177.13
185.53.177.31
185.53.177.51
185.53.177.52
185.53.177.53
185.53.177.54
185.53.178.50
185.53.178.51
185.53.178.52
185.107.56.54
185.107.56.194
185.107.56.199
185.107.56.200
185.166.141.7
185.166.141.8
185.166.141.9
185.173.160.140
185.173.160.141
185.199.108.153
185.199.109.153
185.199.110.153
185.199.111.153
185.240.242.35
188.40.2.4
188.40.87.121
188.165.1.80
188.165.36.206
188.165.223.152
190.2.139.23
192.64.119.58
192.134.5.38
192.169.69.26
192.171.18.197
192.185.4.93
193.29.105.150
193.77.224.191
193.238.27.24
194.58.112.174
194.190.130.86
195.20.43.36
195.20.43.198
195.20.44.138
195.20.46.118
195.20.47.173
195.20.49.172
195.20.50.170
195.20.51.116
195.20.55.30
195.154.222.63
195.154.243.212
195.161.41.222
195.181.172.26
195.201.74.132
195.201.83.239
195.201.105.119
195.201.124.255
195.201.162.230
195.201.162.231
198.58.118.167
198.58.126.31
198.251.81.30
198.251.84.49
198.251.84.92
199.59.243.225
202.61.204.169
202.61.225.215
204.11.56.48
204.16.169.54
204.145.90.53
204.188.203.154
207.60.41.68
207.148.248.143
208.80.122.40
208.80.122.139
208.80.123.4
208.80.123.142
208.100.26.250
208.116.56.2
209.17.116.160
209.42.197.18
209.97.140.241
209.126.123.11
209.141.38.71
212.32.237.90
212.32.237.92
212.32.237.101
212.32.255.4
212.32.255.5
212.32.255.6
212.32.255.12
212.32.255.13
212.32.255.72
212.32.255.137
212.32.255.139
212.32.255.141
212.32.255.148
212.32.255.198
212.32.255.212
212.83.168.39
212.129.44.155
212.129.44.156
212.129.44.157
213.186.33.5
216.155.158.140
216.189.56.129
217.160.0.82

