Robot
/
blocklist-ipsets
mirror of https://github.com/firehol/blocklist-ipsets.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fri Aug 14 10:28:50 UTC 2020 update

This commit is contained in:
Costa Tsaousis 2020-08-09 06:30:14 +01:00
commit 195b80d36b
1465 changed files with 7897958 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

106
.gitignore vendored Normal file
View File

@ -0,0 +1,106 @@
bogons.netset
.cache
.cache.old
dragon_http.netset
dragon_*.ipset
dragon_*.netset
dragon_sshpauth.netset
dragon_vncprobe.netset
dronebl_anonymizers.netset
dronebl_auto_botnets.netset
dronebl_autorooting_worms.netset
dronebl_compromised.netset
dronebl_ddos_drones.netset
dronebl_dns_mx_on_irc.netset
dronebl_*.ipset
dronebl_irc_drones.netset
dronebl_*.netset
dronebl_unknown.netset
dronebl_worms_bots.netset
errors/
fullbogons.netset
history/
ib_*.ipset
iblocklist_ads.netset
iblocklist_ads.*set
iblocklist_badpeers.ipset
iblocklist_badpeers.*set
iblocklist_bogons.netset
iblocklist_bogons.*set
iblocklist_dshield.netset
iblocklist_dshield.*set
iblocklist_edu.netset
iblocklist_edu.*set
iblocklist_exclusions.netset
iblocklist_exclusions.*set
iblocklist_fornonlancomputers.netset
iblocklist_fornonlancomputers.*set
iblocklist_forumspam.netset
iblocklist_forumspam.*set
iblocklist_hijacked.netset
iblocklist_hijacked.*set
iblocklist_iana_multicast.netset
iblocklist_iana_multicast.*set
iblocklist_iana_private.netset
iblocklist_iana_private.*set
iblocklist_iana_reserved.netset
iblocklist_iana_reserved.*set
iblocklist_level1.netset
iblocklist_level1.*set
iblocklist_level2.netset
iblocklist_level2.*set
iblocklist_level3.netset
iblocklist_level3.*set
iblocklist_org_microsoft.netset
iblocklist_org_microsoft.*set
iblocklist_proxies.ipset
iblocklist_proxies.*set
iblocklist_rangetest.netset
iblocklist_rangetest.*set
iblocklist_spider.netset
iblocklist_spider.*set
iblocklist_spyware.netset
iblocklist_spyware.*set
iblocklist_webexploit.ipset
iblocklist_webexploit.*set
ib_*.netset
iprange*
ipv4_range_to_cidr.awk
*.lastchecked
*.setinfo
sorbs_anonymizers.netset
sorbs_dul.netset
sorbs_escalations.netset
sorbs_*.ipset
sorbs_*.netset
sorbs_new_spam.netset
sorbs_noserver.netset
sorbs_recent_spam.netset
sorbs_smtp.netset
sorbs_web.netset
sorbs_zombie.netset
*.source
*.tmp
update-ipsets*
.warn_if_last_downloaded_before_this
blueliv*.ipset
blueliv*.netset
blueliv_crimeserver_online.ipset
blueliv_crimeserver_recent.ipset
blueliv_crimeserver_last.ipset
blueliv_crimeserver_last_1d.ipset
blueliv_crimeserver_last_2d.ipset
blueliv_crimeserver_last_7d.ipset
blueliv_crimeserver_last_30d.ipset
iblocklist_badpeers.netset
dataplane_sipquery.ipset
dataplane_sshpwauth.ipset
dataplane_sshclient.ipset
dataplane_sipregistration.ipset
dataplane_sipinvitation.ipset
dataplane_vncrfb.ipset
dataplane_dnsrd.ipset
dataplane_dnsrdany.ipset
dataplane_dnsversion.ipset
shunlist.ipset
ip2proxy_px1lite.netset

228
README-EDIT.md Normal file
View File

@ -0,0 +1,228 @@
> Due to the amount of data and the frequency of the updates on this repo,
> github has requested to limit the number of updates.
> The site [https://iplists.firehol.org](https://iplists.firehol.org) has direct links
> to all the files in this repo. **This repo is now updated once per day.**
---
### Contents
- [About this repo](#about-this-repo)
- [Using these ipsets](#using-these-ipsets)
- [Which ones to use?](#which-ones-to-use)
- [Why are open proxy lists included](#why-are-open-proxy-lists-included)
- [Using them in FireHOL](#using-them-in-firehol)
* [Adding the ipsets in your firehol.conf](#adding-the-ipsets-in-your-fireholconf)
* [Updating the ipsets while the firewall is running](#updating-the-ipsets-while-the-firewall-is-running)
- [Dynamic List of ipsets included](#list-of-ipsets-included)
- [Comparison of ipsets](#comparison-of-ipsets)
---
# About this repo
This repository includes a list of ipsets dynamically updated with
[FireHOL](https://github.com/firehol/firehol)'s `update-ipsets.sh`
[documented in this wiki](https://github.com/firehol/blocklist-ipsets/wiki).
This repo is self maintained. It it updated automatically from the script via a cron job.
This repo has a site: [http://iplists.firehol.org](http://iplists.firehol.org).
## Why do we need blocklists?
As time passes and the internet matures in our life, cybercrime is becoming increasingly sophisticated.
Although there are many tools (detection of malware, viruses, intrusion detection and prevention systems,
etc) to help us isolate the bad guys, there are now a lot more than just such attacks.
What is more interesting is that the fraudsters or attackers in many cases are not going to do a direct
damage to you or your systems. They will use you and your systems to gain something else, possibly not
related or indirectly related to your business. Nowadays the attacks cannot be identified easily. They are
distributed and come to our systems from a vast amount of IPs around the world.
To get an idea, check for example the [XRumer](http://en.wikipedia.org/wiki/XRumer) software. This thing
mimics human behavior to post ads, it creates email accounts, responds to emails it receives, bypasses
captchas, it goes gently to stay unnoticed, etc.
To increase our effectiveness we need to complement our security solutions with our shared knowledge, our
shared experience in this fight.
Hopefully, there are many teams out there that do their best to identify the attacks and pinpoint the
attackers. These teams release blocklists. Blocklists of IPs (for use in firewalls), domains & URLs
(for use in proxies), etc.
What we are interested here is IPs.
Using IP blocklists at the internet side of your firewall is a key component of internet security. These
lists share key knowledge between us, allowing us to learn from each other and effectively isolate
fraudsters and attackers from our services.
I decided to upload these lists to a github repo because:
1. They are freely available on the internet. The intention of their creators is to help internet security.
Keep in mind though that a few of these lists may have special licences attached. Before using them, please check their source site for any information regarding proper use.
2. Github provides (via `git pull`) a unified way of updating all the lists together.
Pulling this repo regularly on your machines, you will update all the IP lists at once.
3. Github also provides a unified version control. Using it we can have a history of what each list has
done, which IPs or subnets were added and which were removed.
## DNSBLs
Check also another tool included in FireHOL v3+, called `dnsbl-ipset.sh`.
This tool is capable of creating an ipset based on your traffic by looking up information on DNSBLs and
scoring it according to your preferences.
More information [here](https://github.com/firehol/firehol/wiki/dnsbl-ipset.sh).
---
# Using these ipsets
Please be very careful what you choose to use and how you use it. If you blacklist traffic using these
lists you may end up blocking your users, your customers, even yourself (!) from accessing your services.
1. Go to to the site of each list and read how each list is maintained. You are going to trust these guys for doing their job right.
2. Most sites have either a donation system or commercial lists of higher quality. Try to support them.
3. I have included the TOR network in these lists (`bm_tor`, `dm_tor`, `et_tor`). The TOR network is not necessarily bad and you should not block it if you want to allow your users be anonymous. I have included it because for certain cases, allowing an anonymity network might be a risky thing (such as eCommerce).
4. Apply any blacklist at the internet side of your firewall. Be very careful. The `bogons` and `fullbogons` lists contain private, unrouteable IPs that should not be routed on the internet. If you apply such a blocklist on your DMZ or LAN side, you will be blocked out of your firewall.
5. Always have a whitelist too, containing the IP addresses or subnets you trust. Try to build the rules in such a way that if an IP is in the whitelist, it should not be blocked by these blocklists.
## Which ones to use
### Level 1 - Basic
These are the ones I trust. **Level 1** provides basic security against the most well-known attackers, with the minimum of false positives.
1. **Abuse.ch** lists `feodo`, `palevo`, `sslbl`, `zeus`, `zeus_badips`
These folks are doing a great job tracking crime ware. Their blocklists are very focused.
Keep in mind `zeus` may include some false positives. You can use `zeus_badips` instead.
2. **DShield.org** list `dshield`
It contains the top 20 attacking class C (/24) subnets, over the last three days.
3. **Spamhaus.org** lists `spamhaus_drop`, `spamhaus_edrop`
DROP (Don't Route Or Peer) and EDROP are advisory "drop all traffic" lists, consisting of netblocks that are "hijacked" or leased by professional spam or cyber-crime operations (used for dissemination of malware, trojan downloaders, botnet controllers).
According to Spamhaus.org:
> When implemented at a network or ISP's 'core routers', DROP and EDROP will help protect the network's users from spamming, scanning, harvesting, DNS-hijacking and DDoS attacks originating on rogue netblocks.
>
> Spamhaus strongly encourages the use of DROP and EDROP by tier-1s and backbones.
Spamhaus is very responsive to adapt these lists when a network owner updates them that the issue has been solved (I had one such incident with one of my users).
4. **Team-Cymru.org** list `bogons` or `fullbogons`
These are lists of IPs that should not be routed on the internet. No one should be using them.
Be very careful to apply either of the two on the internet side of your network.
### Level 2 - Essentials
**Level 2** provide protection against current brute force attacks. This level may have a small percentage of false positives, mainly due to dynamic IPs being re-used by other users.
1. **OpenBL.org** lists `openbl*`
The team of OpenBL tracks brute force attacks on their hosts. They have a very short list for hosts, under their own control, collecting this information, to eliminate false positives.
They suggest to use the default blacklist which has a retention policy of 90 days (`openbl`), but they also provide lists with different retention policies (from 1 day to 1 year).
Their goal is to report abuse to the responsible provider so that the infection is disabled.
2. **Blocklist.de** lists `blocklist_de*`
Is a network of users reporting abuse mainly using `fail2ban`. They eliminate false positives using other lists available. Since they collect information from their users, their lists may be subject to poisoning, or false positives.
I asked them about poisoning. [Here](https://forum.blocklist.de/viewtopic.php?f=4&t=244&sid=847d00d26b0735add3518ff515242cad) you can find their answer. In short, they track it down so that they have an ignorable rate of false positives.
Also, they only include individual IPs (no subnets) which have attacked their users the last 48 hours and their list contains 20.000 to 40.000 IPs (which is small enough considering the size of the internet).
Like `openbl`, their goal is to report abuse back, so that the infection is disabled.
They also provide their blocklist per type of attack (mail, web, etc).
Of course, there are more lists included. You can check them and decide if they fit for your needs.
## Why are open proxy lists included
Of course, I haven't included them for you to use the open proxies. The port the proxy is listening, or the type of proxy, are not included (although most of them use the standard proxy ports and do serve web requests).
If you check the comparisons for the open proxy lists (`ri_connect_proxies`, `ri_web_proxies`, `xroxy`, `proxz`, `proxyrss`, etc)
you will find that they overlap to a great degree with other blocklists, like `blocklist_de`, `stopforumspam`, etc.
> This means the attackers also use open proxies to execute attacks.
So, if you are under attack, blocking the open proxies may help isolate a large part of the attack.
I don't suggest to permanently block IPs using the proxy lists. Their purpose of existence is questionable.
Their quality though may be acceptable, since lot of these sites advertise that they test open proxies before including them in their lists, so that there are no false positives, at least at the time they tested them.
---
## Using them in FireHOL
`update-ipsets.sh` itself does not alter your firewall. It can be used to update ipsets both on disk and in the kernel for any firewall solution you use.
The information below, shows you how to configure FireHOL to use the provides ipsets.
### Adding the ipsets in your firehol.conf
I use something like this:
```sh
# our wan interface
wan="dsl0"
# our whitelist
ipset4 create whitelist hash:net
ipset4 add whitelist A.B.C.D/E # A.B.C.D/E is whitelisted
# subnets - netsets
for x in fullbogons dshield spamhaus_drop spamhaus_edrop
do
ipset4 create ${x} hash:net
ipset4 addfile ${x} ipsets/${x}.netset
blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} \
except src ipset:whitelist
done
# individual IPs - ipsets
for x in feodo palevo sslbl zeus openbl blocklist_de
do
ipset4 create ${x} hash:ip
ipset4 addfile ${x} ipsets/${x}.ipset
blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} \
except src ipset:whitelist
done
... rest of firehol.conf ...
```
If you are concerned about iptables performance, change the `blacklist4` keyword `full` to `input`.
This will block only inbound NEW connections, i.e. only the first packet for every NEW inbound connection will be checked.
All other traffic passes through unchecked.
> Before adding these rules to your `firehol.conf` you should run `update-ipsets.sh` to enable them.
### Updating the ipsets while the firewall is running
Just use the `update-ipsets.sh` script from the firehol distribution.
This script will update each ipset and call firehol to update the ipset while the firewall is running.
> You can add `update-ipsets.sh` to cron, to run every 10 mins. `update-ipsets.sh` is smart enough to download
> a list only when it needs to.
---
# List of ipsets included

737
README.md Normal file
View File

@ -0,0 +1,737 @@
> Due to the amount of data and the frequency of the updates on this repo,
> github has requested to limit the number of updates.
> The site [https://iplists.firehol.org](https://iplists.firehol.org) has direct links
> to all the files in this repo. **This repo is now updated once per day.**
---
### Contents
- [About this repo](#about-this-repo)
- [Using these ipsets](#using-these-ipsets)
- [Which ones to use?](#which-ones-to-use)
- [Why are open proxy lists included](#why-are-open-proxy-lists-included)
- [Using them in FireHOL](#using-them-in-firehol)
* [Adding the ipsets in your firehol.conf](#adding-the-ipsets-in-your-fireholconf)
* [Updating the ipsets while the firewall is running](#updating-the-ipsets-while-the-firewall-is-running)
- [Dynamic List of ipsets included](#list-of-ipsets-included)
- [Comparison of ipsets](#comparison-of-ipsets)
---
# About this repo
This repository includes a list of ipsets dynamically updated with
[FireHOL](https://github.com/firehol/firehol)'s `update-ipsets.sh`
[documented in this wiki](https://github.com/firehol/blocklist-ipsets/wiki).
This repo is self maintained. It it updated automatically from the script via a cron job.
This repo has a site: [http://iplists.firehol.org](http://iplists.firehol.org).
## Why do we need blocklists?
As time passes and the internet matures in our life, cybercrime is becoming increasingly sophisticated.
Although there are many tools (detection of malware, viruses, intrusion detection and prevention systems,
etc) to help us isolate the bad guys, there are now a lot more than just such attacks.
What is more interesting is that the fraudsters or attackers in many cases are not going to do a direct
damage to you or your systems. They will use you and your systems to gain something else, possibly not
related or indirectly related to your business. Nowadays the attacks cannot be identified easily. They are
distributed and come to our systems from a vast amount of IPs around the world.
To get an idea, check for example the [XRumer](http://en.wikipedia.org/wiki/XRumer) software. This thing
mimics human behavior to post ads, it creates email accounts, responds to emails it receives, bypasses
captchas, it goes gently to stay unnoticed, etc.
To increase our effectiveness we need to complement our security solutions with our shared knowledge, our
shared experience in this fight.