506
coinbl_hosts_optional.ipset Normal file
View File

@ -0,0 +1,506 @@
#
# coinbl_hosts_optional
#
# ipv4 hash:ip ipset
#
# [CoinBlockerLists]
# (https://gitlab.com/ZeroDot1/CoinBlockerLists) Simple lists
# that can help prevent cryptomining in the browser or other
# applications. This list contains additional domains, for
# administrators to prevent mining in networks. The
# maintainer's file contains hostnames, which have been DNS
# resolved to IP addresses.
#
# Maintainer : CoinBlockerLists
# Maintainer URL : https://gitlab.com/ZeroDot1/CoinBlockerLists
# List source URL : https://zerodot1.gitlab.io/CoinBlockerLists/hosts_optional
# Source File Date: Mon Mar 4 10:58:09 UTC 2024
#
# Category : organizations
# Version : 35
#
# This File Date : Mon Mar 4 20:31:55 UTC 2024
# Update Frequency: 1 day
# Aggregation : none
# Entries : 471 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=coinbl_hosts_optional
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
2.16.128.122
2.16.128.202
2.18.66.120
2.18.66.138
2.19.117.68
2.19.117.69
2.19.117.70
2.19.117.72
2.19.117.74
2.19.117.78
2.19.117.81
2.19.117.90
2.19.117.94
2.19.117.96
2.19.117.99
2.19.117.104
2.19.117.106
2.22.156.233
3.20.137.44
3.33.130.190
3.33.152.147
3.35.88.113
3.36.156.26
3.93.123.68
3.94.41.167
3.140.13.188
3.141.96.53
3.209.224.13
3.210.221.105
3.212.210.237
3.218.85.198
3.225.137.152
3.234.186.113
4.194.208.209
13.112.244.197
13.114.246.229
13.115.46.163
13.224.135.12
13.224.222.2
13.224.222.10
13.224.222.42
13.224.222.78
13.224.222.79
13.224.222.84
13.224.222.96
13.224.222.122
13.224.245.2
13.224.245.42
13.224.245.64
13.224.245.70
13.224.245.71
13.224.245.77
13.224.245.84
13.224.245.96
13.229.36.104
13.248.169.48
13.248.213.45
15.197.142.173
15.197.148.33
18.119.154.66
18.164.68.16
18.164.68.23
18.164.68.38
18.164.68.91
18.165.201.11
18.165.201.86
18.165.201.91
18.165.201.123
18.165.227.9
18.165.227.10
18.165.227.13
18.165.227.33
18.165.227.34
18.165.227.38
18.165.227.91
18.165.227.117
18.172.153.36
18.172.153.38
18.172.153.48
18.172.153.83
18.178.24.173
18.178.240.248
18.204.200.228
18.239.236.9
18.239.236.12
18.239.236.18
18.239.236.21
18.239.236.50
18.239.236.54
18.239.236.115
18.239.236.129
18.245.218.59
18.245.218.83
18.245.218.89
18.245.218.102
23.44.64.218
23.227.38.74
34.102.239.211
34.193.227.67
34.203.99.107
34.205.242.146
34.225.59.56
34.236.52.129
34.244.67.113
34.245.84.181
34.252.240.199
35.72.42.247
35.73.106.176
35.76.35.125
35.76.35.223
35.168.141.127
35.172.157.117
35.173.176.69
35.176.92.19
35.176.92.20
35.176.92.21
35.194.162.135
35.234.28.23
35.234.86.61
35.236.135.177
37.48.65.136
43.206.57.92
44.193.54.110
44.205.223.88
44.207.20.63
44.210.169.104
45.162.168.175
47.91.167.174
49.50.108.72
49.50.108.73
52.1.179.177
52.3.130.236
52.18.13.109
52.21.111.192
52.22.200.146
52.23.22.9
52.44.138.87
52.45.205.8
52.48.160.204
52.68.7.163
52.71.57.184
52.71.91.166
52.84.150.36
52.84.150.48
52.84.150.52
52.84.150.65
52.86.6.113
52.92.1.28
52.92.2.148
52.92.16.36
52.92.19.164
52.92.35.44
52.97.146.184
52.97.211.216
52.97.211.248
52.97.219.248
52.98.207.40
52.98.207.168
52.98.207.184
52.98.227.104
52.193.113.187
52.195.45.65
52.196.250.127
52.203.29.35
52.207.181.104
52.213.196.130
52.218.36.68
52.218.96.252
52.218.108.100
52.219.8.167
52.219.16.148
52.219.68.196
52.219.136.4
52.219.150.159
52.219.152.67
52.219.152.115
52.219.200.35
54.64.215.50
54.77.119.238
54.89.42.45
54.89.43.13
54.156.9.35
54.157.239.184
54.161.222.85
54.173.84.248
54.178.166.59
54.209.32.212
54.238.90.11
57.181.12.48
58.228.236.210
58.228.236.211
58.228.236.212
58.228.236.213
58.228.236.214
58.228.236.215
63.33.16.125
64.91.248.15
66.22.39.88
66.23.195.156
66.235.200.146
72.14.191.28
74.220.199.8
76.76.21.9
76.76.21.21
76.76.21.22
76.76.21.61
76.76.21.98
76.76.21.123
76.76.21.142
76.76.21.164
76.76.21.241
76.223.54.146
76.223.67.189
78.46.32.91
79.125.84.18
82.192.82.228
88.198.54.148
91.195.241.232
94.23.50.33
99.84.9.22
99.84.9.36
99.84.9.38
99.84.9.44
99.84.9.51
99.84.9.57
99.84.9.59
99.84.9.71
99.84.9.96
99.84.9.98
99.84.9.110
103.224.212.213
104.16.51.111
104.16.53.111
104.16.145.58
104.16.146.58
104.16.155.13
104.16.156.13
104.16.157.13
104.16.158.13
104.16.159.13
104.16.214.13
104.16.241.118
104.16.242.118
104.16.247.71
104.16.248.71
104.17.70.206
104.17.71.206
104.17.72.206
104.17.73.206
104.17.74.206
104.17.86.98
104.17.97.53
104.18.18.23
104.18.19.23
104.18.32.222
104.18.33.123
104.18.35.15
104.18.36.178
104.18.37.73
104.18.37.145
104.18.38.60
104.18.39.123
104.18.39.184
104.18.40.248
104.18.42.136
104.18.42.203
104.18.82.103
104.18.172.197
104.18.173.197
104.18.174.197
104.18.175.197
104.18.176.197
104.20.0.37
104.20.1.37
104.20.80.175
104.20.81.175
104.21.1.165
104.21.12.149
104.21.13.111
104.21.40.202
104.21.48.5
104.21.49.161
104.21.53.208
104.21.54.180
104.21.58.139
104.21.58.197
104.21.68.9
104.21.74.183
104.21.75.130
104.21.78.247
104.21.85.183
104.21.88.73
104.21.89.253
104.21.91.134
104.21.91.204
104.21.94.110
104.21.96.110
104.22.10.221
104.22.11.221
104.22.28.145
104.22.29.145
104.22.68.176
104.22.69.176
104.22.78.220
104.22.79.220
104.26.2.224
104.26.2.240
104.26.3.224
104.26.3.240
104.26.4.159
104.26.5.159
104.26.6.20
104.26.7.20
104.26.8.106
104.26.9.106
104.26.10.219
104.26.11.219
104.26.12.88
104.26.12.198
104.26.13.88
104.26.13.198
104.26.14.247
104.26.15.247
104.128.239.75
104.199.134.19
104.248.121.107
107.21.169.51
107.180.124.16
108.156.39.12
108.156.39.21
108.156.39.31
108.156.39.44
108.156.39.68
108.156.39.79
108.156.39.86
108.156.39.88
108.156.39.89
108.156.39.116
108.156.39.128
109.109.135.110
110.10.90.180
116.203.46.114
116.203.78.40
121.242.224.82
121.242.224.83
121.242.224.84
121.242.224.85
121.242.224.86
121.242.224.87
121.242.224.88
121.242.224.89
121.242.224.90
121.242.224.91
134.122.6.5
138.113.149.153
143.204.68.8
143.204.68.21
143.204.68.31
143.204.68.47
143.204.68.69
143.204.68.97
143.204.68.99
143.204.68.104
143.204.68.110
143.204.68.115
143.204.68.124
143.204.68.128
143.204.191.51
143.204.191.79
143.204.191.120
143.204.191.127
143.244.42.33
145.14.145.245
162.214.217.188
162.241.194.182
162.241.218.88
163.171.146.42
167.89.115.56
167.89.115.120
167.89.115.150
167.89.123.54
167.89.123.124
167.89.123.204
167.114.97.165
172.64.145.53
172.64.145.120
172.64.147.8
172.64.148.72
172.64.148.133
172.64.149.196
172.64.150.111
172.64.150.183
172.64.151.78
172.64.152.241
172.64.154.133
172.64.155.34
172.66.40.231
172.66.43.25
172.67.14.95
172.67.21.61
172.67.25.63
172.67.33.208
172.67.40.154
172.67.68.82
172.67.69.167
172.67.70.52
172.67.70.65
172.67.72.162
172.67.73.73
172.67.73.151
172.67.75.36
172.67.75.45
172.67.129.162
172.67.138.225
172.67.141.5
172.67.150.125
172.67.155.224
172.67.157.5
172.67.161.56
172.67.164.245
172.67.174.6
172.67.175.39
172.67.177.24
172.67.177.70
172.67.179.87
172.67.184.32
172.67.194.235
172.67.204.125
172.67.207.56
172.67.208.227
172.67.218.212
172.67.220.84
172.67.222.187
172.104.233.20
176.34.2.176
178.62.70.245
178.63.62.94
185.26.156.18
185.85.241.244
185.178.208.185
185.199.108.153
185.199.109.153
185.199.110.153
185.199.111.153
185.225.115.110
190.210.186.207
192.3.11.20
192.64.119.92
192.99.12.221
192.124.249.52
192.185.5.105
192.243.100.192
192.254.232.90
193.70.122.58
193.160.66.104
194.36.191.196
195.39.222.84
195.181.172.27
198.23.50.77
198.37.155.136
198.245.62.172
199.16.172.126
199.48.210.115
199.127.61.148
206.189.144.244
208.87.98.37
216.58.204.83
216.137.44.31
216.137.44.56
216.137.44.58
216.137.44.119

1425
coinbl_ips.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

13909
cruzit_web_attacks.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

1396
cta_cryptowall.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

1480
cybercrime.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

6038
darklist_de.netset Normal file
View File

File diff suppressed because it is too large Load Diff

4257
datacenters.netset Normal file
View File

File diff suppressed because it is too large Load Diff

5490
dm_tor.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

49
dshield.netset Normal file
View File

@ -0,0 +1,49 @@
#
# dshield
#
# ipv4 hash:net ipset
#
# [DShield.org] (https://dshield.org/) top 20 attacking class
# C (/24) subnets over the last three days
#
# Maintainer : DShield.org
# Maintainer URL : https://dshield.org/
# List source URL : http://feeds.dshield.org/block.txt
# Source File Date: Mon Dec 5 16:00:11 UTC 2022
#
# Category : attacks
# Version : 8476
#
# This File Date : Mon Dec 5 16:28:02 UTC 2022
# Update Frequency: 10 mins
# Aggregation : none
# Entries : 19 subnets, 5120 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=dshield
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.206.0/24
45.95.146.0/24
45.142.192.0/24
45.143.200.0/24
62.204.41.0/24
62.233.50.0/24
64.62.197.0/24
78.128.113.0/24
87.246.7.0/24
89.248.163.0/24
89.248.165.0/24
91.191.209.0/24
92.63.196.0/23
94.102.61.0/24
146.88.240.0/24
173.214.175.0/24
185.81.68.0/24
185.156.73.0/24
193.163.125.0/24

51
dshield_1d.netset Normal file
View File

@ -0,0 +1,51 @@
#
# dshield_1d
#
# ipv4 hash:net ipset
#
# [DShield.org] (https://dshield.org/) top 20 attacking class
# C (/24) subnets over the last three days
#
# Maintainer : DShield.org
# Maintainer URL : https://dshield.org/
# List source URL : http://feeds.dshield.org/block.txt
# Source File Date: Mon Dec 5 15:00:12 UTC 2022
#
# Category : attacks
# Version : 7698
#
# This File Date : Mon Dec 5 15:20:02 UTC 2022
# Update Frequency: 10 mins
# Aggregation : 1 day
# Entries : 21 subnets, 5632 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=dshield_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.206.0/24
45.95.146.0/24
45.142.192.0/24
45.143.200.0/24
62.204.41.0/24
62.233.50.0/24
64.62.197.0/24
78.128.113.0/24
80.82.77.0/24
87.246.7.0/24
89.248.163.0/24
89.248.165.0/24
91.191.209.0/24
92.63.196.0/23
94.102.61.0/24
146.88.240.0/24
173.214.175.0/24
185.81.68.0/24
185.156.73.0/24
192.241.212.0/24
193.163.125.0/24

72
dshield_30d.netset Normal file
View File

@ -0,0 +1,72 @@
#
# dshield_30d
#
# ipv4 hash:net ipset
#
# [DShield.org] (https://dshield.org/) top 20 attacking class
# C (/24) subnets over the last three days
#
# Maintainer : DShield.org
# Maintainer URL : https://dshield.org/
# List source URL : http://feeds.dshield.org/block.txt
# Source File Date: Sun Dec 4 13:40:03 UTC 2022
#
# Category : attacks
# Version : 2569
#
# This File Date : Sun Dec 4 14:00:03 UTC 2022
# Update Frequency: 10 mins
# Aggregation : 30 days
# Entries : 42 subnets, 11776 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=dshield_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
2.57.122.0/24
5.8.18.0/24
5.188.206.0/24
45.95.146.0/23
45.142.192.0/24
45.143.200.0/24
45.143.203.0/24
62.204.41.0/24
62.233.50.0/24
64.62.197.0/24
78.128.112.0/23
80.82.77.0/24
87.246.7.0/24
89.190.156.0/24
89.248.163.0/24
89.248.165.0/24
91.191.209.0/24
91.240.118.0/24
92.63.196.0/23
92.118.39.0/24
94.102.61.0/24
104.156.155.0/24
109.205.213.0/24
138.99.216.0/24
141.255.166.0/24
146.88.240.0/24
154.89.5.0/24
173.214.175.0/24
185.81.68.0/24
185.156.73.0/24
185.196.220.0/24
185.224.128.0/24
192.241.197.0/24
192.241.205.0/24
192.241.206.0/23
192.241.212.0/24
193.56.146.0/24
193.163.125.0/24
194.26.29.0/24
198.235.24.0/24
205.210.31.0/24
213.226.123.0/24

59
dshield_7d.netset Normal file
View File

@ -0,0 +1,59 @@
#
# dshield_7d
#
# ipv4 hash:net ipset
#
# [DShield.org] (https://dshield.org/) top 20 attacking class
# C (/24) subnets over the last three days
#
# Maintainer : DShield.org
# Maintainer URL : https://dshield.org/
# List source URL : http://feeds.dshield.org/block.txt
# Source File Date: Mon Dec 5 15:00:12 UTC 2022
#
# Category : attacks
# Version : 4179
#
# This File Date : Mon Dec 5 15:20:02 UTC 2022
# Update Frequency: 10 mins
# Aggregation : 7 days
# Entries : 29 subnets, 7936 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=dshield_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
2.57.122.0/24
5.8.18.0/24
5.188.206.0/24
45.95.146.0/24
45.142.192.0/24
45.143.200.0/24
62.204.41.0/24
62.233.50.0/24
64.62.197.0/24
78.128.112.0/23
80.82.77.0/24
87.246.7.0/24
89.248.163.0/24
89.248.165.0/24
91.191.209.0/24
92.63.196.0/23
92.118.39.0/24
94.102.61.0/24
104.156.155.0/24
146.88.240.0/24
154.89.5.0/24
173.214.175.0/24
185.81.68.0/24
185.156.73.0/24
185.224.128.0/24
192.241.212.0/24
193.163.125.0/24
198.235.24.0/24
205.210.31.0/24

1030
dshield_top_1000.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

74
dyndns_ponmocup.ipset Normal file
View File

@ -0,0 +1,74 @@
#
# dyndns_ponmocup
#
# ipv4 hash:ip ipset
#
# [DynDNS.org]
# (http://security-research.dyndns.org/pub/malware-feeds/)
# Ponmocup. The malware powering the botnet has been around
# since 2006 and it’s known under various names, including
# Ponmocup, Vundo, Virtumonde, Milicenso and Swisyn. It has
# been used for ad fraud, data theft and downloading
# additional threats to infected systems. Ponmocup is one of
# the largest currently active and, with nine consecutive
# years, also one of the longest running, but it is rarely
# noticed as the operators take care to keep it operating
# under the radar.
#
# Maintainer : DynDNS.org
# Maintainer URL : http://security-research.dyndns.org/pub/malware-feeds/
# List source URL : http://security-research.dyndns.org/pub/malware-feeds/ponmocup-infected-domains-shadowserver.csv
# Source File Date: Sun May 19 19:29:29 UTC 2024
#
# Category : malware
# Version : 2072
#
# This File Date : Sun May 19 19:40:25 UTC 2024
# Update Frequency: 1 day
# Aggregation : none
# Entries : 35 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=dyndns_ponmocup
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
3.130.204.160
3.130.253.23
3.140.13.188
31.11.36.8
34.205.242.146
52.86.6.113
54.153.111.129
54.161.222.85
64.70.19.52
66.96.149.32
69.30.245.146
69.61.26.162
72.167.78.221
74.208.236.248
78.47.71.170
79.124.76.10
82.118.24.217
85.13.140.101
94.130.190.96
94.152.142.140
122.201.84.241
144.76.45.43
162.255.166.188
172.67.165.25
173.209.47.104
192.99.161.26
199.67.250.59
200.170.151.200
203.174.34.49
206.188.193.120
213.186.33.18
213.186.33.19
217.76.132.246
217.160.0.225
217.160.0.240