Hopefully, there are many teams out there that do their best to identify the attacks and pinpoint the
attackers. These teams release blocklists. Blocklists of IPs (for use in firewalls), domains & URLs
(for use in proxies), etc.
What we are interested here is IPs.
Using IP blocklists at the internet side of your firewall is a key component of internet security. These
lists share key knowledge between us, allowing us to learn from each other and effectively isolate
fraudsters and attackers from our services.
I decided to upload these lists to a github repo because:
1. They are freely available on the internet. The intention of their creators is to help internet security.
Keep in mind though that a few of these lists may have special licences attached. Before using them, please check their source site for any information regarding proper use.
2. Github provides (via `git pull`) a unified way of updating all the lists together.
Pulling this repo regularly on your machines, you will update all the IP lists at once.
3. Github also provides a unified version control. Using it we can have a history of what each list has
done, which IPs or subnets were added and which were removed.
## DNSBLs
Check also another tool included in FireHOL v3+, called `dnsbl-ipset.sh`.
This tool is capable of creating an ipset based on your traffic by looking up information on DNSBLs and
scoring it according to your preferences.
More information [here](https://github.com/firehol/firehol/wiki/dnsbl-ipset.sh).
---
# Using these ipsets
Please be very careful what you choose to use and how you use it. If you blacklist traffic using these
lists you may end up blocking your users, your customers, even yourself (!) from accessing your services.
1. Go to to the site of each list and read how each list is maintained. You are going to trust these guys for doing their job right.
2. Most sites have either a donation system or commercial lists of higher quality. Try to support them.
3. I have included the TOR network in these lists (`bm_tor`, `dm_tor`, `et_tor`). The TOR network is not necessarily bad and you should not block it if you want to allow your users be anonymous. I have included it because for certain cases, allowing an anonymity network might be a risky thing (such as eCommerce).
4. Apply any blacklist at the internet side of your firewall. Be very careful. The `bogons` and `fullbogons` lists contain private, unrouteable IPs that should not be routed on the internet. If you apply such a blocklist on your DMZ or LAN side, you will be blocked out of your firewall.
5. Always have a whitelist too, containing the IP addresses or subnets you trust. Try to build the rules in such a way that if an IP is in the whitelist, it should not be blocked by these blocklists.
## Which ones to use
### Level 1 - Basic
These are the ones I trust. **Level 1** provides basic security against the most well-known attackers, with the minimum of false positives.
1. **Abuse.ch** lists `feodo`, `palevo`, `sslbl`, `zeus`, `zeus_badips`
These folks are doing a great job tracking crime ware. Their blocklists are very focused.
Keep in mind `zeus` may include some false positives. You can use `zeus_badips` instead.
2. **DShield.org** list `dshield`
It contains the top 20 attacking class C (/24) subnets, over the last three days.
3. **Spamhaus.org** lists `spamhaus_drop`, `spamhaus_edrop`
DROP (Don't Route Or Peer) and EDROP are advisory "drop all traffic" lists, consisting of netblocks that are "hijacked" or leased by professional spam or cyber-crime operations (used for dissemination of malware, trojan downloaders, botnet controllers).
According to Spamhaus.org:
> When implemented at a network or ISP's 'core routers', DROP and EDROP will help protect the network's users from spamming, scanning, harvesting, DNS-hijacking and DDoS attacks originating on rogue netblocks.
>
> Spamhaus strongly encourages the use of DROP and EDROP by tier-1s and backbones.
Spamhaus is very responsive to adapt these lists when a network owner updates them that the issue has been solved (I had one such incident with one of my users).
4. **Team-Cymru.org** list `bogons` or `fullbogons`
These are lists of IPs that should not be routed on the internet. No one should be using them.
Be very careful to apply either of the two on the internet side of your network.
### Level 2 - Essentials
**Level 2** provide protection against current brute force attacks. This level may have a small percentage of false positives, mainly due to dynamic IPs being re-used by other users.
1. **OpenBL.org** lists `openbl*`
The team of OpenBL tracks brute force attacks on their hosts. They have a very short list for hosts, under their own control, collecting this information, to eliminate false positives.
They suggest to use the default blacklist which has a retention policy of 90 days (`openbl`), but they also provide lists with different retention policies (from 1 day to 1 year).
Their goal is to report abuse to the responsible provider so that the infection is disabled.
2. **Blocklist.de** lists `blocklist_de*`
Is a network of users reporting abuse mainly using `fail2ban`. They eliminate false positives using other lists available. Since they collect information from their users, their lists may be subject to poisoning, or false positives.
I asked them about poisoning. [Here](https://forum.blocklist.de/viewtopic.php?f=4&t=244&sid=847d00d26b0735add3518ff515242cad) you can find their answer. In short, they track it down so that they have an ignorable rate of false positives.
Also, they only include individual IPs (no subnets) which have attacked their users the last 48 hours and their list contains 20.000 to 40.000 IPs (which is small enough considering the size of the internet).
Like `openbl`, their goal is to report abuse back, so that the infection is disabled.
They also provide their blocklist per type of attack (mail, web, etc).
Of course, there are more lists included. You can check them and decide if they fit for your needs.
## Why are open proxy lists included
Of course, I haven't included them for you to use the open proxies. The port the proxy is listening, or the type of proxy, are not included (although most of them use the standard proxy ports and do serve web requests).
If you check the comparisons for the open proxy lists (`ri_connect_proxies`, `ri_web_proxies`, `xroxy`, `proxz`, `proxyrss`, etc)
you will find that they overlap to a great degree with other blocklists, like `blocklist_de`, `stopforumspam`, etc.
> This means the attackers also use open proxies to execute attacks.
So, if you are under attack, blocking the open proxies may help isolate a large part of the attack.
I don't suggest to permanently block IPs using the proxy lists. Their purpose of existence is questionable.
Their quality though may be acceptable, since lot of these sites advertise that they test open proxies before including them in their lists, so that there are no false positives, at least at the time they tested them.
---
## Using them in FireHOL
`update-ipsets.sh` itself does not alter your firewall. It can be used to update ipsets both on disk and in the kernel for any firewall solution you use.
The information below, shows you how to configure FireHOL to use the provides ipsets.
### Adding the ipsets in your firehol.conf
I use something like this:
```sh
# our wan interface
wan="dsl0"
# our whitelist
ipset4 create whitelist hash:net
ipset4 add whitelist A.B.C.D/E # A.B.C.D/E is whitelisted
# subnets - netsets
for x in fullbogons dshield spamhaus_drop spamhaus_edrop
do
ipset4 create ${x} hash:net
ipset4 addfile ${x} ipsets/${x}.netset
blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} \
except src ipset:whitelist
done
# individual IPs - ipsets
for x in feodo palevo sslbl zeus openbl blocklist_de
do
ipset4 create ${x} hash:ip
ipset4 addfile ${x} ipsets/${x}.ipset
blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} \
except src ipset:whitelist
done
... rest of firehol.conf ...
```
If you are concerned about iptables performance, change the `blacklist4` keyword `full` to `input`.
This will block only inbound NEW connections, i.e. only the first packet for every NEW inbound connection will be checked.
All other traffic passes through unchecked.
> Before adding these rules to your `firehol.conf` you should run `update-ipsets.sh` to enable them.
### Updating the ipsets while the firewall is running
Just use the `update-ipsets.sh` script from the firehol distribution.
This script will update each ipset and call firehol to update the ipset while the firewall is running.
> You can add `update-ipsets.sh` to cron, to run every 10 mins. `update-ipsets.sh` is smart enough to download
> a list only when it needs to.
---
# List of ipsets included
The following list was automatically generated on Fri Aug 14 10:28:49 UTC 2020.
The update frequency is the maximum allowed by internal configuration. A list will never be downloaded sooner than the update frequency stated. A list may also not be downloaded, after this frequency expired, if it has not been modified on the server (as reported by HTTP `IF_MODIFIED_SINCE` method).
name|info|type|entries|update|
:--:|:--:|:--:|:-----:|:----:|
[alienvault_reputation](http://iplists.firehol.org/?ipset=alienvault_reputation)|[AlienVault.com](https://www.alienvault.com/) IP reputation database|ipv4 hash:ip|275629 unique IPs|updated every 6 hours from [this link](https://reputation.alienvault.com/reputation.generic)
[asprox_c2](http://iplists.firehol.org/?ipset=asprox_c2)|[h3x.eu](http://atrack.h3x.eu/) ASPROX Tracker - Asprox C&C Sites|ipv4 hash:ip|0 unique IPs|updated every 1 day from [this link](http://atrack.h3x.eu/c2)
[bambenek_banjori](http://iplists.firehol.org/?ipset=bambenek_banjori)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of banjori C&Cs with 90 minute lookback|ipv4 hash:ip|136 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/banjori-iplist.txt)
[bambenek_bebloh](http://iplists.firehol.org/?ipset=bambenek_bebloh)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of bebloh C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/bebloh-iplist.txt)
[bambenek_c2](http://iplists.firehol.org/?ipset=bambenek_c2)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) master feed of known, active and non-sinkholed C&Cs IP addresses|ipv4 hash:ip|486 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/c2-ipmasterlist.txt)
[bambenek_cl](http://iplists.firehol.org/?ipset=bambenek_cl)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of cl C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/cl-iplist.txt)
[bambenek_cryptowall](http://iplists.firehol.org/?ipset=bambenek_cryptowall)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of cryptowall C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/cryptowall-iplist.txt)
[bambenek_dircrypt](http://iplists.firehol.org/?ipset=bambenek_dircrypt)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of dircrypt C&Cs with 90 minute lookback|ipv4 hash:ip|2 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/dircrypt-iplist.txt)
[bambenek_dyre](http://iplists.firehol.org/?ipset=bambenek_dyre)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of dyre C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/dyre-iplist.txt)
[bambenek_geodo](http://iplists.firehol.org/?ipset=bambenek_geodo)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of geodo C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/geodo-iplist.txt)
[bambenek_hesperbot](http://iplists.firehol.org/?ipset=bambenek_hesperbot)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of hesperbot C&Cs with 90 minute lookback|ipv4 hash:ip|2 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/hesperbot-iplist.txt)
[bambenek_matsnu](http://iplists.firehol.org/?ipset=bambenek_matsnu)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of matsnu C&Cs with 90 minute lookback|ipv4 hash:ip|1 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/matsnu-iplist.txt)
[bambenek_necurs](http://iplists.firehol.org/?ipset=bambenek_necurs)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of necurs C&Cs with 90 minute lookback|ipv4 hash:ip|13 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/necurs-iplist.txt)
[bambenek_p2pgoz](http://iplists.firehol.org/?ipset=bambenek_p2pgoz)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of p2pgoz C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/p2pgoz-iplist.txt)
[bambenek_pushdo](http://iplists.firehol.org/?ipset=bambenek_pushdo)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of pushdo C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/pushdo-iplist.txt)
[bambenek_pykspa](http://iplists.firehol.org/?ipset=bambenek_pykspa)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of pykspa C&Cs with 90 minute lookback|ipv4 hash:ip|5 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/pykspa-iplist.txt)
[bambenek_qakbot](http://iplists.firehol.org/?ipset=bambenek_qakbot)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of qakbot C&Cs with 90 minute lookback|ipv4 hash:ip|2 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/qakbot-iplist.txt)
[bambenek_ramnit](http://iplists.firehol.org/?ipset=bambenek_ramnit)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of ramnit C&Cs with 90 minute lookback|ipv4 hash:ip|98 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/ramnit-iplist.txt)
[bambenek_ranbyus](http://iplists.firehol.org/?ipset=bambenek_ranbyus)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of ranbyus C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/ranbyus-iplist.txt)
[bambenek_simda](http://iplists.firehol.org/?ipset=bambenek_simda)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of simda C&Cs with 90 minute lookback|ipv4 hash:ip|131 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/simda-iplist.txt)
[bambenek_suppobox](http://iplists.firehol.org/?ipset=bambenek_suppobox)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of suppobox C&Cs with 90 minute lookback|ipv4 hash:ip|108 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/suppobox-iplist.txt)
[bambenek_symmi](http://iplists.firehol.org/?ipset=bambenek_symmi)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of symmi C&Cs with 90 minute lookback|ipv4 hash:ip|1 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/symmi-iplist.txt)
[bambenek_tinba](http://iplists.firehol.org/?ipset=bambenek_tinba)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of tinba C&Cs with 90 minute lookback|ipv4 hash:ip|4 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/tinba-iplist.txt)
[bambenek_volatile](http://iplists.firehol.org/?ipset=bambenek_volatile)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of volatile C&Cs with 90 minute lookback|ipv4 hash:ip|1 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/volatile-iplist.txt)
[bbcan177_ms1](http://iplists.firehol.org/?ipset=bbcan177_ms1)|pfBlockerNG Malicious Threats|ipv4 hash:net|2688 subnets, 5269973 unique IPs|updated every 1 day from [this link](https://gist.githubusercontent.com/BBcan177/bf29d47ea04391cb3eb0/raw)
[bbcan177_ms3](http://iplists.firehol.org/?ipset=bbcan177_ms3)|pfBlockerNG Malicious Threats|ipv4 hash:net|1146 subnets, 30151694 unique IPs|updated every 1 day from [this link](https://gist.githubusercontent.com/BBcan177/d7105c242f17f4498f81/raw)
[bds_atif](http://iplists.firehol.org/?ipset=bds_atif)|Artillery Threat Intelligence Feed and Banlist Feed|ipv4 hash:ip|4703 unique IPs|updated every 1 day from [this link](https://www.binarydefense.com/banlist.txt)
[bi_any_0_1d](http://iplists.firehol.org/?ipset=bi_any_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category any with score above 0 and age less than 1d|ipv4 hash:ip|20428 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/any/0?age=1d)
[bi_any_1_7d](http://iplists.firehol.org/?ipset=bi_any_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category any with score above 1 and age less than 7d|ipv4 hash:ip|1001 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/any/1?age=7d)
[bi_any_2_1d](http://iplists.firehol.org/?ipset=bi_any_2_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category any with score above 2 and age less than 1d|ipv4 hash:ip|310 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/any/2?age=1d)