608
esentire_14072015_com.ipset Normal file
View File

@ -0,0 +1,608 @@
#
# esentire_14072015_com
#
# ipv4 hash:ip ipset
#
# Malicious Botnet Serving Various Malware Families
#
# Maintainer : eSentire
# Maintainer URL : https://github.com/eSentire/malfeed
# List source URL : https://raw.githubusercontent.com/eSentire/malfeed/master/14072015.com_watch_ip.lst
# Source File Date: Wed Jun 6 11:52:14 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:50 UTC 2018
# Update Frequency: 1 day
# Aggregation : none
# Entries : 579 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=esentire_14072015_com
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.175.3.90
2.133.85.150
5.1.2.227
5.56.25.29
5.105.50.179
5.105.52.34
5.105.130.241
5.140.106.180
5.143.150.71
5.149.216.46
5.248.99.180
5.248.124.161
5.248.140.201
5.248.141.34
5.248.144.87
5.248.165.65
5.248.194.148
5.248.196.203
5.248.254.4
10.1.120.31
10.1.120.34
23.243.180.132
24.193.190.169
24.214.18.167
31.41.116.88
31.43.4.212
31.43.28.113
31.43.61.73
31.43.82.41
31.43.102.34
31.43.132.156
31.128.74.100
31.128.104.215
31.129.94.180
31.129.95.173
31.129.109.172
31.129.110.6
31.131.101.222
31.131.108.202
31.131.115.55
31.133.66.75
31.133.68.81
31.135.130.27
31.170.130.120
31.170.152.131
31.170.178.179
31.202.176.54
31.207.167.5
36.237.101.56
37.1.58.55
37.25.119.138
37.25.123.252
37.25.126.4
37.54.161.154
37.57.27.184
37.57.37.69
37.57.240.152
37.57.246.121
37.115.15.172
37.115.20.149
37.115.93.155
37.139.165.201
37.143.88.42
37.221.142.213
37.229.13.98
37.229.24.30
46.33.225.80
46.37.197.144
46.46.79.62
46.46.90.65
46.46.96.199
46.63.35.252
46.63.59.44
46.98.1.8
46.98.75.118
46.98.78.188
46.98.97.89
46.98.97.130
46.98.100.46
46.98.113.153
46.98.132.170
46.98.152.107
46.98.203.70
46.98.204.117
46.98.204.188
46.98.213.95
46.98.220.186
46.98.247.222
46.98.254.210
46.118.23.179
46.118.51.117
46.118.54.10
46.118.69.177
46.118.81.195
46.118.84.37
46.118.147.106
46.118.149.108
46.118.158.172
46.118.178.113
46.118.253.204
46.119.0.170
46.119.11.137
46.119.16.18
46.119.17.234
46.119.76.220
46.119.105.213
46.119.173.111
46.119.179.81
46.119.195.170
46.119.209.176
46.146.132.76
46.148.180.102
46.150.8.215
46.150.91.176
46.151.248.27
46.151.253.25
46.160.99.66
46.160.113.116
46.164.188.85
46.172.192.160
46.172.209.208
46.172.212.54
46.173.77.180
46.173.84.239
46.174.240.33
46.174.246.197
46.175.77.227
46.175.137.124
46.185.81.27
46.185.107.224
46.200.44.135
46.201.77.153
46.211.18.203
46.211.27.11
46.211.28.176
46.211.53.116
46.211.74.218
46.211.88.32
46.211.195.139
46.211.217.205
46.211.235.48
46.211.235.195
46.211.238.141
46.250.4.228
46.250.15.111
46.250.17.227
46.250.120.231
54.83.4.26
54.235.166.93
62.16.38.131
62.84.253.186
62.122.93.147
69.84.107.186
70.51.44.188
71.3.191.208
71.61.172.133
71.182.234.109
71.226.78.56
72.53.89.52
73.36.213.39
73.128.180.27
73.172.10.82
74.134.99.228
77.89.226.21
77.91.184.71
77.109.58.50
77.109.58.246
77.120.153.195
77.120.155.24
77.121.59.193
77.121.83.134
77.121.172.23
77.121.186.193
77.121.214.247
77.121.248.109
77.121.248.142
77.122.27.116
77.122.48.50
77.122.50.141
77.122.117.112
77.122.121.122
77.122.150.135
77.122.153.68
77.122.184.9
77.122.184.233
77.122.225.133
77.122.225.173
77.122.232.43
77.123.33.194
77.123.73.204
77.123.222.54
77.247.21.163
77.247.23.79
78.30.226.103
78.111.243.83
78.137.16.80
78.137.21.217
78.137.42.84
78.137.45.30
78.137.45.113
78.162.208.223
78.169.94.241
79.112.62.143
79.113.160.90
79.132.3.138
79.135.222.84
79.142.207.184
79.171.124.211
80.245.117.198
80.252.249.153
80.252.250.121
80.252.253.160
81.9.24.250
81.22.139.55
81.22.141.34
83.99.245.186
83.167.28.121
83.218.228.46
85.114.216.12
85.198.166.158
85.237.34.129
85.238.101.24
86.125.251.15
87.76.36.212
87.76.53.178
87.76.57.222
87.110.28.220
87.244.34.238
88.135.94.164
88.135.238.111
88.135.251.129
88.156.84.155
88.222.173.33
89.65.63.95
89.66.136.116
89.185.15.235
89.185.21.82
89.185.29.54
91.124.201.223
91.196.81.167
91.198.143.44
91.201.71.41
91.202.133.86
91.209.96.67
91.215.55.41
91.218.74.89
91.219.199.248
91.221.29.181
91.224.253.6
91.225.57.30
91.229.54.147
91.237.14.8
91.243.200.132
91.244.8.216
91.244.24.5
91.244.29.60
91.244.36.90
91.244.37.3
92.52.177.95
92.52.186.215
92.112.58.245
92.113.69.127
92.243.113.105
92.244.103.244
92.244.116.165
92.249.119.9
93.76.66.62
93.76.104.167
93.76.104.241
93.76.164.173
93.77.104.109
93.77.204.131
93.77.220.9
93.78.19.128
93.78.67.85
93.78.163.201
93.78.181.144
93.79.34.155
93.79.111.83
93.79.168.251
93.79.241.161
93.114.246.153
93.118.90.170
93.118.202.150
93.127.3.177
93.127.16.170
93.127.119.6
93.170.50.15
93.170.50.91
93.170.51.47
93.170.152.201
93.170.153.170
93.170.155.207
93.181.197.194
93.181.211.186
93.183.243.116
93.185.211.46
94.45.73.242
94.45.92.6
94.45.140.60
94.76.65.93
94.76.121.245
94.76.127.113
94.154.35.51
94.158.43.155
94.178.84.198
94.178.129.75
94.178.230.215
94.181.80.232
94.181.160.141
94.231.70.97
94.231.71.95
94.231.184.85
94.232.76.137
94.232.78.220
94.244.48.229
94.244.141.40
95.47.28.117
95.47.128.209
95.57.228.161
95.67.46.154
95.67.75.154
95.77.219.240
95.81.247.208
95.87.84.203
95.105.11.115
95.105.249.36
95.132.207.171
95.134.158.152
95.135.17.8
95.135.69.19
95.135.213.151
95.164.40.91
95.173.33.100
95.215.118.45
97.75.107.134
98.27.145.224
100.3.73.52
100.6.61.161
104.162.93.136
107.4.129.77
107.15.99.91
108.29.104.102
108.54.179.254
109.72.120.184
109.86.147.39
109.86.206.111
109.86.210.227
109.86.230.210
109.86.234.51
109.87.3.16
109.87.68.203
109.87.120.8
109.87.165.28
109.87.187.170
109.87.205.126
109.87.209.171
109.87.249.48
109.104.177.13
109.104.189.67
109.108.233.47
109.122.19.239
109.162.68.86
109.162.91.114
109.185.112.235
109.200.141.15
109.200.230.5
109.200.240.83
109.200.248.30
109.207.205.3
109.227.67.70
109.227.117.230
109.227.120.202
109.229.19.28
109.229.19.84
109.237.47.9
109.251.77.14
109.251.107.244
109.251.126.134
109.254.33.29
109.254.108.51
113.252.179.249
119.246.242.148
123.110.207.41
134.249.12.41
134.249.17.76
134.249.24.249
134.249.40.43
134.249.42.37
134.249.73.124
134.249.78.208
134.249.149.69
134.249.238.140
141.101.3.36
141.101.19.13
141.138.115.144
151.0.12.101
151.0.57.159
159.224.247.95
173.51.221.110
173.71.98.228
173.224.248.55
176.8.33.121
176.8.51.96
176.8.140.178
176.8.209.58
176.8.253.189
176.36.17.197
176.36.186.138
176.37.147.11
176.37.234.30
176.38.40.16
176.38.95.43
176.38.106.4
176.38.125.64
176.73.13.72
176.73.173.163
176.98.20.110
176.99.112.249
176.99.126.224
176.103.202.65
176.104.10.54
176.104.46.61
176.104.171.139
176.106.31.227
176.107.198.34
176.109.75.175
176.109.238.102
176.109.238.201
176.110.22.247
176.111.36.66
176.111.41.206
176.111.184.13
176.113.149.167
176.113.249.15
176.113.251.172
176.113.255.207
176.114.37.72
176.114.45.237
176.117.64.103
176.118.146.15
176.122.107.41
176.122.107.221
176.124.8.118
176.124.12.180
176.124.13.103
176.124.239.170
176.195.156.193
176.212.209.85
176.241.155.43
178.54.238.73
178.74.194.82
178.74.214.9
178.74.228.191
178.94.49.166
178.94.52.156
178.136.122.47
178.136.130.171
178.136.131.30
178.136.229.208
178.137.11.129
178.137.66.0
178.137.82.42
178.137.140.96
178.137.224.117
178.137.242.146
178.137.243.182
178.137.251.70
178.150.112.132
178.150.114.140
178.150.153.18
178.150.184.9
178.150.195.215
178.150.196.136
178.150.213.134
178.151.11.33
178.151.23.241
178.151.24.112
178.151.34.85
178.151.73.157
178.151.105.24
178.151.116.140
178.151.144.68
178.151.161.143
178.151.175.121
178.151.194.16
178.151.197.61
178.158.131.20
178.158.148.195
178.158.203.91
178.159.113.114
178.164.145.39
178.165.6.62
178.165.44.250
178.165.83.3
178.165.113.39
178.213.169.171
178.213.190.164
178.215.185.23
178.215.191.156
178.216.2.64
178.216.225.249
181.165.34.50
184.144.198.231
185.6.184.146
185.10.3.232
185.28.193.193
185.28.193.195
185.35.102.6
188.0.122.38
188.0.125.41
188.26.120.193
188.43.105.49
188.122.2.225
188.130.192.163
188.190.65.214
188.190.76.247
188.190.90.148
188.190.200.145
188.190.203.178
188.190.213.100
188.190.214.24
188.230.15.191
188.230.31.190
188.230.65.72
188.230.75.141
188.230.84.45
188.231.147.199
188.239.2.247
188.239.91.46
189.219.75.244
190.137.215.190
192.168.114.199
193.93.216.149
193.107.135.125
193.107.227.46
193.108.49.57
193.111.188.230
193.189.127.121
194.8.156.226
194.8.159.12
194.44.2.22
194.44.2.75
194.44.37.3
194.44.113.79
194.44.250.92
194.116.195.132
195.58.254.206
195.64.143.36
195.114.149.110
195.114.157.81
195.135.236.138
195.191.247.98
195.225.228.156
200.116.20.61
212.15.151.42
212.22.192.224
212.28.84.202
212.80.56.118
212.92.246.198
212.115.243.25
212.142.90.46
213.111.137.90
213.111.138.73
213.111.151.140
213.111.161.210
213.111.163.0
213.111.184.48
213.111.203.203
213.111.248.124
213.130.8.151
213.142.49.167
213.231.22.235
213.231.39.31
217.24.64.168
217.30.203.39
217.67.67.229
217.73.85.49
217.73.85.156