[bi_any_2_30d](http://iplists.firehol.org/?ipset=bi_any_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category any with score above 2 and age less than 30d|ipv4 hash:ip|6915 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/any/2?age=30d)
[bi_any_2_7d](http://iplists.firehol.org/?ipset=bi_any_2_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category any with score above 2 and age less than 7d|ipv4 hash:ip|741 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/any/2?age=7d)
[bi_apache-404_0_1d](http://iplists.firehol.org/?ipset=bi_apache-404_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category apache-404 with score above 0 and age less than 1d|ipv4 hash:ip|12 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/apache-404/0?age=1d)
[bi_apache-modsec_0_1d](http://iplists.firehol.org/?ipset=bi_apache-modsec_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category apache-modsec with score above 0 and age less than 1d|ipv4 hash:ip|9 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/apache-modsec/0?age=1d)
[bi_apache-noscript_0_1d](http://iplists.firehol.org/?ipset=bi_apache-noscript_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category apache-noscript with score above 0 and age less than 1d|ipv4 hash:ip|36 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/apache-noscript/0?age=1d)
[bi_apache-noscript_2_30d](http://iplists.firehol.org/?ipset=bi_apache-noscript_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category apache-noscript with score above 2 and age less than 30d|ipv4 hash:ip|7 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/apache-noscript/2?age=30d)
[bi_apache-phpmyadmin_0_1d](http://iplists.firehol.org/?ipset=bi_apache-phpmyadmin_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category apache-phpmyadmin with score above 0 and age less than 1d|ipv4 hash:ip|1 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/apache-phpmyadmin/0?age=1d)
[bi_apache-scriddies_0_1d](http://iplists.firehol.org/?ipset=bi_apache-scriddies_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category apache-scriddies with score above 0 and age less than 1d|ipv4 hash:ip|270 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/apache-scriddies/0?age=1d)
[bi_apache_0_1d](http://iplists.firehol.org/?ipset=bi_apache_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category apache with score above 0 and age less than 1d|ipv4 hash:ip|465 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/apache/0?age=1d)
[bi_apache_1_7d](http://iplists.firehol.org/?ipset=bi_apache_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category apache with score above 1 and age less than 7d|ipv4 hash:ip|25 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/apache/1?age=7d)
[bi_apache_2_30d](http://iplists.firehol.org/?ipset=bi_apache_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category apache with score above 2 and age less than 30d|ipv4 hash:ip|54 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/apache/2?age=30d)
[bi_apacheddos_0_1d](http://iplists.firehol.org/?ipset=bi_apacheddos_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category apacheddos with score above 0 and age less than 1d|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/apacheddos/0?age=1d)
[bi_assp_0_1d](http://iplists.firehol.org/?ipset=bi_assp_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category assp with score above 0 and age less than 1d|ipv4 hash:ip|44 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/assp/0?age=1d)
[bi_asterisk_0_1d](http://iplists.firehol.org/?ipset=bi_asterisk_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category asterisk with score above 0 and age less than 1d|ipv4 hash:ip|55 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/asterisk/0?age=1d)
[bi_asterisk_2_30d](http://iplists.firehol.org/?ipset=bi_asterisk_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category asterisk with score above 2 and age less than 30d|ipv4 hash:ip|3 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/asterisk/2?age=30d)
[bi_badbots_0_1d](http://iplists.firehol.org/?ipset=bi_badbots_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category badbots with score above 0 and age less than 1d|ipv4 hash:ip|7697 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/badbots/0?age=1d)
[bi_badbots_1_7d](http://iplists.firehol.org/?ipset=bi_badbots_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category badbots with score above 1 and age less than 7d|ipv4 hash:ip|245 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/badbots/1?age=7d)
[bi_bruteforce_0_1d](http://iplists.firehol.org/?ipset=bi_bruteforce_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category bruteforce with score above 0 and age less than 1d|ipv4 hash:ip|7847 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/bruteforce/0?age=1d)
[bi_bruteforce_1_7d](http://iplists.firehol.org/?ipset=bi_bruteforce_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category bruteforce with score above 1 and age less than 7d|ipv4 hash:ip|247 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/bruteforce/1?age=7d)
[bi_cms_0_1d](http://iplists.firehol.org/?ipset=bi_cms_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category cms with score above 0 and age less than 1d|ipv4 hash:ip|482 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/cms/0?age=1d)
[bi_cms_1_7d](http://iplists.firehol.org/?ipset=bi_cms_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category cms with score above 1 and age less than 7d|ipv4 hash:ip|26 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/cms/1?age=7d)
[bi_cms_2_30d](http://iplists.firehol.org/?ipset=bi_cms_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category cms with score above 2 and age less than 30d|ipv4 hash:ip|107 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/cms/2?age=30d)
[bi_courierauth_0_1d](http://iplists.firehol.org/?ipset=bi_courierauth_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category courierauth with score above 0 and age less than 1d|ipv4 hash:ip|1 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/courierauth/0?age=1d)
[bi_courierauth_2_30d](http://iplists.firehol.org/?ipset=bi_courierauth_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category courierauth with score above 2 and age less than 30d|ipv4 hash:ip|1 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/courierauth/2?age=30d)
[bi_default_0_1d](http://iplists.firehol.org/?ipset=bi_default_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category default with score above 0 and age less than 1d|ipv4 hash:ip|8 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/default/0?age=1d)
[bi_default_1_7d](http://iplists.firehol.org/?ipset=bi_default_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category default with score above 1 and age less than 7d|ipv4 hash:ip|0 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/default/1?age=7d)
[bi_default_2_30d](http://iplists.firehol.org/?ipset=bi_default_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category default with score above 2 and age less than 30d|ipv4 hash:ip|0 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/default/2?age=30d)
[bi_dns_0_1d](http://iplists.firehol.org/?ipset=bi_dns_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category dns with score above 0 and age less than 1d|ipv4 hash:ip|9 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/dns/0?age=1d)
[bi_dovecot-pop3imap_0_1d](http://iplists.firehol.org/?ipset=bi_dovecot-pop3imap_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category dovecot-pop3imap with score above 0 and age less than 1d|ipv4 hash:ip|98 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/dovecot-pop3imap/0?age=1d)
[bi_dovecot-pop3imap_2_30d](http://iplists.firehol.org/?ipset=bi_dovecot-pop3imap_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category dovecot-pop3imap with score above 2 and age less than 30d|ipv4 hash:ip|45 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/dovecot-pop3imap/2?age=30d)
[bi_dovecot_0_1d](http://iplists.firehol.org/?ipset=bi_dovecot_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category dovecot with score above 0 and age less than 1d|ipv4 hash:ip|92 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/dovecot/0?age=1d)
[bi_dovecot_1_7d](http://iplists.firehol.org/?ipset=bi_dovecot_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category dovecot with score above 1 and age less than 7d|ipv4 hash:ip|15 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/dovecot/1?age=7d)
[bi_dovecot_2_30d](http://iplists.firehol.org/?ipset=bi_dovecot_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category dovecot with score above 2 and age less than 30d|ipv4 hash:ip|45 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/dovecot/2?age=30d)
[bi_drupal_0_1d](http://iplists.firehol.org/?ipset=bi_drupal_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category drupal with score above 0 and age less than 1d|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/drupal/0?age=1d)
[bi_exim_0_1d](http://iplists.firehol.org/?ipset=bi_exim_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category exim with score above 0 and age less than 1d|ipv4 hash:ip|80 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/exim/0?age=1d)
[bi_exim_1_7d](http://iplists.firehol.org/?ipset=bi_exim_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category exim with score above 1 and age less than 7d|ipv4 hash:ip|0 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/exim/1?age=7d)
[bi_ftp_0_1d](http://iplists.firehol.org/?ipset=bi_ftp_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category ftp with score above 0 and age less than 1d|ipv4 hash:ip|75 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/ftp/0?age=1d)
[bi_ftp_1_7d](http://iplists.firehol.org/?ipset=bi_ftp_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category ftp with score above 1 and age less than 7d|ipv4 hash:ip|4 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/ftp/1?age=7d)
[bi_ftp_2_30d](http://iplists.firehol.org/?ipset=bi_ftp_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category ftp with score above 2 and age less than 30d|ipv4 hash:ip|6 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/ftp/2?age=30d)
[bi_http_0_1d](http://iplists.firehol.org/?ipset=bi_http_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category http with score above 0 and age less than 1d|ipv4 hash:ip|1002 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/http/0?age=1d)
[bi_http_1_7d](http://iplists.firehol.org/?ipset=bi_http_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category http with score above 1 and age less than 7d|ipv4 hash:ip|63 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/http/1?age=7d)
[bi_http_2_30d](http://iplists.firehol.org/?ipset=bi_http_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category http with score above 2 and age less than 30d|ipv4 hash:ip|190 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/http/2?age=30d)
[bi_imap_0_1d](http://iplists.firehol.org/?ipset=bi_imap_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category imap with score above 0 and age less than 1d|ipv4 hash:ip|95 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/imap/0?age=1d)
[bi_mail_0_1d](http://iplists.firehol.org/?ipset=bi_mail_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category mail with score above 0 and age less than 1d|ipv4 hash:ip|1872 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/mail/0?age=1d)
[bi_mail_1_7d](http://iplists.firehol.org/?ipset=bi_mail_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category mail with score above 1 and age less than 7d|ipv4 hash:ip|168 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/mail/1?age=7d)
[bi_mail_2_30d](http://iplists.firehol.org/?ipset=bi_mail_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category mail with score above 2 and age less than 30d|ipv4 hash:ip|439 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/mail/2?age=30d)
[bi_named_0_1d](http://iplists.firehol.org/?ipset=bi_named_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category named with score above 0 and age less than 1d|ipv4 hash:ip|9 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/named/0?age=1d)
[bi_owncloud_0_1d](http://iplists.firehol.org/?ipset=bi_owncloud_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category owncloud with score above 0 and age less than 1d|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/owncloud/0?age=1d)
[bi_plesk-postfix_0_1d](http://iplists.firehol.org/?ipset=bi_plesk-postfix_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category plesk-postfix with score above 0 and age less than 1d|ipv4 hash:ip|16 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/plesk-postfix/0?age=1d)
[bi_postfix-sasl_0_1d](http://iplists.firehol.org/?ipset=bi_postfix-sasl_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category postfix-sasl with score above 0 and age less than 1d|ipv4 hash:ip|156 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/postfix-sasl/0?age=1d)
[bi_postfix-sasl_1_7d](http://iplists.firehol.org/?ipset=bi_postfix-sasl_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category postfix-sasl with score above 1 and age less than 7d|ipv4 hash:ip|7 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/postfix-sasl/1?age=7d)
[bi_postfix-sasl_2_30d](http://iplists.firehol.org/?ipset=bi_postfix-sasl_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category postfix-sasl with score above 2 and age less than 30d|ipv4 hash:ip|15 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/postfix-sasl/2?age=30d)
[bi_postfix_0_1d](http://iplists.firehol.org/?ipset=bi_postfix_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category postfix with score above 0 and age less than 1d|ipv4 hash:ip|612 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/postfix/0?age=1d)
[bi_postfix_1_7d](http://iplists.firehol.org/?ipset=bi_postfix_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category postfix with score above 1 and age less than 7d|ipv4 hash:ip|47 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/postfix/1?age=7d)
[bi_postfix_2_30d](http://iplists.firehol.org/?ipset=bi_postfix_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category postfix with score above 2 and age less than 30d|ipv4 hash:ip|139 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/postfix/2?age=30d)
[bi_proftpd_0_1d](http://iplists.firehol.org/?ipset=bi_proftpd_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category proftpd with score above 0 and age less than 1d|ipv4 hash:ip|43 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/proftpd/0?age=1d)
[bi_proftpd_1_7d](http://iplists.firehol.org/?ipset=bi_proftpd_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category proftpd with score above 1 and age less than 7d|ipv4 hash:ip|2 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/proftpd/1?age=7d)
[bi_proftpd_2_30d](http://iplists.firehol.org/?ipset=bi_proftpd_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category proftpd with score above 2 and age less than 30d|ipv4 hash:ip|2 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/proftpd/2?age=30d)
[bi_pureftpd_0_1d](http://iplists.firehol.org/?ipset=bi_pureftpd_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category pureftpd with score above 0 and age less than 1d|ipv4 hash:ip|17 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/pureftpd/0?age=1d)
[bi_pureftpd_1_7d](http://iplists.firehol.org/?ipset=bi_pureftpd_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category pureftpd with score above 1 and age less than 7d|ipv4 hash:ip|2 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/pureftpd/1?age=7d)
[bi_pureftpd_2_30d](http://iplists.firehol.org/?ipset=bi_pureftpd_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category pureftpd with score above 2 and age less than 30d|ipv4 hash:ip|3 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/pureftpd/2?age=30d)
[bi_qmail-smtp_0_1d](http://iplists.firehol.org/?ipset=bi_qmail-smtp_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category qmail-smtp with score above 0 and age less than 1d|ipv4 hash:ip|7 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/qmail-smtp/0?age=1d)
[bi_rdp_0_1d](http://iplists.firehol.org/?ipset=bi_rdp_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category rdp with score above 0 and age less than 1d|ipv4 hash:ip|5 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/rdp/0?age=1d)
[bi_sasl_0_1d](http://iplists.firehol.org/?ipset=bi_sasl_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sasl with score above 0 and age less than 1d|ipv4 hash:ip|120 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/sasl/0?age=1d)
[bi_sasl_1_7d](http://iplists.firehol.org/?ipset=bi_sasl_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sasl with score above 1 and age less than 7d|ipv4 hash:ip|11 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/sasl/1?age=7d)
[bi_sasl_2_30d](http://iplists.firehol.org/?ipset=bi_sasl_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sasl with score above 2 and age less than 30d|ipv4 hash:ip|152 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/sasl/2?age=30d)
[bi_sip_0_1d](http://iplists.firehol.org/?ipset=bi_sip_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sip with score above 0 and age less than 1d|ipv4 hash:ip|13 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/sip/0?age=1d)
[bi_sip_1_7d](http://iplists.firehol.org/?ipset=bi_sip_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sip with score above 1 and age less than 7d|ipv4 hash:ip|1 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/sip/1?age=7d)
[bi_sip_2_30d](http://iplists.firehol.org/?ipset=bi_sip_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sip with score above 2 and age less than 30d|ipv4 hash:ip|1 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/sip/2?age=30d)
[bi_smtp_0_1d](http://iplists.firehol.org/?ipset=bi_smtp_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category smtp with score above 0 and age less than 1d|ipv4 hash:ip|366 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/smtp/0?age=1d)
[bi_spam_0_1d](http://iplists.firehol.org/?ipset=bi_spam_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category spam with score above 0 and age less than 1d|ipv4 hash:ip|332 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/spam/0?age=1d)
[bi_spam_1_7d](http://iplists.firehol.org/?ipset=bi_spam_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category spam with score above 1 and age less than 7d|ipv4 hash:ip|51 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/spam/1?age=7d)
[bi_sql-attack_0_1d](http://iplists.firehol.org/?ipset=bi_sql-attack_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sql-attack with score above 0 and age less than 1d|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/sql-attack/0?age=1d)
[bi_sql_0_1d](http://iplists.firehol.org/?ipset=bi_sql_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sql with score above 0 and age less than 1d|ipv4 hash:ip|92 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/sql/0?age=1d)
[bi_ssh-blocklist_0_1d](http://iplists.firehol.org/?ipset=bi_ssh-blocklist_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category ssh-blocklist with score above 0 and age less than 1d|ipv4 hash:ip|2 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/ssh-blocklist/0?age=1d)
[bi_ssh-ddos_0_1d](http://iplists.firehol.org/?ipset=bi_ssh-ddos_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category ssh-ddos with score above 0 and age less than 1d|ipv4 hash:ip|1472 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/ssh-ddos/0?age=1d)
[bi_ssh-ddos_2_30d](http://iplists.firehol.org/?ipset=bi_ssh-ddos_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category ssh-ddos with score above 2 and age less than 30d|ipv4 hash:ip|13 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/ssh-ddos/2?age=30d)
[bi_ssh_0_1d](http://iplists.firehol.org/?ipset=bi_ssh_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category ssh with score above 0 and age less than 1d|ipv4 hash:ip|10506 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/ssh/0?age=1d)
[bi_ssh_1_7d](http://iplists.firehol.org/?ipset=bi_ssh_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category ssh with score above 1 and age less than 7d|ipv4 hash:ip|556 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/ssh/1?age=7d)
[bi_ssh_2_30d](http://iplists.firehol.org/?ipset=bi_ssh_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category ssh with score above 2 and age less than 30d|ipv4 hash:ip|6239 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/ssh/2?age=30d)
[bi_sshd_0_1d](http://iplists.firehol.org/?ipset=bi_sshd_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sshd with score above 0 and age less than 1d|ipv4 hash:ip|7693 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/sshd/0?age=1d)
[bi_sshd_1_7d](http://iplists.firehol.org/?ipset=bi_sshd_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sshd with score above 1 and age less than 7d|ipv4 hash:ip|325 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/sshd/1?age=7d)
[bi_sshd_2_30d](http://iplists.firehol.org/?ipset=bi_sshd_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sshd with score above 2 and age less than 30d|ipv4 hash:ip|5552 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/sshd/2?age=30d)
[bi_telnet_0_1d](http://iplists.firehol.org/?ipset=bi_telnet_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category telnet with score above 0 and age less than 1d|ipv4 hash:ip|96 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/telnet/0?age=1d)
[bi_telnet_1_7d](http://iplists.firehol.org/?ipset=bi_telnet_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category telnet with score above 1 and age less than 7d|ipv4 hash:ip|13 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/telnet/1?age=7d)
[bi_telnet_2_30d](http://iplists.firehol.org/?ipset=bi_telnet_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category telnet with score above 2 and age less than 30d|ipv4 hash:ip|5 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/telnet/2?age=30d)
[bi_unknown_0_1d](http://iplists.firehol.org/?ipset=bi_unknown_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category unknown with score above 0 and age less than 1d|ipv4 hash:ip|2189 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/unknown/0?age=1d)
[bi_unknown_1_7d](http://iplists.firehol.org/?ipset=bi_unknown_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category unknown with score above 1 and age less than 7d|ipv4 hash:ip|3 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/unknown/1?age=7d)
[bi_unknown_2_30d](http://iplists.firehol.org/?ipset=bi_unknown_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category unknown with score above 2 and age less than 30d|ipv4 hash:ip|7 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/unknown/2?age=30d)
[bi_username-notfound_0_1d](http://iplists.firehol.org/?ipset=bi_username-notfound_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category username-notfound with score above 0 and age less than 1d|ipv4 hash:ip|48 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/username-notfound/0?age=1d)
[bi_voip_0_1d](http://iplists.firehol.org/?ipset=bi_voip_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category voip with score above 0 and age less than 1d|ipv4 hash:ip|67 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/voip/0?age=1d)
[bi_voip_1_7d](http://iplists.firehol.org/?ipset=bi_voip_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category voip with score above 1 and age less than 7d|ipv4 hash:ip|2 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/voip/1?age=7d)
[bi_voip_2_30d](http://iplists.firehol.org/?ipset=bi_voip_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category voip with score above 2 and age less than 30d|ipv4 hash:ip|4 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/voip/2?age=30d)
[bi_vsftpd_0_1d](http://iplists.firehol.org/?ipset=bi_vsftpd_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category vsftpd with score above 0 and age less than 1d|ipv4 hash:ip|8 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/vsftpd/0?age=1d)
[bi_vsftpd_2_30d](http://iplists.firehol.org/?ipset=bi_vsftpd_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category vsftpd with score above 2 and age less than 30d|ipv4 hash:ip|1 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/vsftpd/2?age=30d)
[bi_wordpress_0_1d](http://iplists.firehol.org/?ipset=bi_wordpress_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category wordpress with score above 0 and age less than 1d|ipv4 hash:ip|432 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/wordpress/0?age=1d)
[bi_wordpress_1_7d](http://iplists.firehol.org/?ipset=bi_wordpress_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category wordpress with score above 1 and age less than 7d|ipv4 hash:ip|24 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/wordpress/1?age=7d)
[bi_wordpress_2_30d](http://iplists.firehol.org/?ipset=bi_wordpress_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category wordpress with score above 2 and age less than 30d|ipv4 hash:ip|55 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/wordpress/2?age=30d)
[bitcoin_blockchain_info_1d](http://iplists.firehol.org/?ipset=bitcoin_blockchain_info_1d)|[Blockchain.info](https://blockchain.info/en/connected-nodes) Bitcoin nodes connected to Blockchain.info.|ipv4 hash:ip|988 unique IPs|updated every 10 mins from [this link](https://blockchain.info/en/connected-nodes)
[bitcoin_blockchain_info_30d](http://iplists.firehol.org/?ipset=bitcoin_blockchain_info_30d)|[Blockchain.info](https://blockchain.info/en/connected-nodes) Bitcoin nodes connected to Blockchain.info.|ipv4 hash:ip|8196 unique IPs|updated every 10 mins from [this link](https://blockchain.info/en/connected-nodes)
[bitcoin_blockchain_info_7d](http://iplists.firehol.org/?ipset=bitcoin_blockchain_info_7d)|[Blockchain.info](https://blockchain.info/en/connected-nodes) Bitcoin nodes connected to Blockchain.info.|ipv4 hash:ip|2636 unique IPs|updated every 10 mins from [this link](https://blockchain.info/en/connected-nodes)
[bitcoin_nodes](http://iplists.firehol.org/?ipset=bitcoin_nodes)|[BitNodes](https://getaddr.bitnodes.io/) Bitcoin connected nodes, globally.|ipv4 hash:ip|6550 unique IPs|updated every 10 mins from [this link](https://getaddr.bitnodes.io/api/v1/snapshots/latest/)
[bitcoin_nodes_1d](http://iplists.firehol.org/?ipset=bitcoin_nodes_1d)|[BitNodes](https://getaddr.bitnodes.io/) Bitcoin connected nodes, globally.|ipv4 hash:ip|7105 unique IPs|updated every 10 mins from [this link](https://getaddr.bitnodes.io/api/v1/snapshots/latest/)
[bitcoin_nodes_30d](http://iplists.firehol.org/?ipset=bitcoin_nodes_30d)|[BitNodes](https://getaddr.bitnodes.io/) Bitcoin connected nodes, globally.|ipv4 hash:ip|14272 unique IPs|updated every 10 mins from [this link](https://getaddr.bitnodes.io/api/v1/snapshots/latest/)
[bitcoin_nodes_7d](http://iplists.firehol.org/?ipset=bitcoin_nodes_7d)|[BitNodes](https://getaddr.bitnodes.io/) Bitcoin connected nodes, globally.|ipv4 hash:ip|8840 unique IPs|updated every 10 mins from [this link](https://getaddr.bitnodes.io/api/v1/snapshots/latest/)
[blocklist_de](http://iplists.firehol.org/?ipset=blocklist_de)|[Blocklist.de](https://www.blocklist.de/) IPs that have been detected by fail2ban in the last 48 hours|ipv4 hash:ip|25254 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/all.txt)
[blocklist_de_apache](http://iplists.firehol.org/?ipset=blocklist_de_apache)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours as having run attacks on the service Apache, Apache-DDOS, RFI-Attacks.|ipv4 hash:ip|8968 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/apache.txt)
[blocklist_de_bots](http://iplists.firehol.org/?ipset=blocklist_de_bots)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours as having run attacks on the RFI-Attacks, REG-Bots, IRC-Bots or BadBots (BadBots = it has posted a Spam-Comment on a open Forum or Wiki).|ipv4 hash:ip|53 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/bots.txt)
[blocklist_de_bruteforce](http://iplists.firehol.org/?ipset=blocklist_de_bruteforce)|[Blocklist.de](https://www.blocklist.de/) All IPs which attacks Joomla, Wordpress and other Web-Logins with Brute-Force Logins.|ipv4 hash:ip|963 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/bruteforcelogin.txt)
[blocklist_de_ftp](http://iplists.firehol.org/?ipset=blocklist_de_ftp)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours for attacks on the Service FTP.|ipv4 hash:ip|239 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/ftp.txt)
[blocklist_de_imap](http://iplists.firehol.org/?ipset=blocklist_de_imap)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours for attacks on the Service imap, sasl, pop3, etc.|ipv4 hash:ip|2038 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/imap.txt)
[blocklist_de_mail](http://iplists.firehol.org/?ipset=blocklist_de_mail)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours as having run attacks on the service Mail, Postfix.|ipv4 hash:ip|12652 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/mail.txt)
[blocklist_de_sip](http://iplists.firehol.org/?ipset=blocklist_de_sip)|[Blocklist.de](https://www.blocklist.de/) All IP addresses that tried to login in a SIP, VOIP or Asterisk Server and are included in the IPs list from infiltrated.net|ipv4 hash:ip|212 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/sip.txt)
[blocklist_de_ssh](http://iplists.firehol.org/?ipset=blocklist_de_ssh)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours as having run attacks on the service SSH.|ipv4 hash:ip|11146 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/ssh.txt)
[blocklist_de_strongips](http://iplists.firehol.org/?ipset=blocklist_de_strongips)|[Blocklist.de](https://www.blocklist.de/) All IPs which are older then 2 month and have more then 5.000 attacks.|ipv4 hash:ip|894 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/strongips.txt)
[blocklist_net_ua](http://iplists.firehol.org/?ipset=blocklist_net_ua)|[blocklist.net.ua](https://blocklist.net.ua) The BlockList project was created to become protection against negative influence of the harmful and potentially dangerous events on the Internet. First of all this service will help internet and hosting providers to protect subscribers sites from being hacked. BlockList will help to stop receiving a large amount of spam from dubious SMTP relays or from attempts of brute force passwords to servers and network equipment.|ipv4 hash:ip|41627 unique IPs|updated every 10 mins from [this link](https://blocklist.net.ua/blocklist.csv)
[blueliv_crimeserver_last](http://iplists.firehol.org/?ipset=blueliv_crimeserver_last)|[blueliv.com](https://www.blueliv.com/) Last 6 hours Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|24381 unique IPs|updated every 6 hours
[blueliv_crimeserver_last_1d](http://iplists.firehol.org/?ipset=blueliv_crimeserver_last_1d)|[blueliv.com](https://www.blueliv.com/) Last 6 hours Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|58312 unique IPs|updated every 6 hours
[blueliv_crimeserver_last_2d](http://iplists.firehol.org/?ipset=blueliv_crimeserver_last_2d)|[blueliv.com](https://www.blueliv.com/) Last 6 hours Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|71293 unique IPs|updated every 6 hours
[blueliv_crimeserver_last_30d](http://iplists.firehol.org/?ipset=blueliv_crimeserver_last_30d)|[blueliv.com](https://www.blueliv.com/) Last 6 hours Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|87551 unique IPs|updated every 6 hours
[blueliv_crimeserver_last_7d](http://iplists.firehol.org/?ipset=blueliv_crimeserver_last_7d)|[blueliv.com](https://www.blueliv.com/) Last 6 hours Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|77098 unique IPs|updated every 6 hours
[blueliv_crimeserver_online](http://iplists.firehol.org/?ipset=blueliv_crimeserver_online)|[blueliv.com](https://www.blueliv.com/) Online Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|15628 unique IPs|updated every 1 day
[blueliv_crimeserver_recent](http://iplists.firehol.org/?ipset=blueliv_crimeserver_recent)|[blueliv.com](https://www.blueliv.com/) Recent Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|64076 unique IPs|updated every 1 day
[bm_tor](http://iplists.firehol.org/?ipset=bm_tor)|[torstatus.blutmagie.de](https://torstatus.blutmagie.de) list of all TOR network servers|ipv4 hash:ip|5748 unique IPs|updated every 30 mins from [this link](https://torstatus.blutmagie.de/ip_list_all.php/Tor_ip_list_ALL.csv)