604
esentire_14072015q_com.ipset Normal file
View File

@ -0,0 +1,604 @@
#
# esentire_14072015q_com
#
# ipv4 hash:ip ipset
#
# Malicious Botnet Serving Various Malware Families
#
# Maintainer : eSentire
# Maintainer URL : https://github.com/eSentire/malfeed
# List source URL : https://raw.githubusercontent.com/eSentire/malfeed/master/14072015q.com_watch_ip.lst
# Source File Date: Wed Jun 6 11:52:14 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:50 UTC 2018
# Update Frequency: 1 day
# Aggregation : none
# Entries : 575 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=esentire_14072015q_com
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.175.3.90
2.133.85.150
5.1.2.227
5.56.25.29
5.105.50.179
5.105.52.34
5.105.130.241
5.140.106.180
5.143.150.71
5.149.216.46
5.248.99.180
5.248.124.161
5.248.140.201
5.248.141.34
5.248.144.87
5.248.194.148
5.248.196.203
5.248.254.4
10.1.120.31
10.1.120.34
23.243.180.132
24.193.190.169
24.214.18.167
31.41.116.88
31.43.4.212
31.43.28.113
31.43.61.73
31.43.82.41
31.43.102.34
31.43.132.156
31.128.74.100
31.128.104.215
31.129.94.180
31.129.95.173
31.129.109.172
31.129.110.6
31.131.101.222
31.131.108.202
31.131.115.55
31.133.66.75
31.133.68.81
31.135.130.27
31.170.130.120
31.170.152.131
31.170.178.179
31.202.176.54
31.207.167.5
36.237.101.56
37.1.58.55
37.25.119.138
37.25.123.252
37.25.126.4
37.54.161.154
37.57.27.184
37.57.37.69
37.57.240.152
37.57.246.121
37.115.15.172
37.115.20.149
37.115.93.155
37.139.165.201
37.143.88.42
37.221.142.213
37.229.13.98
37.229.24.30
46.33.225.80
46.37.197.144
46.46.79.62
46.46.90.65
46.46.96.199
46.63.35.252
46.63.59.44
46.98.1.8
46.98.75.118
46.98.78.188
46.98.97.89
46.98.97.130
46.98.100.46
46.98.113.153
46.98.132.170
46.98.152.107
46.98.203.70
46.98.204.188
46.98.213.95
46.98.220.186
46.98.247.222
46.98.254.210
46.118.23.179
46.118.51.117
46.118.54.10
46.118.69.177
46.118.81.195
46.118.84.37
46.118.147.106
46.118.149.108
46.118.158.172
46.118.178.113
46.118.253.204
46.119.0.170
46.119.11.137
46.119.16.18
46.119.17.234
46.119.76.220
46.119.105.213
46.119.173.111
46.119.179.81
46.119.195.170
46.119.209.176
46.146.132.76
46.148.180.102
46.150.8.215
46.150.91.176
46.151.248.27
46.151.253.25
46.160.99.66
46.160.113.116
46.164.188.85
46.172.192.160
46.172.209.208
46.172.212.54
46.173.77.180
46.173.84.239
46.174.240.33
46.174.246.197
46.175.77.227
46.175.137.124
46.185.81.27
46.185.107.224
46.200.44.135
46.201.77.153
46.211.18.203
46.211.27.11
46.211.28.176
46.211.53.116
46.211.74.218
46.211.88.32
46.211.195.139
46.211.217.205
46.211.235.48
46.211.238.141
46.250.4.228
46.250.15.111
46.250.17.227
46.250.120.231
54.83.4.26
54.235.166.93
62.16.38.131
62.84.253.186
62.122.93.147
69.84.107.186
70.51.44.188
71.3.191.208
71.61.172.133
71.182.234.109
71.226.78.56
72.53.89.52
73.36.213.39
73.128.180.27
73.172.10.82
74.134.99.228
77.89.226.21
77.91.184.71
77.109.58.50
77.109.58.246
77.120.153.195
77.120.155.24
77.121.59.193
77.121.83.134
77.121.172.23
77.121.186.193
77.121.214.247
77.121.248.109
77.121.248.142
77.122.27.116
77.122.48.50
77.122.50.141
77.122.117.112
77.122.121.122
77.122.150.135
77.122.153.68
77.122.184.9
77.122.184.233
77.122.225.133
77.122.225.173
77.122.232.43
77.123.33.194
77.123.73.204
77.123.222.54
77.247.21.163
77.247.23.79
78.30.226.103
78.111.243.83
78.137.16.80
78.137.21.217
78.137.42.84
78.137.45.30
78.137.45.113
78.162.208.223
78.169.94.241
79.112.62.143
79.113.160.90
79.132.3.138
79.135.222.84
79.142.207.184
79.171.124.211
80.245.117.198
80.252.249.153
80.252.250.121
80.252.253.160
81.9.24.250
81.22.139.55
81.22.141.34
83.99.245.186
83.167.28.121
83.218.228.46
85.114.216.12
85.198.166.158
85.237.34.129
85.238.101.24
86.125.251.15
87.76.36.212
87.76.53.178
87.76.57.222
87.110.28.220
87.244.34.238
88.135.94.164
88.135.238.111
88.135.251.129
88.156.84.155
88.222.173.33
89.65.63.95
89.66.136.116
89.185.15.235
89.185.21.82
89.185.29.54
91.124.201.223
91.196.81.167
91.198.143.44
91.201.71.41
91.202.133.86
91.209.96.67
91.215.55.41
91.218.74.89
91.219.199.248
91.221.29.181
91.224.253.6
91.225.57.30
91.229.54.147
91.237.14.8
91.243.200.132
91.244.8.216
91.244.24.5
91.244.29.60
91.244.36.90
91.244.37.3
92.52.177.95
92.52.186.215
92.112.58.245
92.113.69.127
92.243.113.105
92.244.103.244
92.244.116.165
92.249.119.9
93.76.66.62
93.76.104.167
93.76.104.241
93.76.164.173
93.77.104.109
93.77.204.131
93.77.220.9
93.78.19.128
93.78.67.85
93.78.163.201
93.78.181.144
93.79.34.155
93.79.111.83
93.79.168.251
93.79.241.161
93.114.246.153
93.118.90.170
93.118.202.150
93.127.3.177
93.127.16.170
93.127.119.6
93.170.50.15
93.170.50.91
93.170.51.47
93.170.152.201
93.170.153.170
93.170.155.207
93.181.197.194
93.181.211.186
93.183.243.116
93.185.211.46
94.45.73.242
94.45.140.60
94.76.65.93
94.76.121.245
94.76.127.113
94.154.35.51
94.158.43.155
94.178.84.198
94.178.129.75
94.178.230.215
94.181.80.232
94.181.160.141
94.231.70.97
94.231.71.95
94.231.184.85
94.232.76.137
94.232.78.220
94.244.48.229
94.244.141.40
95.47.28.117
95.47.128.209
95.57.228.161
95.67.46.154
95.67.75.154
95.77.219.240
95.81.247.208
95.87.84.203
95.105.11.115
95.105.249.36
95.132.207.171
95.134.158.152
95.135.17.8
95.135.69.19
95.135.213.151
95.164.40.91
95.173.33.100
95.215.118.45
97.75.107.134
98.27.145.224
100.3.73.52
100.6.61.161
104.162.93.136
107.4.129.77
107.15.99.91
108.29.104.102
108.54.179.254
109.72.120.184
109.86.147.39
109.86.206.111
109.86.210.227
109.86.230.210
109.86.234.51
109.87.3.16
109.87.68.203
109.87.120.8
109.87.165.28
109.87.187.170
109.87.205.126
109.87.209.171
109.87.249.48
109.104.177.13
109.104.189.67
109.108.233.47
109.122.19.239
109.162.68.86
109.162.91.114
109.185.112.235
109.200.141.15
109.200.230.5
109.200.240.83
109.200.248.30
109.207.205.3
109.227.67.70
109.227.117.230
109.227.120.202
109.229.19.28
109.229.19.84
109.237.47.9
109.251.77.14
109.251.107.244
109.251.126.134
109.254.33.29
109.254.108.51
113.252.179.249
119.246.242.148
123.110.207.41
134.249.12.41
134.249.17.76
134.249.24.249
134.249.40.43
134.249.42.37
134.249.73.124
134.249.78.208
134.249.149.69
134.249.238.140
141.101.3.36
141.101.19.13
141.138.115.144
151.0.12.101
151.0.57.159
159.224.247.95
173.51.221.110
173.71.98.228
173.224.248.55
176.8.33.121
176.8.51.96
176.8.140.178
176.8.209.58
176.8.253.189
176.36.17.197
176.36.186.138
176.37.147.11
176.37.234.30
176.38.40.16
176.38.95.43
176.38.106.4
176.38.125.64
176.73.13.72
176.73.173.163
176.98.20.110
176.99.112.249
176.99.126.224
176.103.202.65
176.104.10.54
176.104.46.61
176.104.171.139
176.106.31.227
176.107.198.34
176.109.75.175
176.109.238.102
176.109.238.201
176.110.22.247
176.111.36.66
176.111.41.206
176.111.184.13
176.113.149.167
176.113.249.15
176.113.251.172
176.113.255.207
176.114.37.72
176.114.45.237
176.117.64.103
176.118.146.15
176.122.107.41
176.122.107.221
176.124.8.118
176.124.12.180
176.124.13.103
176.124.239.170
176.195.156.193
176.212.209.85
176.241.155.43
178.54.238.73
178.74.194.82
178.74.214.9
178.74.228.191
178.94.49.166
178.94.52.156
178.136.122.47
178.136.130.171
178.136.131.30
178.136.229.208
178.137.11.129
178.137.66.0
178.137.82.42
178.137.140.96
178.137.224.117
178.137.242.146
178.137.243.182
178.137.251.70
178.150.112.132
178.150.114.140
178.150.153.18
178.150.184.9
178.150.195.215
178.150.196.136
178.150.213.134
178.151.11.33
178.151.23.241
178.151.24.112
178.151.34.85
178.151.73.157
178.151.105.24
178.151.116.140
178.151.144.68
178.151.161.143
178.151.175.121
178.151.194.16
178.151.197.61
178.158.131.20
178.158.148.195
178.158.203.91
178.159.113.114
178.164.145.39
178.165.6.62
178.165.44.250
178.165.83.3
178.165.113.39
178.213.169.171
178.213.190.164
178.215.185.23
178.215.191.156
178.216.2.64
178.216.225.249
181.165.34.50
184.144.198.231
185.6.184.146
185.10.3.232
185.28.193.193
185.28.193.195
185.35.102.6
188.0.122.38
188.0.125.41
188.26.120.193
188.43.105.49
188.122.2.225
188.130.192.163
188.190.65.214
188.190.76.247
188.190.90.148
188.190.200.145
188.190.203.178
188.190.213.100
188.190.214.24
188.230.15.191
188.230.31.190
188.230.65.72
188.230.75.141
188.230.84.45
188.231.147.199
188.239.2.247
188.239.91.46
189.219.75.244
190.137.215.190
192.168.114.199
193.93.216.149
193.107.135.125
193.107.227.46
193.108.49.57
193.111.188.230
193.189.127.121
194.8.156.226
194.8.159.12
194.44.2.22
194.44.2.75
194.44.37.3
194.44.113.79
194.44.250.92
194.116.195.132
195.58.254.206
195.64.143.36
195.114.149.110
195.114.157.81
195.135.236.138
195.191.247.98
195.225.228.156
200.116.20.61
212.15.151.42
212.22.192.224
212.28.84.202
212.80.56.118
212.92.246.198
212.115.243.25
212.142.90.46
213.111.137.90
213.111.138.73
213.111.151.140
213.111.161.210
213.111.163.0
213.111.184.48
213.111.203.203
213.111.248.124
213.130.8.151
213.142.49.167
213.231.22.235
213.231.39.31
217.24.64.168
217.30.203.39
217.67.67.229
217.73.85.49
217.73.85.156