[bogons](http://iplists.firehol.org/?ipset=bogons)|[Team-Cymru.org](http://www.team-cymru.org) private and reserved addresses defined by RFC 1918, RFC 5735, and RFC 6598 and netblocks that have not been allocated to a regional internet registry|ipv4 hash:net|13 subnets, 592708608 unique IPs|updated every 1 day
[botscout](http://iplists.firehol.org/?ipset=botscout)|[BotScout](http://botscout.com/) helps prevent automated web scripts, known as bots, from registering on forums, polluting databases, spreading spam, and abusing forms on web sites. They do this by tracking the names, IPs, and email addresses that bots use and logging them as unique signatures for future reference. They also provide a simple yet powerful API that you can use to test forms when they're submitted on your site. This list is composed of the most recently-caught bots.|ipv4 hash:ip|36 unique IPs|updated every 30 mins from [this link](http://botscout.com/last_caught_cache.htm)
[botscout_1d](http://iplists.firehol.org/?ipset=botscout_1d)|[BotScout](http://botscout.com/) helps prevent automated web scripts, known as bots, from registering on forums, polluting databases, spreading spam, and abusing forms on web sites. They do this by tracking the names, IPs, and email addresses that bots use and logging them as unique signatures for future reference. They also provide a simple yet powerful API that you can use to test forms when they're submitted on your site. This list is composed of the most recently-caught bots.|ipv4 hash:ip|1373 unique IPs|updated every 30 mins from [this link](http://botscout.com/last_caught_cache.htm)
[botscout_30d](http://iplists.firehol.org/?ipset=botscout_30d)|[BotScout](http://botscout.com/) helps prevent automated web scripts, known as bots, from registering on forums, polluting databases, spreading spam, and abusing forms on web sites. They do this by tracking the names, IPs, and email addresses that bots use and logging them as unique signatures for future reference. They also provide a simple yet powerful API that you can use to test forms when they're submitted on your site. This list is composed of the most recently-caught bots.|ipv4 hash:ip|18475 unique IPs|updated every 30 mins from [this link](http://botscout.com/last_caught_cache.htm)
[botscout_7d](http://iplists.firehol.org/?ipset=botscout_7d)|[BotScout](http://botscout.com/) helps prevent automated web scripts, known as bots, from registering on forums, polluting databases, spreading spam, and abusing forms on web sites. They do this by tracking the names, IPs, and email addresses that bots use and logging them as unique signatures for future reference. They also provide a simple yet powerful API that you can use to test forms when they're submitted on your site. This list is composed of the most recently-caught bots.|ipv4 hash:ip|6662 unique IPs|updated every 30 mins from [this link](http://botscout.com/last_caught_cache.htm)
[botvrij_dst](http://iplists.firehol.org/?ipset=botvrij_dst)|[botvrij.eu](http://www.botvrij.eu/) Indicators of Compromise (IOCS) about malicious destination IPs, gathered via open source information feeds (blog pages and PDF documents) and then consolidated into different datasets. To ensure the quality of the data all entries older than approx. 6 months are removed.|ipv4 hash:ip|56 unique IPs|updated every 1 day from [this link](http://www.botvrij.eu/data/ioclist.ip-dst.raw)
[botvrij_src](http://iplists.firehol.org/?ipset=botvrij_src)|[botvrij.eu](http://www.botvrij.eu/) Indicators of Compromise (IOCS) about malicious source IPs, gathered via open source information feeds (blog pages and PDF documents) and then consolidated into different datasets. To ensure the quality of the data all entries older than approx. 6 months are removed.|ipv4 hash:ip|0 unique IPs|updated every 1 day from [this link](http://www.botvrij.eu/data/ioclist.ip-src.raw)
[bruteforceblocker](http://iplists.firehol.org/?ipset=bruteforceblocker)|[danger.rulez.sk bruteforceblocker](http://danger.rulez.sk/index.php/bruteforceblocker/) (fail2ban alternative for SSH on OpenBSD). This is an automatically generated list from users reporting failed authentication attempts. An IP seems to be included if 3 or more users report it. Its retention pocily seems 30 days.|ipv4 hash:ip|961 unique IPs|updated every 3 hours from [this link](http://danger.rulez.sk/projects/bruteforceblocker/blist.php)
[ciarmy](http://iplists.firehol.org/?ipset=ciarmy)|[CIArmy.com](http://ciarmy.com/) IPs with poor Rogue Packet score that have not yet been identified as malicious by the community|ipv4 hash:ip|15000 unique IPs|updated every 3 hours from [this link](http://cinsscore.com/list/ci-badguys.txt)
[cidr_report_bogons](http://iplists.firehol.org/?ipset=cidr_report_bogons)|Unallocated (Free) Address Space, generated on a daily basis using the IANA registry files, the Regional Internet Registry stats files and the Regional Internet Registry whois data.|ipv4 hash:net|5780 subnets, 606128004 unique IPs|updated every 1 day from [this link](http://www.cidr-report.org/bogons/freespace-prefix.txt)
[cleanmx_phishing](http://iplists.firehol.org/?ipset=cleanmx_phishing)|[Clean-MX.de](http://support.clean-mx.de/) IPs sending phishing messages|ipv4 hash:ip|4519 unique IPs|updated every 30 mins from [this link](http://support.clean-mx.de/clean-mx/xmlphishing?response=alive&format=csv&domain=)
[cleanmx_viruses](http://iplists.firehol.org/?ipset=cleanmx_viruses)|[Clean-MX.de](http://support.clean-mx.de/clean-mx/viruses.php) IPs with viruses|ipv4 hash:ip|12190 unique IPs|updated every 30 mins from [this link](http://support.clean-mx.de/clean-mx/xmlviruses.php?response=alive&fields=ip)
[cleantalk](http://iplists.firehol.org/?ipset=cleantalk)|[CleanTalk](https://cleantalk.org/) Today's HTTP Spammers (includes: cleantalk_new cleantalk_updated)|ipv4 hash:ip|1 unique IPs|updated every 1 min
[cleantalk_1d](http://iplists.firehol.org/?ipset=cleantalk_1d)|[CleanTalk](https://cleantalk.org/) Today's HTTP Spammers (includes: cleantalk_new_1d cleantalk_updated_1d)|ipv4 hash:ip|504 unique IPs|updated every 1 min
[cleantalk_30d](http://iplists.firehol.org/?ipset=cleantalk_30d)|[CleanTalk](https://cleantalk.org/) Today's HTTP Spammers (includes: cleantalk_new_30d cleantalk_updated_30d)|ipv4 hash:ip|23387 unique IPs|updated every 1 min
[cleantalk_7d](http://iplists.firehol.org/?ipset=cleantalk_7d)|[CleanTalk](https://cleantalk.org/) Today's HTTP Spammers (includes: cleantalk_new_7d cleantalk_updated_7d)|ipv4 hash:ip|5753 unique IPs|updated every 1 min
[cleantalk_new](http://iplists.firehol.org/?ipset=cleantalk_new)|[CleanTalk](https://cleantalk.org/) Recent HTTP Spammers|ipv4 hash:ip|1 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/submited_today)
[cleantalk_new_1d](http://iplists.firehol.org/?ipset=cleantalk_new_1d)|[CleanTalk](https://cleantalk.org/) Recent HTTP Spammers|ipv4 hash:ip|501 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/submited_today)
[cleantalk_new_30d](http://iplists.firehol.org/?ipset=cleantalk_new_30d)|[CleanTalk](https://cleantalk.org/) Recent HTTP Spammers|ipv4 hash:ip|14501 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/submited_today)
[cleantalk_new_7d](http://iplists.firehol.org/?ipset=cleantalk_new_7d)|[CleanTalk](https://cleantalk.org/) Recent HTTP Spammers|ipv4 hash:ip|3501 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/submited_today)
[cleantalk_top20](http://iplists.firehol.org/?ipset=cleantalk_top20)|[CleanTalk](https://cleantalk.org/) Top 20 HTTP Spammers|ipv4 hash:ip|20 unique IPs|updated every 1 day from [this link](https://cleantalk.org/blacklists/top20)
[cleantalk_updated](http://iplists.firehol.org/?ipset=cleantalk_updated)|[CleanTalk](https://cleantalk.org/) Recurring HTTP Spammers|ipv4 hash:ip|1 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/updated_today)
[cleantalk_updated_1d](http://iplists.firehol.org/?ipset=cleantalk_updated_1d)|[CleanTalk](https://cleantalk.org/) Recurring HTTP Spammers|ipv4 hash:ip|501 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/updated_today)
[cleantalk_updated_30d](http://iplists.firehol.org/?ipset=cleantalk_updated_30d)|[CleanTalk](https://cleantalk.org/) Recurring HTTP Spammers|ipv4 hash:ip|11293 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/updated_today)
[cleantalk_updated_7d](http://iplists.firehol.org/?ipset=cleantalk_updated_7d)|[CleanTalk](https://cleantalk.org/) Recurring HTTP Spammers|ipv4 hash:ip|3055 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/updated_today)
[coinbl_hosts](http://iplists.firehol.org/?ipset=coinbl_hosts)|[CoinBlockerLists](https://gitlab.com/ZeroDot1/CoinBlockerLists) Simple lists that can help prevent cryptomining in the browser or other applications. This list contains all domains - A list for administrators to prevent mining in networks. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|9065 unique IPs|updated every 1 day from [this link](https://zerodot1.gitlab.io/CoinBlockerLists/hosts)
[coinbl_hosts_browser](http://iplists.firehol.org/?ipset=coinbl_hosts_browser)|[CoinBlockerLists](https://gitlab.com/ZeroDot1/CoinBlockerLists) Simple lists that can help prevent cryptomining in the browser or other applications. A hosts list to prevent browser mining only. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|811 unique IPs|updated every 1 day from [this link](https://zerodot1.gitlab.io/CoinBlockerLists/hosts_browser)
[coinbl_hosts_optional](http://iplists.firehol.org/?ipset=coinbl_hosts_optional)|[CoinBlockerLists](https://gitlab.com/ZeroDot1/CoinBlockerLists) Simple lists that can help prevent cryptomining in the browser or other applications. This list contains additional domains, for administrators to prevent mining in networks. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|510 unique IPs|updated every 1 day from [this link](https://zerodot1.gitlab.io/CoinBlockerLists/hosts_optional)
[coinbl_ips](http://iplists.firehol.org/?ipset=coinbl_ips)|[CoinBlockerLists](https://gitlab.com/ZeroDot1/CoinBlockerLists) Simple lists that can help prevent cryptomining in the browser or other applications. This list contains all IPs - An additional list for administrators to prevent mining in networks. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|1390 unique IPs|updated every 1 day from [this link](https://zerodot1.gitlab.io/CoinBlockerLists/MiningServerIPList.txt)
[cruzit_web_attacks](http://iplists.firehol.org/?ipset=cruzit_web_attacks)|[CruzIt.com](http://www.cruzit.com/wbl.php) IPs of compromised machines scanning for vulnerabilities and DDOS attacks|ipv4 hash:ip|10711 unique IPs|updated every 12 hours from [this link](http://www.cruzit.com/xwbl2txt.php)
[cta_cryptowall](http://iplists.firehol.org/?ipset=cta_cryptowall)|[Cyber Threat Alliance](http://www.cyberthreatalliance.org/cryptowall-dashboard.html) CryptoWall is one of the most lucrative and broad-reaching ransomware campaigns affecting Internet users today. Sharing intelligence and analysis resources, the CTA profiled the latest version of CryptoWall, which impacted hundreds of thousands of users, resulting in over US $325 million in damages worldwide.|ipv4 hash:ip|1360 unique IPs|updated every 1 day from [this link](https://public.tableau.com/views/CTAOnlineViz/DashboardData.csv?:embed=y&:showVizHome=no&:showTabs=y&:display_count=y&:display_static_image=y&:bootstrapWhenNotified=true)
[cybercrime](http://iplists.firehol.org/?ipset=cybercrime)|[CyberCrime](http://cybercrime-tracker.net/) A project tracking Command and Control.|ipv4 hash:ip|3684 unique IPs|updated every 12 hours from [this link](http://cybercrime-tracker.net/fuckerz.php)
[darklist_de](http://iplists.firehol.org/?ipset=darklist_de)|[darklist.de](http://www.darklist.de/) ssh fail2ban reporting|ipv4 hash:net|8893 subnets, 673485 unique IPs|updated every 1 day from [this link](http://www.darklist.de/raw.php)
[datacenters](http://iplists.firehol.org/?ipset=datacenters)|[Nick Galbreath](https://github.com/client9/ipcat) This is a list of IPv4 address that correspond to datacenters, co-location centers, shared and virtual webhosting providers. In other words, ip addresses that end web consumers should not be using.|ipv4 hash:net|4224 subnets, 95959476 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/client9/ipcat/master/datacenters.csv)
[dataplane_dnsrd](http://iplists.firehol.org/?ipset=dataplane_dnsrd)|[DataPlane.org](https://dataplane.org/) IP addresses that have been identified as sending recursive DNS queries to a remote host. This report lists addresses that may be cataloging open DNS resolvers or evaluating cache entries.|ipv4 hash:ip|9 unique IPs|updated every 1 hour
[dataplane_dnsrdany](http://iplists.firehol.org/?ipset=dataplane_dnsrdany)|[DataPlane.org](https://dataplane.org/) IP addresses that have been identified as sending recursive DNS IN ANY queries to a remote host. This report lists addresses that may be cataloging open DNS resolvers for the purpose of later using them to facilitate DNS amplification and reflection attacks.|ipv4 hash:ip|1 unique IPs|updated every 1 hour
[dataplane_dnsversion](http://iplists.firehol.org/?ipset=dataplane_dnsversion)|[DataPlane.org](https://dataplane.org/) IP addresses that have been identified as sending DNS CH TXT VERSION.BIND queries to a remote host. This report lists addresses that may be cataloging DNS software.|ipv4 hash:ip|2 unique IPs|updated every 1 hour
[dataplane_sipinvitation](http://iplists.firehol.org/?ipset=dataplane_sipinvitation)|[DataPlane.org](https://dataplane.org/) IP addresses that have been seen initiating a SIP INVITE operation to a remote host. This report lists hosts that are suspicious of more than just port scanning. These hosts may be SIP client cataloging or conducting various forms of telephony abuse.|ipv4 hash:ip|5 unique IPs|updated every 1 hour
[dataplane_sipquery](http://iplists.firehol.org/?ipset=dataplane_sipquery)|[DataPlane.org](https://dataplane.org/) IP addresses that has been seen initiating a SIP OPTIONS query to a remote host. This report lists hosts that are suspicious of more than just port scanning. These hosts may be SIP server cataloging or conducting various forms of telephony abuse.|ipv4 hash:ip|33 unique IPs|updated every 1 hour
[dataplane_sipregistration](http://iplists.firehol.org/?ipset=dataplane_sipregistration)|[DataPlane.org](https://dataplane.org/) IP addresses that have been seen initiating a SIP REGISTER operation to a remote host. This report lists hosts that are suspicious of more than just port scanning. These hosts may be SIP client cataloging or conducting various forms of telephony abuse.|ipv4 hash:ip|4 unique IPs|updated every 1 hour
[dataplane_sshclient](http://iplists.firehol.org/?ipset=dataplane_sshclient)|[DataPlane.org](https://dataplane.org/) IP addresses that has been seen initiating an SSH connection to a remote host. This report lists hosts that are suspicious of more than just port scanning. These hosts may be SSH server cataloging or conducting authentication attack attempts.|ipv4 hash:ip|2548 unique IPs|updated every 1 hour
[dataplane_sshpwauth](http://iplists.firehol.org/?ipset=dataplane_sshpwauth)|[DataPlane.org](https://dataplane.org/) IP addresses that has been seen attempting to remotely login to a host using SSH password authentication. This report lists hosts that are highly suspicious and are likely conducting malicious SSH password authentication attacks.|ipv4 hash:ip|2394 unique IPs|updated every 1 hour
[dataplane_vncrfb](http://iplists.firehol.org/?ipset=dataplane_vncrfb)|[DataPlane.org](https://dataplane.org/) IP addresses that have been seen initiating a VNC remote frame buffer (RFB) session to a remote host. This report lists hosts that are suspicious of more than just port scanning. These hosts may be VNC server cataloging or conducting various forms of remote access abuse.|ipv4 hash:ip|175 unique IPs|updated every 1 hour
[dm_tor](http://iplists.firehol.org/?ipset=dm_tor)|[dan.me.uk](https://www.dan.me.uk) dynamic list of TOR nodes|ipv4 hash:ip|6430 unique IPs|updated every 30 mins from [this link](https://www.dan.me.uk/torlist/)