1319
esentire_22072014a_com.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

1317
esentire_22072014b_com.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

1318
esentire_22072014c_com.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

36
esentire_atomictrivia_ru.ipset Normal file
View File

@ -0,0 +1,36 @@
#
# esentire_atomictrivia_ru
#
# ipv4 hash:ip ipset
#
# Andromeda/Gamarue Checkin
#
# Maintainer : eSentire
# Maintainer URL : https://github.com/eSentire/malfeed
# List source URL : https://raw.githubusercontent.com/eSentire/malfeed/master/atomictrivia.ru_watch_ip.lst
# Source File Date: Wed Jun 6 11:52:13 UTC 2018
#
# Category : malware
# Version : 11
#
# This File Date : Thu Jun 7 00:08:51 UTC 2018
# Update Frequency: 1 day
# Aggregation : none
# Entries : 7 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=esentire_atomictrivia_ru
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
46.4.114.61
54.83.4.26
54.235.166.93
95.213.192.71
176.9.48.86
176.9.82.215
178.63.12.207

1335
esentire_auth_update_ru.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

2580
esentire_burmundisoul_ru.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

18642
esentire_crazyerror_su.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

546
esentire_dagestanskiiviskis_ru.ipset Normal file
View File

@ -0,0 +1,546 @@
#
# esentire_dagestanskiiviskis_ru
#
# ipv4 hash:ip ipset
#
# Ursnif Variant CnC
#
# Maintainer : eSentire
# Maintainer URL : https://github.com/eSentire/malfeed
# List source URL : https://raw.githubusercontent.com/eSentire/malfeed/master/dagestanskiiviskis.ru_watch_ip.lst
# Source File Date: Wed Jun 6 11:52:15 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:51 UTC 2018
# Update Frequency: 1 day
# Aggregation : none
# Entries : 517 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=esentire_dagestanskiiviskis_ru
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
2.62.23.234
5.2.216.120
5.12.168.83
5.14.69.38
5.14.172.95
5.79.191.198
5.105.98.241
5.105.130.241
5.136.100.50
5.143.140.236
5.143.166.83
5.153.129.193
5.164.66.183
5.164.207.221
5.165.232.191
5.167.9.135
5.189.221.99
5.199.233.176
5.228.106.212
5.248.51.11
5.248.58.154
5.248.106.201
5.248.124.161
5.248.126.218
5.248.175.139
5.248.186.248
5.248.198.111
5.248.235.69
5.248.242.211
5.255.161.252
14.42.158.45
24.70.124.49
24.96.222.4
24.136.95.254
31.6.123.150
31.6.125.172
31.8.144.14
31.8.161.217
31.8.175.111
31.23.21.219
31.41.116.88
31.42.125.15
31.43.75.153
31.44.11.217
31.47.122.245
31.47.167.142
31.128.44.20
31.128.74.100
31.128.104.215
31.129.95.173
31.131.101.222
31.131.137.63
31.133.77.119
31.134.21.170
31.134.69.230
31.135.38.197
31.135.48.147
31.135.114.203
31.135.133.237
31.135.136.176
31.162.8.8
31.170.130.120
31.170.152.131
31.202.223.141
31.207.178.78
31.207.228.197
31.207.229.67
37.1.128.96
37.19.78.212
37.21.23.21
37.25.109.92
37.25.114.125
37.25.116.19
37.25.117.182
37.46.249.235
37.54.230.239
37.57.28.153
37.57.37.69
37.57.240.187
37.113.204.90
37.115.24.106
37.115.90.157
37.115.134.56
37.115.171.164
37.115.231.247
37.194.118.106
37.221.142.213
37.229.43.110
37.229.247.52
37.229.249.54
37.235.161.13
46.0.18.88
46.0.105.75
46.33.240.159
46.33.251.145
46.35.240.81
46.37.197.134
46.43.224.57
46.48.147.97
46.50.179.195
46.63.1.192
46.63.6.16
46.98.18.231
46.98.37.161
46.98.73.53
46.98.86.240
46.98.105.164
46.98.117.134
46.98.202.20
46.98.202.163
46.98.219.38
46.118.29.25
46.118.84.22
46.118.130.60
46.118.155.53
46.118.239.72
46.118.252.166
46.119.35.231
46.119.89.198
46.119.94.122
46.119.155.141
46.119.173.111
46.146.3.235
46.147.179.93
46.148.182.219
46.148.183.5
46.150.91.176
46.162.36.98
46.164.164.200
46.164.170.15
46.164.189.238
46.172.207.21
46.172.232.202
46.172.238.213
46.172.252.79
46.173.74.179
46.175.77.186
46.175.98.254
46.181.215.20
46.185.9.53
46.185.18.158
46.185.51.76
46.185.73.44
46.185.94.136
46.185.119.82
46.211.60.80
46.237.30.185
50.83.33.15
50.161.246.210
61.244.34.238
62.80.161.74
62.84.253.186
62.84.255.35
62.244.60.154
67.161.171.204
73.143.88.158
73.182.13.78
73.209.189.206
74.139.176.131
77.52.183.30
77.75.135.92
77.78.210.179
77.91.184.71
77.93.62.84
77.120.25.214
77.120.159.89
77.120.170.83
77.121.47.43
77.121.58.49
77.121.114.54
77.121.161.66
77.122.125.49
77.122.152.5
77.122.154.230
77.122.189.45
77.122.226.163
77.122.235.183
77.232.214.172
77.239.190.247
78.27.183.113
78.29.101.224
78.96.153.47
78.97.195.40
79.114.76.25
79.116.111.187
79.117.27.88
79.119.76.40
79.119.81.24
79.119.192.205
79.142.200.140
79.171.124.211
80.240.40.174
80.243.155.25
80.252.252.7
80.252.252.171
80.252.255.128
81.9.24.250
81.22.135.82
81.163.46.209
81.163.54.83
81.163.93.101
82.76.65.108
82.77.43.35
82.79.21.91
82.209.117.176
83.234.253.227
84.53.214.22
84.117.156.67
84.232.210.248
85.237.35.122
86.100.133.94
86.121.248.49
86.124.111.205
86.125.184.115
86.125.231.223
88.85.206.166
88.135.121.221
88.203.3.130
88.233.78.205
89.32.218.56
89.42.87.41
89.121.205.190
89.185.10.36
89.252.7.39
89.252.8.138
89.252.41.9
91.104.21.62
91.190.235.194
91.198.143.44
91.204.250.227
91.211.175.7
91.218.89.197
91.219.251.28
91.221.179.42
91.225.161.106
91.225.161.207
91.237.14.19
91.241.227.106
91.243.218.240
91.244.12.138
91.246.7.211
92.52.165.90
92.52.181.125
92.52.188.52
92.113.29.192
92.113.143.87
92.248.135.141
92.248.136.100
92.248.216.12
92.248.242.249
92.249.212.75
93.76.72.58
93.76.104.226
93.76.164.173
93.76.181.42
93.76.205.64
93.77.115.10
93.77.204.131