[dronebl_anonymizers](http://iplists.firehol.org/?ipset=dronebl_anonymizers)|[DroneBL.org](https://dronebl.org) List of open proxies. It includes IPs which DroneBL categorizes as SOCKS proxies (8), HTTP proxies (9), web page proxies (11), WinGate proxies (14), proxy chains (10).|ipv4 hash:net|1150711 subnets, 1264261 unique IPs|updated every 1 min
[dronebl_auto_botnets](http://iplists.firehol.org/?ipset=dronebl_auto_botnets)|[DroneBL.org](https://dronebl.org) IPs of automatically detected botnets. It includes IPs for which DroneBL responds with 17.|ipv4 hash:net|10836 subnets, 10947 unique IPs|updated every 1 min
[dronebl_autorooting_worms](http://iplists.firehol.org/?ipset=dronebl_autorooting_worms)|[DroneBL.org](https://dronebl.org) IPs of autorooting worms. It includes IPs for which DroneBL responds with 16. These are usually SSH bruteforce attacks.|ipv4 hash:net|1557 subnets, 1664 unique IPs|updated every 1 min
[dronebl_compromised](http://iplists.firehol.org/?ipset=dronebl_compromised)|[DroneBL.org](https://dronebl.org) IPs of compromised routers / gateways. It includes IPs for which DroneBL responds with 15 (BOPM detected).|ipv4 hash:net|56462 subnets, 57362 unique IPs|updated every 1 min
[dronebl_ddos_drones](http://iplists.firehol.org/?ipset=dronebl_ddos_drones)|[DroneBL.org](https://dronebl.org) IPs of DDoS drones. It includes IPs for which DroneBL responds with 7.|ipv4 hash:net|459 subnets, 462 unique IPs|updated every 1 min
[dronebl_dns_mx_on_irc](http://iplists.firehol.org/?ipset=dronebl_dns_mx_on_irc)|[DroneBL.org](https://dronebl.org) List of IPs of DNS / MX hostname detected on IRC. It includes IPs for which DroneBL responds with 18.|ipv4 hash:net|501 subnets, 506 unique IPs|updated every 1 min
[dronebl_irc_drones](http://iplists.firehol.org/?ipset=dronebl_irc_drones)|[DroneBL.org](https://dronebl.org) List of IRC spam drones (litmus/sdbot/fyle). It includes IPs for which DroneBL responds with 3.|ipv4 hash:net|362330 subnets, 371190 unique IPs|updated every 1 min
[dronebl_unknown](http://iplists.firehol.org/?ipset=dronebl_unknown)|[DroneBL.org](https://dronebl.org) List of IPs of uncategorized threats. It includes IPs for which DroneBL responds with 255.|ipv4 hash:net|4 subnets, 4 unique IPs|updated every 1 min
[dronebl_worms_bots](http://iplists.firehol.org/?ipset=dronebl_worms_bots)|[DroneBL.org](https://dronebl.org) IPs of unknown worms or spambots. It includes IPs for which DroneBL responds with 6|ipv4 hash:net|123330 subnets, 132820 unique IPs|updated every 1 min
[dshield](http://iplists.firehol.org/?ipset=dshield)|[DShield.org](https://dshield.org/) top 20 attacking class C (/24) subnets over the last three days|ipv4 hash:net|19 subnets, 5120 unique IPs|updated every 10 mins from [this link](http://feeds.dshield.org/block.txt)
[dshield_1d](http://iplists.firehol.org/?ipset=dshield_1d)|[DShield.org](https://dshield.org/) top 20 attacking class C (/24) subnets over the last three days|ipv4 hash:net|24 subnets, 6656 unique IPs|updated every 10 mins from [this link](http://feeds.dshield.org/block.txt)
[dshield_30d](http://iplists.firehol.org/?ipset=dshield_30d)|[DShield.org](https://dshield.org/) top 20 attacking class C (/24) subnets over the last three days|ipv4 hash:net|84 subnets, 24064 unique IPs|updated every 10 mins from [this link](http://feeds.dshield.org/block.txt)
[dshield_7d](http://iplists.firehol.org/?ipset=dshield_7d)|[DShield.org](https://dshield.org/) top 20 attacking class C (/24) subnets over the last three days|ipv4 hash:net|46 subnets, 12544 unique IPs|updated every 10 mins from [this link](http://feeds.dshield.org/block.txt)
[dshield_top_1000](http://iplists.firehol.org/?ipset=dshield_top_1000)|[DShield.org](https://dshield.org/) top 1000 attacking hosts in the last 30 days|ipv4 hash:ip|867 unique IPs|updated every 1 hour from [this link](https://isc.sans.edu/api/sources/attacks/1000/)
[dyndns_ponmocup](http://iplists.firehol.org/?ipset=dyndns_ponmocup)|[DynDNS.org](http://security-research.dyndns.org/pub/malware-feeds/) Ponmocup. The malware powering the botnet has been around since 2006 and it’s known under various names, including Ponmocup, Vundo, Virtumonde, Milicenso and Swisyn. It has been used for ad fraud, data theft and downloading additional threats to infected systems. Ponmocup is one of the largest currently active and, with nine consecutive years, also one of the longest running, but it is rarely noticed as the operators take care to keep it operating under the radar.|ipv4 hash:ip|70 unique IPs|updated every 1 day from [this link](http://security-research.dyndns.org/pub/malware-feeds/ponmocup-infected-domains-shadowserver.csv)
[esentire_14072015_com](http://iplists.firehol.org/?ipset=esentire_14072015_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|579 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/14072015.com_watch_ip.lst)
[esentire_14072015q_com](http://iplists.firehol.org/?ipset=esentire_14072015q_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|575 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/14072015q.com_watch_ip.lst)
[esentire_22072014a_com](http://iplists.firehol.org/?ipset=esentire_22072014a_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|1290 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/22072014a.com_watch_ip.lst)
[esentire_22072014b_com](http://iplists.firehol.org/?ipset=esentire_22072014b_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|1288 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/22072014b.com_watch_ip.lst)
[esentire_22072014c_com](http://iplists.firehol.org/?ipset=esentire_22072014c_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|1289 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/22072014c.com_watch_ip.lst)
[esentire_atomictrivia_ru](http://iplists.firehol.org/?ipset=esentire_atomictrivia_ru)|Andromeda/Gamarue Checkin|ipv4 hash:ip|7 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/atomictrivia.ru_watch_ip.lst)
[esentire_auth_update_ru](http://iplists.firehol.org/?ipset=esentire_auth_update_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|1306 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/auth-update.ru_watch_ip.lst)
[esentire_burmundisoul_ru](http://iplists.firehol.org/?ipset=esentire_burmundisoul_ru)|Ursnif Variant CnC|ipv4 hash:ip|2551 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/burmundisoul.ru_watch_ip.lst)
[esentire_crazyerror_su](http://iplists.firehol.org/?ipset=esentire_crazyerror_su)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|18613 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/crazyerror.su_watch_ip.lst)
[esentire_dagestanskiiviskis_ru](http://iplists.firehol.org/?ipset=esentire_dagestanskiiviskis_ru)|Ursnif Variant CnC|ipv4 hash:ip|517 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/dagestanskiiviskis.ru_watch_ip.lst)
[esentire_differentia_ru](http://iplists.firehol.org/?ipset=esentire_differentia_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|12 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/differentia.ru_watch_ip.lst)
[esentire_disorderstatus_ru](http://iplists.firehol.org/?ipset=esentire_disorderstatus_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|7 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/disorderstatus.ru_watch_ip.lst)
[esentire_dorttlokolrt_com](http://iplists.firehol.org/?ipset=esentire_dorttlokolrt_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|23664 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/dorttlokolrt.com_watch_ip.lst)
[esentire_downs1_ru](http://iplists.firehol.org/?ipset=esentire_downs1_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|7231 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/downs1.ru_watch_ip.lst)
[esentire_ebankoalalusys_ru](http://iplists.firehol.org/?ipset=esentire_ebankoalalusys_ru)|Ursnif Variant CnC|ipv4 hash:ip|898 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/ebankoalalusys.ru_watch_ip.lst)
[esentire_emptyarray_ru](http://iplists.firehol.org/?ipset=esentire_emptyarray_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|20139 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/emptyarray.ru_watch_ip.lst)
[esentire_fioartd_com](http://iplists.firehol.org/?ipset=esentire_fioartd_com)|Andromeda/Gamarue Checkin|ipv4 hash:ip|601 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/fioartd.com_watch_ip.lst)
[esentire_getarohirodrons_com](http://iplists.firehol.org/?ipset=esentire_getarohirodrons_com)|Andromeda/Gamarue Checkin|ipv4 hash:ip|2156 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/getarohirodrons.com_watch_ip.lst)
[esentire_hasanhashsde_ru](http://iplists.firehol.org/?ipset=esentire_hasanhashsde_ru)|Ursnif Variant CnC|ipv4 hash:ip|1184 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/hasanhashsde.ru_watch_ip.lst)
[esentire_inleet_ru](http://iplists.firehol.org/?ipset=esentire_inleet_ru)|Ursnif Variant CnC|ipv4 hash:ip|4219 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/inleet.ru_watch_ip.lst)
[esentire_islamislamdi_ru](http://iplists.firehol.org/?ipset=esentire_islamislamdi_ru)|Ursnif Variant CnC|ipv4 hash:ip|673 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/islamislamdi.ru_watch_ip.lst)
[esentire_krnqlwlplttc_com](http://iplists.firehol.org/?ipset=esentire_krnqlwlplttc_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|2 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/krnqlwlplttc.com_watch_ip.lst)
[esentire_maddox1_ru](http://iplists.firehol.org/?ipset=esentire_maddox1_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|11345 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/maddox1.ru_watch_ip.lst)
[esentire_manning1_ru](http://iplists.firehol.org/?ipset=esentire_manning1_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|6824 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/manning1.ru_watch_ip.lst)
[esentire_misteryherson_ru](http://iplists.firehol.org/?ipset=esentire_misteryherson_ru)|Ursnif Variant CnC|ipv4 hash:ip|176 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/misteryherson.ru_watch_ip.lst)
[esentire_mysebstarion_ru](http://iplists.firehol.org/?ipset=esentire_mysebstarion_ru)|Ursnif Variant CnC|ipv4 hash:ip|1058 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/mysebstarion.ru_watch_ip.lst)
[esentire_smartfoodsglutenfree_kz](http://iplists.firehol.org/?ipset=esentire_smartfoodsglutenfree_kz)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|2674 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/smartfoodsglutenfree.kz_watch_ip.lst)
[esentire_venerologvasan93_ru](http://iplists.firehol.org/?ipset=esentire_venerologvasan93_ru)|Ursnif Variant CnC|ipv4 hash:ip|1263 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/venerologvasan93.ru_watch_ip.lst)
[esentire_volaya_ru](http://iplists.firehol.org/?ipset=esentire_volaya_ru)|Win32/PSW.Papras.CK CnC|ipv4 hash:ip|5080 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/volaya.ru_watch_ip.lst)
[et_block](http://iplists.firehol.org/?ipset=et_block)|[EmergingThreats.net](http://www.emergingthreats.net/) default blacklist (at the time of writing includes spamhaus DROP, dshield and abuse.ch trackers, which are available separately too - prefer to use the direct ipsets instead of this, they seem to lag a bit in updates)|ipv4 hash:net|1407 subnets, 19307389 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt)
[et_botcc](http://iplists.firehol.org/?ipset=et_botcc)|[EmergingThreats.net Command and Control IPs](http://doc.emergingthreats.net/bin/view/Main/BotCC) These IPs are updates every 24 hours and should be considered VERY highly reliable indications that a host is communicating with a known and active Bot or Malware command and control server - (although they say this includes abuse.ch trackers, it does not - check its overlaps)|ipv4 hash:ip|53 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/fwrules/emerging-PIX-CC.rules)
[et_compromised](http://iplists.firehol.org/?ipset=et_compromised)|[EmergingThreats.net compromised hosts](http://doc.emergingthreats.net/bin/view/Main/CompromisedHost)|ipv4 hash:ip|1211 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/blockrules/compromised-ips.txt)
[et_dshield](http://iplists.firehol.org/?ipset=et_dshield)|[EmergingThreats.net](http://www.emergingthreats.net/) dshield blocklist|ipv4 hash:net|19 subnets, 5120 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/fwrules/emerging-PIX-DSHIELD.rules)
[et_spamhaus](http://iplists.firehol.org/?ipset=et_spamhaus)|[EmergingThreats.net](http://www.emergingthreats.net/) spamhaus blocklist|ipv4 hash:net|758 subnets, 19301888 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/fwrules/emerging-PIX-DROP.rules)
[et_tor](http://iplists.firehol.org/?ipset=et_tor)|[EmergingThreats.net TOR list](http://doc.emergingthreats.net/bin/view/Main/TorRules) of TOR network IPs|ipv4 hash:ip|6519 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/blockrules/emerging-tor.rules)
[feodo](http://iplists.firehol.org/?ipset=feodo)|[Abuse.ch Feodo tracker](https://feodotracker.abuse.ch) trojan includes IPs which are being used by Feodo (also known as Cridex or Bugat) which commits ebanking fraud|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://feodotracker.abuse.ch/blocklist/?download=ipblocklist)
[feodo_badips](http://iplists.firehol.org/?ipset=feodo_badips)|[Abuse.ch Feodo tracker BadIPs](https://feodotracker.abuse.ch) The Feodo Tracker Feodo BadIP Blocklist only contains IP addresses (IPv4) used as C&C communication channel by the Feodo Trojan version B. These IP addresses are usually servers rented by cybercriminals directly and used for the exclusive purpose of hosting a Feodo C&C server. Hence you should expect no legit traffic to those IP addresses. The site highly recommends you to block/drop any traffic towards any Feodo C&C using the Feodo BadIP Blocklist. Please consider that this blocklist only contains IP addresses used by version B of the Feodo Trojan. C&C communication channels used by version A, version C and version D are not covered by this blocklist.|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://feodotracker.abuse.ch/blocklist/?download=badips)
[firehol_abusers_1d](http://iplists.firehol.org/?ipset=firehol_abusers_1d)|An ipset made from blocklists that track abusers in the last 24 hours. (includes: botscout_1d cleantalk_new_1d cleantalk_updated_1d php_commenters_1d php_dictionary_1d php_harvesters_1d php_spammers_1d stopforumspam_1d)|ipv4 hash:net|7963 subnets, 8343 unique IPs|updated every 1 min
[firehol_abusers_30d](http://iplists.firehol.org/?ipset=firehol_abusers_30d)|An ipset made from blocklists that track abusers in the last 30 days. (includes: cleantalk_new_30d cleantalk_updated_30d php_commenters_30d php_dictionary_30d php_harvesters_30d php_spammers_30d stopforumspam sblam)|ipv4 hash:net|155511 subnets, 165466 unique IPs|updated every 1 min
[firehol_anonymous](http://iplists.firehol.org/?ipset=firehol_anonymous)|An ipset that includes all the anonymizing IPs of the world. (includes: anonymous bm_tor dm_tor firehol_proxies tor_exits)|ipv4 hash:net|1443974 subnets, 1479253 unique IPs|updated every 1 min
[firehol_level1](http://iplists.firehol.org/?ipset=firehol_level1)|A firewall blacklist composed from IP lists, providing maximum protection with minimum false positives. Suitable for basic protection on all internet facing servers, routers and firewalls. (includes: bambenek_c2 dshield feodo fullbogons spamhaus_drop spamhaus_edrop sslbl zeus_badips ransomware_rw)|ipv4 hash:net|2576 subnets, 619725023 unique IPs|updated every 1 min
[firehol_level2](http://iplists.firehol.org/?ipset=firehol_level2)|An ipset made from blocklists that track attacks, during about the last 48 hours. (includes: blocklist_de dshield_1d greensnow)|ipv4 hash:net|17461 subnets, 32355 unique IPs|updated every 1 min
[firehol_level3](http://iplists.firehol.org/?ipset=firehol_level3)|An ipset made from blocklists that track attacks, spyware, viruses. It includes IPs than have been reported or detected in the last 30 days. (includes: bruteforceblocker ciarmy dshield_30d dshield_top_1000 malc0de maxmind_proxy_fraud myip shunlist snort_ipfilter sslbl_aggressive talosintel_ipfilter zeus vxvault)|ipv4 hash:net|17813 subnets, 42599 unique IPs|updated every 1 min
[firehol_level4](http://iplists.firehol.org/?ipset=firehol_level4)|An ipset made from blocklists that track attacks, but may include a large number of false positives. (includes: blocklist_net_ua botscout_30d cruzit_web_attacks cybercrime haley_ssh iblocklist_hijacked iblocklist_spyware iblocklist_webexploit ipblacklistcloud_top iw_wormlist malwaredomainlist)|ipv4 hash:net|157400 subnets, 9310085 unique IPs|updated every 1 min
[firehol_proxies](http://iplists.firehol.org/?ipset=firehol_proxies)|An ipset made from all sources that track open proxies. It includes IPs reported or detected in the last 30 days. (includes: iblocklist_proxies maxmind_proxy_fraud ip2proxy_px1lite proxylists_30d proxyrss_30d proxz_30d ri_connect_proxies_30d ri_web_proxies_30d socks_proxy_30d sslproxies_30d xroxy_30d)|ipv4 hash:net|1435000 subnets, 1464001 unique IPs|updated every 1 min
[firehol_webclient](http://iplists.firehol.org/?ipset=firehol_webclient)|An IP blacklist made from blocklists that track IPs that a web client should never talk to. This list is to be used on top of firehol_level1. (includes: ransomware_online sslbl_aggressive cybercrime dyndns_ponmocup maxmind_proxy_fraud)|ipv4 hash:net|4162 subnets, 4329 unique IPs|updated every 1 min
[firehol_webserver](http://iplists.firehol.org/?ipset=firehol_webserver)|A web server IP blacklist made from blocklists that track IPs that should never be used by your web users. (This list includes IPs that are servers hosting malware, bots, etc or users having a long criminal history. This list is to be used on top of firehol_level1, firehol_level2, firehol_level3 and possibly firehol_proxies or firehol_anonymous). (includes: maxmind_proxy_fraud myip pushing_inertia_blocklist stopforumspam_toxic)|ipv4 hash:net|1835 subnets, 34672207 unique IPs|updated every 1 min
[fullbogons](http://iplists.firehol.org/?ipset=fullbogons)|[Team-Cymru.org](http://www.team-cymru.org) IP space that has been allocated to an RIR, but not assigned by that RIR to an actual ISP or other end-user|ipv4 hash:net|1304 subnets, 599494656 unique IPs|updated every 1 day
geolite2_asn|[MaxMind GeoLite2 ASN](https://dev.maxmind.com/geoip/geoip2/geolite2/)|ipv4 hash:net|disabled|updated every 7 days from [this link](http://geolite.maxmind.com/download/geoip/database/GeoLite2-ASN-CSV.zip)
[geolite2_country](https://github.com/firehol/blocklist-ipsets/tree/master/geolite2_country)|[MaxMind GeoLite2](http://dev.maxmind.com/geoip/geoip2/geolite2/) databases are free IP geolocation databases comparable to, but less accurate than, MaxMind’s GeoIP2 databases. They include IPs per country, IPs per continent, IPs used by anonymous services (VPNs, Proxies, etc) and Satellite Providers.|ipv4 hash:net|All the world|updated every 7 days from [this link](http://geolite.maxmind.com/download/geoip/database/GeoLite2-Country-CSV.zip)
[gofferje_sip](http://iplists.firehol.org/?ipset=gofferje_sip)|[Stefan Gofferje](http://stefan.gofferje.net/it-stuff/sipfraud/sip-attacker-blacklist) A personal blacklist of networks and IPs of SIP attackers. To end up here, the IP or network must have been the origin of considerable and repeated attacks on my PBX and additionally, the ISP didn't react to any complaint. Note from the author: I don't give any guarantees of accuracy, completeness or even usability! USE AT YOUR OWN RISK! Also note that I block complete countries, namely China, Korea and Palestine with blocklists from ipdeny.com, so some attackers will never even get the chance to get noticed by me to be put on this blacklist. I also don't accept any liabilities related to this blocklist. If you're an ISP and don't like your IPs being listed here, too bad! You should have done something about your customers' behavior and reacted to my complaints. This blocklist is nothing but an expression of my personal opinion and exercising my right of free speech.|ipv4 hash:net|3771 subnets, 1097808 unique IPs|updated every 6 hours from [this link](http://stefan.gofferje.net/sipblocklist.zone)
[gpf_comics](http://iplists.firehol.org/?ipset=gpf_comics)|The GPF DNS Block List is a list of IP addresses on the Internet that have attacked the [GPF Comics](http://www.gpf-comics.com/) family of Web sites. IPs on this block list have been banned from accessing all of our servers because they were caught in the act of spamming, attempting to exploit our scripts, scanning for vulnerabilities, or consuming resources to the detriment of our human visitors.|ipv4 hash:ip|2887 unique IPs|updated every 1 day from [this link](https://www.gpf-comics.com/dnsbl/export.php)
[graphiclineweb](http://iplists.firehol.org/?ipset=graphiclineweb)|[GraphiclineWeb](https://graphiclineweb.wordpress.com/tech-notes/ip-blacklist/) The IP’s, Hosts and Domains listed in this table are banned universally from accessing websites controlled by the maintainer. Some form of bad activity has been seen from the addresses listed. Bad activity includes: unwanted spiders, rule breakers, comment spammers, trackback spammers, spambots, hacker bots, registration bots and other scripting attackers, harvesters, nuisance spiders, spy bots and organizations spying on websites for commercial reasons.|ipv4 hash:net|2579 subnets, 330527 unique IPs|updated every 1 day from [this link](https://graphiclineweb.wordpress.com/tech-notes/ip-blacklist/)
[greensnow](http://iplists.firehol.org/?ipset=greensnow)|[GreenSnow](https://greensnow.co/) is a team harvesting a large number of IPs from different computers located around the world. GreenSnow is comparable with SpamHaus.org for attacks of any kind except for spam. Their list is updated automatically and you can withdraw at any time your IP address if it has been listed. Attacks / bruteforce that are monitored are: Scan Port, FTP, POP3, mod_security, IMAP, SMTP, SSH, cPanel, etc.|ipv4 hash:ip|3241 unique IPs|updated every 30 mins from [this link](http://blocklist.greensnow.co/greensnow.txt)
[haley_ssh](http://iplists.firehol.org/?ipset=haley_ssh)|[Charles Haley](http://charles.the-haleys.org) IPs launching SSH dictionary attacks.|ipv4 hash:ip|83324 unique IPs|updated every 4 hours from [this link](http://charles.the-haleys.org/ssh_dico_attack_hdeny_format.php/hostsdeny.txt)
[hphosts_ats](http://iplists.firehol.org/?ipset=hphosts_ats)|[hpHosts](http://hosts-file.net/?s=Download) ad/tracking servers listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|13037 unique IPs|updated every 1 day from [this link](http://hosts-file.net/ad_servers.txt)
[hphosts_emd](http://iplists.firehol.org/?ipset=hphosts_emd)|[hpHosts](http://hosts-file.net/?s=Download) malware sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|59204 unique IPs|updated every 1 day from [this link](http://hosts-file.net/emd.txt)
[hphosts_exp](http://iplists.firehol.org/?ipset=hphosts_exp)|[hpHosts](http://hosts-file.net/?s=Download) exploit sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|196 unique IPs|updated every 1 day from [this link](http://hosts-file.net/exp.txt)
[hphosts_fsa](http://iplists.firehol.org/?ipset=hphosts_fsa)|[hpHosts](http://hosts-file.net/?s=Download) fraud sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|24764 unique IPs|updated every 1 day from [this link](http://hosts-file.net/fsa.txt)
[hphosts_grm](http://iplists.firehol.org/?ipset=hphosts_grm)|[hpHosts](http://hosts-file.net/?s=Download) sites involved in spam (that do not otherwise meet any other classification criteria) listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|293 unique IPs|updated every 1 day from [this link](http://hosts-file.net/grm.txt)
[hphosts_hfs](http://iplists.firehol.org/?ipset=hphosts_hfs)|[hpHosts](http://hosts-file.net/?s=Download) sites spamming the hpHosts forums (and not meeting any other classification criteria) listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|245 unique IPs|updated every 1 day from [this link](http://hosts-file.net/hfs.txt)
[hphosts_hjk](http://iplists.firehol.org/?ipset=hphosts_hjk)|[hpHosts](http://hosts-file.net/?s=Download) hijack sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|152 unique IPs|updated every 1 day from [this link](http://hosts-file.net/hjk.txt)
[hphosts_mmt](http://iplists.firehol.org/?ipset=hphosts_mmt)|[hpHosts](http://hosts-file.net/?s=Download) sites involved in misleading marketing (e.g. fake Flash update adverts) listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|960 unique IPs|updated every 1 day from [this link](http://hosts-file.net/mmt.txt)
[hphosts_pha](http://iplists.firehol.org/?ipset=hphosts_pha)|[hpHosts](http://hosts-file.net/?s=Download) illegal pharmacy sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|2474 unique IPs|updated every 1 day from [this link](http://hosts-file.net/pha.txt)
[hphosts_psh](http://iplists.firehol.org/?ipset=hphosts_psh)|[hpHosts](http://hosts-file.net/?s=Download) phishing sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|44781 unique IPs|updated every 1 day from [this link](http://hosts-file.net/psh.txt)
[hphosts_wrz](http://iplists.firehol.org/?ipset=hphosts_wrz)|[hpHosts](http://hosts-file.net/?s=Download) warez/piracy sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|905 unique IPs|updated every 1 day from [this link](http://hosts-file.net/wrz.txt)
[iblocklist_abuse_palevo](http://iplists.firehol.org/?ipset=iblocklist_abuse_palevo)|palevotracker.abuse.ch IP blocklist.|ipv4 hash:net|12 subnets, 12 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=erqajhwrxiuvjxqrrwfj&fileformat=p2p&archiveformat=gz)
[iblocklist_abuse_spyeye](http://iplists.firehol.org/?ipset=iblocklist_abuse_spyeye)|spyeyetracker.abuse.ch IP blocklist.|ipv4 hash:net|83 subnets, 84 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=zvjxsfuvdhoxktpeiokq&fileformat=p2p&archiveformat=gz)
[iblocklist_abuse_zeus](http://iplists.firehol.org/?ipset=iblocklist_abuse_zeus)|zeustracker.abuse.ch IP blocklist that contains IP addresses which are currently beeing tracked on the abuse.ch ZeuS Tracker.|ipv4 hash:net|209 subnets, 212 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=ynkdjqsjyfmilsgbogqf&fileformat=p2p&archiveformat=gz)
[iblocklist_ads](http://iplists.firehol.org/?ipset=iblocklist_ads)|Advertising trackers and a short list of bad/intrusive porn sites.|ipv4 hash:net|3389 subnets, 888968 unique IPs|updated every 12 hours
[iblocklist_badpeers](http://iplists.firehol.org/?ipset=iblocklist_badpeers)|IPs that have been reported for bad deeds in p2p.|ipv4 hash:net|48578 subnets, 1569289 unique IPs|updated every 12 hours
[iblocklist_bogons](http://iplists.firehol.org/?ipset=iblocklist_bogons)|Unallocated address space.|ipv4 hash:net|2691 subnets, 643576487 unique IPs|updated every 12 hours
[iblocklist_ciarmy_malicious](http://iplists.firehol.org/?ipset=iblocklist_ciarmy_malicious)|ciarmy.com IP blocklist. Based on information from a network of Sentinel devices deployed around the world, they compile a list of known bad IP addresses. Sentinel devices are uniquely positioned to pick up traffic from bad guys without requiring any type of signature-based or rate-based identification. If an IP is identified in this way by a significant number of Sentinels, the IP is malicious and should be blocked.|ipv4 hash:net|14679 subnets, 15000 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=npkuuhuxcsllnhoamkvm&fileformat=p2p&archiveformat=gz)
[iblocklist_cidr_report_bogons](http://iplists.firehol.org/?ipset=iblocklist_cidr_report_bogons)|cidr-report.org IP list of Unallocated address space.|ipv4 hash:net|5784 subnets, 606141316 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=lujdnbasfaaixitgmxpp&fileformat=p2p&archiveformat=gz)
[iblocklist_cruzit_web_attacks](http://iplists.firehol.org/?ipset=iblocklist_cruzit_web_attacks)|CruzIT IP list with individual IP addresses of compromised machines scanning for vulnerabilities and DDOS attacks.|ipv4 hash:net|9398 subnets, 9592 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=czvaehmjpsnwwttrdoyl&fileformat=p2p&archiveformat=gz)
[iblocklist_dshield](http://iplists.firehol.org/?ipset=iblocklist_dshield)|known Hackers and such people.|ipv4 hash:net|16 subnets, 2566 unique IPs|updated every 12 hours
[iblocklist_edu](http://iplists.firehol.org/?ipset=iblocklist_edu)|IPs used by Educational Institutions.|ipv4 hash:net|43898 subnets, 227828007 unique IPs|updated every 12 hours
[iblocklist_exclusions](http://iplists.firehol.org/?ipset=iblocklist_exclusions)|Exclusions.|ipv4 hash:net|313 subnets, 7488 unique IPs|updated every 12 hours
[iblocklist_fornonlancomputers](http://iplists.firehol.org/?ipset=iblocklist_fornonlancomputers)|IP blocklist for non-LAN computers.|ipv4 hash:net|4 subnets, 302055424 unique IPs|updated every 12 hours
[iblocklist_forumspam](http://iplists.firehol.org/?ipset=iblocklist_forumspam)|Forum spam.|ipv4 hash:net|455 subnets, 479 unique IPs|updated every 12 hours
[iblocklist_hijacked](http://iplists.firehol.org/?ipset=iblocklist_hijacked)|Hijacked IP-Blocks. Contains hijacked IP-Blocks and known IP-Blocks that are used to deliver Spam. This list is a combination of lists with hijacked IP-Blocks. Hijacked IP space are IP blocks that are being used without permission by organizations that have no relation to original organization (or its legal successor) that received the IP block. In essence it's stealing of somebody else's IP resources.|ipv4 hash:net|513 subnets, 8802048 unique IPs|updated every 12 hours
[iblocklist_iana_multicast](http://iplists.firehol.org/?ipset=iblocklist_iana_multicast)|IANA Multicast IPs.|ipv4 hash:net|1 subnets, 268435456 unique IPs|updated every 12 hours
[iblocklist_iana_private](http://iplists.firehol.org/?ipset=iblocklist_iana_private)|IANA Private IPs.|ipv4 hash:net|58 subnets, 51643646 unique IPs|updated every 12 hours
[iblocklist_iana_reserved](http://iplists.firehol.org/?ipset=iblocklist_iana_reserved)|IANA Reserved IPs.|ipv4 hash:net|1 subnets, 536870912 unique IPs|updated every 12 hours
[iblocklist_isp_aol](http://iplists.firehol.org/?ipset=iblocklist_isp_aol)|AOL IPs.|ipv4 hash:net|16 subnets, 6627584 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=toboaiysofkflwgrttmb&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_att](http://iplists.firehol.org/?ipset=iblocklist_isp_att)|AT&T IPs.|ipv4 hash:net|35 subnets, 55845128 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=grbtkzijgrowvobvessf&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_cablevision](http://iplists.firehol.org/?ipset=iblocklist_isp_cablevision)|Cablevision IPs.|ipv4 hash:net|11 subnets, 1787136 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=dwwbsmzirrykdlvpqozb&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_charter](http://iplists.firehol.org/?ipset=iblocklist_isp_charter)|Charter IPs.|ipv4 hash:net|21 subnets, 6138112 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=htnzojgossawhpkbulqw&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_comcast](http://iplists.firehol.org/?ipset=iblocklist_isp_comcast)|Comcast IPs.|ipv4 hash:net|33 subnets, 45121536 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=rsgyxvuklicibautguia&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_embarq](http://iplists.firehol.org/?ipset=iblocklist_isp_embarq)|Embarq IPs.|ipv4 hash:net|14 subnets, 2703360 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=twdblifaysaqtypevvdp&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_qwest](http://iplists.firehol.org/?ipset=iblocklist_isp_qwest)|Qwest IPs.|ipv4 hash:net|73 subnets, 15777552 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=jezlifrpefawuoawnfez&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_sprint](http://iplists.firehol.org/?ipset=iblocklist_isp_sprint)|Sprint IPs.|ipv4 hash:net|73 subnets, 6310570 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=hngtqrhhuadlceqxbrob&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_suddenlink](http://iplists.firehol.org/?ipset=iblocklist_isp_suddenlink)|Suddenlink IPs.|ipv4 hash:net|3 subnets, 458752 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=psaoblrwylfrdsspfuiq&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_twc](http://iplists.firehol.org/?ipset=iblocklist_isp_twc)|Time Warner Cable IPs.|ipv4 hash:net|56 subnets, 15015936 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=aqtsnttnqmcucwrjmohd&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_verizon](http://iplists.firehol.org/?ipset=iblocklist_isp_verizon)|Verizon IPs.|ipv4 hash:net|22 subnets, 18087936 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=cdmdbprvldivlqsaqjol&fileformat=p2p&archiveformat=gz)