93.77.221.41
93.78.54.197
93.78.96.225
93.78.217.148
93.79.24.199
93.79.65.222
93.79.168.251
93.79.199.156
93.79.200.105
93.88.57.78
93.113.90.28
93.113.176.105
93.118.209.118
93.119.139.39
93.119.155.220
93.124.44.131
93.127.89.112
93.170.153.170
93.171.21.27
93.171.253.155
93.183.246.105
94.28.137.173
94.45.92.6
94.45.140.60
94.76.65.93
94.76.127.113
94.125.51.117
94.179.47.27
94.181.97.145
94.240.165.141
94.243.14.31
94.244.141.40
94.253.13.174
95.67.46.154
95.67.75.154
95.79.217.131
95.105.249.36
95.106.203.206
95.106.214.42
95.110.24.171
95.139.66.62
95.139.212.72
95.139.253.60
95.190.15.238
95.190.16.138
95.215.209.73
96.50.181.81
98.116.11.226
100.6.61.161
104.162.93.136
107.15.99.91
108.7.231.42
108.183.203.14
109.63.193.84
109.86.76.58
109.86.143.188
109.86.230.210
109.86.234.51
109.87.131.54
109.87.148.237
109.87.165.28
109.87.204.143
109.87.249.48
109.104.189.67
109.105.78.238
109.120.5.115
109.161.41.46
109.162.118.190
109.184.213.234
109.196.71.193
109.200.230.148
109.200.232.184
109.201.76.89
109.201.198.206
109.227.200.151
109.236.217.151
109.251.77.14
109.251.148.252
109.254.58.99
109.254.108.51
109.254.116.68
113.252.180.74
119.247.219.135
123.202.249.155
130.204.240.145
134.249.30.72
134.249.31.13
134.249.81.148
136.169.169.63
136.169.169.197
145.249.167.167
146.120.25.65
151.0.61.118
151.249.101.99
159.224.62.162
159.224.101.52
159.224.140.219
159.224.253.208
176.36.23.31
176.36.68.13
176.36.174.59
176.36.202.68
176.37.109.5
176.37.122.224
176.37.172.33
176.49.142.86
176.77.24.129
176.77.111.200
176.98.2.232
176.99.106.204
176.99.176.112
176.101.193.179
176.101.207.64
176.102.211.159
176.103.205.207
176.104.41.120
176.104.102.59
176.104.185.139
176.105.131.208
176.106.31.227
176.113.246.139
176.113.251.1
176.114.44.50
176.116.221.106
176.116.221.246
176.116.222.84
176.117.72.184
176.118.113.253
176.124.13.36
176.195.253.219
176.210.68.73
176.212.97.227
176.212.185.229
176.213.67.155
176.213.75.210
176.213.239.205
176.213.253.173
176.226.147.109
178.34.19.159
178.35.161.136
178.45.197.114
178.46.96.169
178.54.167.147
178.54.182.27
178.74.203.125
178.93.163.70
178.136.222.214
178.136.241.135
178.137.11.129
178.137.61.90
178.137.80.252
178.137.82.42
178.137.115.109
178.137.156.59
178.137.158.86
178.137.186.180
178.137.213.13
178.137.224.117
178.150.172.207
178.150.213.134
178.151.11.33
178.151.73.157
178.151.114.33
178.151.139.25
178.151.144.68
178.151.241.177
178.158.148.195
178.158.201.252
178.158.228.24
178.159.113.246
178.165.36.80
178.165.98.17
178.165.106.161
178.165.107.138
178.206.127.150
178.207.168.102
178.211.185.203
178.217.163.77
178.219.253.37
178.234.243.161
178.234.247.85
181.45.0.138
185.17.17.111
185.22.17.85
185.27.103.79
185.86.3.171
187.240.23.29
188.0.122.38
188.0.125.41
188.18.80.50
188.24.15.92
188.24.182.130
188.25.68.106
188.25.185.202
188.27.58.58
188.27.224.223
188.27.236.220
188.75.198.19
188.75.240.44
188.75.243.36
188.123.45.117
188.168.146.203
188.190.66.19
188.190.67.242
188.190.195.238
188.191.235.161
188.191.238.171
188.191.239.79
188.209.109.154
188.212.158.206
188.230.84.45
188.231.147.199
188.231.244.193
188.234.116.93
188.234.119.59
188.239.6.96
188.239.21.192
188.240.0.34
188.241.106.118
188.241.131.14
188.242.4.131
188.255.93.37
190.19.48.93
190.190.179.2
192.162.232.198
192.166.113.83
193.111.188.230
193.242.156.56
193.254.233.26
195.18.43.216
195.160.220.110
197.7.101.165
197.9.198.102
204.195.156.186
212.2.142.108
212.3.107.202
212.21.7.79
212.22.192.224
212.34.126.162
212.91.214.42
212.92.225.115
212.92.240.222
212.92.254.38
212.115.239.200
212.115.250.13
213.111.140.203
213.111.155.155
213.111.167.62
213.111.168.163
213.111.232.28
213.111.251.240
213.154.205.150
213.231.10.126
213.231.15.11
213.231.28.245
213.231.61.231
217.73.81.60
217.73.85.49
217.73.93.154

41
esentire_differentia_ru.ipset Normal file
View File

@ -0,0 +1,41 @@
#
# esentire_differentia_ru
#
# ipv4 hash:ip ipset
#
# Malicious Botnet Serving Various Malware Families
#
# Maintainer : eSentire
# Maintainer URL : https://github.com/eSentire/malfeed
# List source URL : https://raw.githubusercontent.com/eSentire/malfeed/master/differentia.ru_watch_ip.lst
# Source File Date: Wed Jun 6 11:52:10 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:49 UTC 2018
# Update Frequency: 1 day
# Aggregation : none
# Entries : 12 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=esentire_differentia_ru
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
46.4.114.61
54.83.4.26
54.235.166.93
95.213.186.51
95.213.192.71
109.70.26.37
109.206.186.164
176.9.48.86
176.9.82.215
176.9.174.220
178.63.12.207
194.85.61.76

36
esentire_disorderstatus_ru.ipset Normal file
View File

@ -0,0 +1,36 @@
#
# esentire_disorderstatus_ru
#
# ipv4 hash:ip ipset
#
# Malicious Botnet Serving Various Malware Families
#
# Maintainer : eSentire
# Maintainer URL : https://github.com/eSentire/malfeed
# List source URL : https://raw.githubusercontent.com/eSentire/malfeed/master/disorderstatus.ru_watch_ip.lst
# Source File Date: Wed Jun 6 11:52:13 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:50 UTC 2018
# Update Frequency: 1 day
# Aggregation : none
# Entries : 7 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=esentire_disorderstatus_ru
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
46.4.114.61
54.83.4.26
54.235.166.93
95.213.192.71
109.206.186.164
176.9.48.86
176.9.82.215

Some files were not shown because too many files have changed in this diff Show More