[iblocklist_level1](http://iplists.firehol.org/?ipset=iblocklist_level1)|Level 1 (for use in p2p): Companies or organizations who are clearly involved with trying to stop filesharing (e.g. Baytsp, MediaDefender, Mediasentry). Companies which anti-p2p activity has been seen from. Companies that produce or have a strong financial interest in copyrighted material (e.g. music, movie, software industries a.o.). Government ranges or companies that have a strong financial interest in doing work for governments. Legal industry ranges. IPs or ranges of ISPs from which anti-p2p activity has been observed. Basically this list will block all kinds of internet connections that most people would rather not have during their internet travels.|ipv4 hash:net|236297 subnets, 756668353 unique IPs|updated every 12 hours
[iblocklist_level2](http://iplists.firehol.org/?ipset=iblocklist_level2)|Level 2 (for use in p2p). General corporate ranges. Ranges used by labs or researchers. Proxies.|ipv4 hash:net|78369 subnets, 337983419 unique IPs|updated every 12 hours
[iblocklist_level3](http://iplists.firehol.org/?ipset=iblocklist_level3)|Level 3 (for use in p2p). Many portal-type websites. ISP ranges that may be dodgy for some reason. Ranges that belong to an individual, but which have not been determined to be used by a particular company. Ranges for things that are unusual in some way. The L3 list is aka the paranoid list.|ipv4 hash:net|18866 subnets, 137011671 unique IPs|updated every 12 hours
[iblocklist_malc0de](http://iplists.firehol.org/?ipset=iblocklist_malc0de)|malc0de.com IP blocklist. Addresses that have been identified distributing malware during the past 30 days.|ipv4 hash:net|21 subnets, 21 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=pbqcylkejciyhmwttify&fileformat=p2p&archiveformat=gz)
[iblocklist_onion_router](http://iplists.firehol.org/?ipset=iblocklist_onion_router)|The Onion Router IP addresses.|ipv4 hash:net|5586 subnets, 5791 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=togdoptykrlolpddwbvz&fileformat=p2p&archiveformat=gz)
[iblocklist_org_activision](http://iplists.firehol.org/?ipset=iblocklist_org_activision)|Activision IPs.|ipv4 hash:net|49 subnets, 4902 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=gfnxlhxsijzrcuxwzebb&fileformat=p2p&archiveformat=gz)
[iblocklist_org_apple](http://iplists.firehol.org/?ipset=iblocklist_org_apple)|Apple IPs.|ipv4 hash:net|1 subnets, 16777216 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=aphcqvpxuqgrkgufjruj&fileformat=p2p&archiveformat=gz)
[iblocklist_org_blizzard](http://iplists.firehol.org/?ipset=iblocklist_org_blizzard)|Blizzard IPs.|ipv4 hash:net|8 subnets, 16795139 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=ercbntshuthyykfkmhxc&fileformat=p2p&archiveformat=gz)
[iblocklist_org_crowd_control](http://iplists.firehol.org/?ipset=iblocklist_org_crowd_control)|Crowd Control Productions IPs.|ipv4 hash:net|2 subnets, 768 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=eveiyhgmusglurfmjyag&fileformat=p2p&archiveformat=gz)
[iblocklist_org_electronic_arts](http://iplists.firehol.org/?ipset=iblocklist_org_electronic_arts)|Electronic Arts IPs.|ipv4 hash:net|42 subnets, 69720 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=ejqebpcdmffinaetsvxj&fileformat=p2p&archiveformat=gz)
[iblocklist_org_joost](http://iplists.firehol.org/?ipset=iblocklist_org_joost)|Joost IPs.|ipv4 hash:net|4 subnets, 16779456 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=alxugfmeszbhpxqfdits&fileformat=p2p&archiveformat=gz)
[iblocklist_org_linden_lab](http://iplists.firehol.org/?ipset=iblocklist_org_linden_lab)|Linden Lab IPs.|ipv4 hash:net|11 subnets, 23600 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=qnjdimxnaupjmpqolxcv&fileformat=p2p&archiveformat=gz)
[iblocklist_org_logmein](http://iplists.firehol.org/?ipset=iblocklist_org_logmein)|LogMeIn IPs.|ipv4 hash:net|13 subnets, 16781568 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=tgbankumtwtrzllndbmb&fileformat=p2p&archiveformat=gz)
[iblocklist_org_microsoft](http://iplists.firehol.org/?ipset=iblocklist_org_microsoft)|Microsoft IP ranges.|ipv4 hash:net|901 subnets, 1848599 unique IPs|updated every 12 hours
[iblocklist_org_ncsoft](http://iplists.firehol.org/?ipset=iblocklist_org_ncsoft)|NCsoft IPs.|ipv4 hash:net|5 subnets, 12560 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=mwjuwmebrnzyyxpbezxu&fileformat=p2p&archiveformat=gz)
[iblocklist_org_nintendo](http://iplists.firehol.org/?ipset=iblocklist_org_nintendo)|Nintendo IPs.|ipv4 hash:net|45 subnets, 3927 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=pevkykuhgaegqyayzbnr&fileformat=p2p&archiveformat=gz)
[iblocklist_org_pandora](http://iplists.firehol.org/?ipset=iblocklist_org_pandora)|Pandora IPs.|ipv4 hash:net|1 subnets, 2048 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=aevzidimyvwybzkletsg&fileformat=p2p&archiveformat=gz)
[iblocklist_org_pirate_bay](http://iplists.firehol.org/?ipset=iblocklist_org_pirate_bay)|The Pirate Bay IPs.|ipv4 hash:net|5 subnets, 323 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=nzldzlpkgrcncdomnttb&fileformat=p2p&archiveformat=gz)
[iblocklist_org_punkbuster](http://iplists.firehol.org/?ipset=iblocklist_org_punkbuster)|Punkbuster IPs.|ipv4 hash:net|1 subnets, 1 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=zvwwndvzulqcltsicwdg&fileformat=p2p&archiveformat=gz)
[iblocklist_org_riot_games](http://iplists.firehol.org/?ipset=iblocklist_org_riot_games)|Riot Games IPs.|ipv4 hash:net|6 subnets, 1792 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=sdlvfabdjvrdttfjotcy&fileformat=p2p&archiveformat=gz)
[iblocklist_org_sony_online](http://iplists.firehol.org/?ipset=iblocklist_org_sony_online)|Sony Online Entertainment IPs.|ipv4 hash:net|7 subnets, 24616 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=tukpvrvlubsputmkmiwg&fileformat=p2p&archiveformat=gz)
[iblocklist_org_square_enix](http://iplists.firehol.org/?ipset=iblocklist_org_square_enix)|Square Enix IPs.|ipv4 hash:net|2 subnets, 4112 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=odyaqontcydnodrlyina&fileformat=p2p&archiveformat=gz)
[iblocklist_org_steam](http://iplists.firehol.org/?ipset=iblocklist_org_steam)|Steam IPs.|ipv4 hash:net|53 subnets, 596448 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=cnxkgiklecdaihzukrud&fileformat=p2p&archiveformat=gz)
[iblocklist_org_ubisoft](http://iplists.firehol.org/?ipset=iblocklist_org_ubisoft)|Ubisoft IPs.|ipv4 hash:net|10 subnets, 5308 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=etmcrglomupyxtaebzht&fileformat=p2p&archiveformat=gz)
[iblocklist_org_xfire](http://iplists.firehol.org/?ipset=iblocklist_org_xfire)|XFire IPs.|ipv4 hash:net|3 subnets, 3328 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=ppqqnyihmcrryraaqsjo&fileformat=p2p&archiveformat=gz)
[iblocklist_pedophiles](http://iplists.firehol.org/?ipset=iblocklist_pedophiles)|IP ranges of people who we have found to be sharing child pornography in the p2p community.|ipv4 hash:net|29188 subnets, 847889 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=dufcxgnbjsdwmwctgfuj&fileformat=p2p&archiveformat=gz)
[iblocklist_proxies](http://iplists.firehol.org/?ipset=iblocklist_proxies)|Open Proxies IPs list (without TOR)|ipv4 hash:ip|672 unique IPs|updated every 12 hours
[iblocklist_rangetest](http://iplists.firehol.org/?ipset=iblocklist_rangetest)|Suspicious IPs that are under investigation.|ipv4 hash:net|576 subnets, 4280758 unique IPs|updated every 12 hours
[iblocklist_spamhaus_drop](http://iplists.firehol.org/?ipset=iblocklist_spamhaus_drop)|Spamhaus.org DROP (Don't Route Or Peer) list.|ipv4 hash:net|758 subnets, 19301888 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=zbdlwrqkabxbcppvrnos&fileformat=p2p&archiveformat=gz)
[iblocklist_spider](http://iplists.firehol.org/?ipset=iblocklist_spider)|IP list intended to be used by webmasters to block hostile spiders from their web sites.|ipv4 hash:net|773 subnets, 846788 unique IPs|updated every 12 hours
[iblocklist_spyware](http://iplists.firehol.org/?ipset=iblocklist_spyware)|Known malicious SPYWARE and ADWARE IP Address ranges. It is compiled from various sources, including other available spyware blacklists, HOSTS files, from research found at many of the top anti-spyware forums, logs of spyware victims, etc.|ipv4 hash:net|3359 subnets, 339304 unique IPs|updated every 12 hours
[iblocklist_webexploit](http://iplists.firehol.org/?ipset=iblocklist_webexploit)|Web server hack and exploit attempts. IP addresses related to current web server hack and exploit attempts that have been logged or can be found in and cross referenced with other related IP databases. Malicious and other non search engine bots will also be listed here, along with anything found that can have a negative impact on a website or webserver such as proxies being used for negative SEO hijacks, unauthorised site mirroring, harvesting, scraping, snooping and data mining / spy bot / security & copyright enforcement companies that target and continuosly scan webservers.|ipv4 hash:ip|15382 unique IPs|updated every 12 hours
[iblocklist_yoyo_adservers](http://iplists.firehol.org/?ipset=iblocklist_yoyo_adservers)|pgl.yoyo.org ad servers|ipv4 hash:net|9134 subnets, 10706 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=zhogegszwduurnvsyhdf&fileformat=p2p&archiveformat=gz)
[ip2location_country](https://github.com/ktsaou/blocklist-ipsets/tree/master/ip2location_country)|[IP2Location.com](http://lite.ip2location.com/database-ip-country) geolocation database|ipv4 hash:net|All the world|updated every 1 day from [this link](http://download.ip2location.com/lite/IP2LOCATION-LITE-DB1.CSV.ZIP)
[ip2location_country_eh](http://iplists.firehol.org/?ipset=ip2location_country_eh)|Western Sahara (EH) -- [IP2Location.com](http://lite.ip2location.com/database-ip-country)|ipv4 hash:net|1 subnets, 256 unique IPs|updated every 1 day from [this link](http://download.ip2location.com/lite/IP2LOCATION-LITE-DB1.CSV.ZIP)
[ip2location_country_sh](http://iplists.firehol.org/?ipset=ip2location_country_sh)|Saint Helena (SH) -- [IP2Location.com](http://lite.ip2location.com/database-ip-country)|ipv4 hash:net|1 subnets, 256 unique IPs|updated every 1 day from [this link](http://download.ip2location.com/lite/IP2LOCATION-LITE-DB1.CSV.ZIP)
[ip2proxy_px1lite](http://iplists.firehol.org/?ipset=ip2proxy_px1lite)|[IP2Location.com](https://lite.ip2location.com/database/px1-ip-country) IP2Proxy LITE IP-COUNTRY Database contains IP addresses which are used as public proxies. The LITE edition is a free version of database that is limited to public proxies IP address.|ipv4 hash:net|1431501 subnets, 1458770 unique IPs|updated every 1 day
[ipblacklistcloud_recent](http://iplists.firehol.org/?ipset=ipblacklistcloud_recent)|[IP Blacklist Cloud](http://www.ip-finder.me/) These are the most recent IP addresses that have been blacklisted by websites. IP Blacklist Cloud plugin protects your WordPress based website from spam comments, gives details about login attacks which you don't even know are happening without this plugin!|ipv4 hash:ip|32 unique IPs|updated every 4 hours from [this link](http://www.ip-finder.me/download/)
[ipblacklistcloud_recent_1d](http://iplists.firehol.org/?ipset=ipblacklistcloud_recent_1d)|[IP Blacklist Cloud](http://www.ip-finder.me/) These are the most recent IP addresses that have been blacklisted by websites. IP Blacklist Cloud plugin protects your WordPress based website from spam comments, gives details about login attacks which you don't even know are happening without this plugin!|ipv4 hash:ip|32 unique IPs|updated every 4 hours from [this link](http://www.ip-finder.me/download/)
[ipblacklistcloud_recent_30d](http://iplists.firehol.org/?ipset=ipblacklistcloud_recent_30d)|[IP Blacklist Cloud](http://www.ip-finder.me/) These are the most recent IP addresses that have been blacklisted by websites. IP Blacklist Cloud plugin protects your WordPress based website from spam comments, gives details about login attacks which you don't even know are happening without this plugin!|ipv4 hash:ip|196 unique IPs|updated every 4 hours from [this link](http://www.ip-finder.me/download/)
[ipblacklistcloud_recent_7d](http://iplists.firehol.org/?ipset=ipblacklistcloud_recent_7d)|[IP Blacklist Cloud](http://www.ip-finder.me/) These are the most recent IP addresses that have been blacklisted by websites. IP Blacklist Cloud plugin protects your WordPress based website from spam comments, gives details about login attacks which you don't even know are happening without this plugin!|ipv4 hash:ip|64 unique IPs|updated every 4 hours from [this link](http://www.ip-finder.me/download/)
[ipblacklistcloud_top](http://iplists.firehol.org/?ipset=ipblacklistcloud_top)|[IP Blacklist Cloud](http://www.ip-finder.me/) These are the top IP addresses that have been blacklisted by many websites. IP Blacklist Cloud plugin protects your WordPress based website from spam comments, gives details about login attacks which you don't even know are happening without this plugin!|ipv4 hash:ip|200 unique IPs|updated every 1 day from [this link](http://www.ip-finder.me/ip-full-list/)
[ipdeny_country](https://github.com/firehol/blocklist-ipsets/tree/master/ipdeny_country)|[IPDeny.com](http://www.ipdeny.com/) geolocation database|ipv4 hash:net|All the world|updated every 1 day from [this link](http://www.ipdeny.com/ipblocks/data/countries/all-zones.tar.gz)
[iw_spamlist](http://iplists.firehol.org/?ipset=iw_spamlist)|[ImproWare Antispam](http://antispam.imp.ch/) IPs sending spam, in the last 3 days|ipv4 hash:ip|0 unique IPs|updated every 1 hour from [this link](http://antispam.imp.ch/spamlist)
[iw_wormlist](http://iplists.firehol.org/?ipset=iw_wormlist)|[ImproWare Antispam](http://antispam.imp.ch/) IPs sending emails with viruses or worms, in the last 3 days|ipv4 hash:ip|0 unique IPs|updated every 1 hour from [this link](http://antispam.imp.ch/wormlist)
[lashback_ubl](http://iplists.firehol.org/?ipset=lashback_ubl)|[The LashBack UBL](http://blacklist.lashback.com/) The Unsubscribe Blacklist (UBL) is a real-time blacklist of IP addresses which are sending email to names harvested from suppression files (this is a big list, more than 500.000 IPs)|ipv4 hash:ip|103993 unique IPs|updated every 1 day from [this link](http://www.unsubscore.com/blacklist.txt)
[malc0de](http://iplists.firehol.org/?ipset=malc0de)|[Malc0de.com](http://malc0de.com) malicious IPs of the last 30 days|ipv4 hash:ip|21 unique IPs|updated every 1 day from [this link](http://malc0de.com/bl/IP_Blacklist.txt)
[malwaredomainlist](http://iplists.firehol.org/?ipset=malwaredomainlist)|[malwaredomainlist.com](http://www.malwaredomainlist.com) list of malware active ip addresses|ipv4 hash:ip|996 unique IPs|updated every 12 hours from [this link](http://www.malwaredomainlist.com/hostslist/ip.txt)
[maxmind_proxy_fraud](http://iplists.firehol.org/?ipset=maxmind_proxy_fraud)|[MaxMind.com](https://www.maxmind.com/en/high-risk-ip-sample-list) sample list of high-risk IP addresses.|ipv4 hash:ip|583 unique IPs|updated every 4 hours from [this link](https://www.maxmind.com/en/high-risk-ip-sample-list)
[myip](http://iplists.firehol.org/?ipset=myip)|[myip.ms](http://www.myip.ms/info/about) IPs identified as web bots in the last 10 days, using several sites that require human action|ipv4 hash:ip|744 unique IPs|updated every 1 day from [this link](http://www.myip.ms/files/blacklist/csf/latest_blacklist.txt)
[nixspam](http://iplists.firehol.org/?ipset=nixspam)|[NiX Spam](http://www.heise.de/ix/NiX-Spam-DNSBL-and-blacklist-for-download-499637.html) IP addresses that sent spam in the last hour - automatically generated entries without distinguishing open proxies from relays, dialup gateways, and so on. All IPs are removed after 12 hours if there is no spam from there.|ipv4 hash:ip|1340 unique IPs|updated every 15 mins from [this link](http://www.dnsbl.manitu.net/download/nixspam-ip.dump.gz)
[normshield_all_attack](http://iplists.firehol.org/?ipset=normshield_all_attack)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category attack with severity all|ipv4 hash:ip|133 unique IPs|updated every 12 hours
[normshield_all_bruteforce](http://iplists.firehol.org/?ipset=normshield_all_bruteforce)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category bruteforce with severity all|ipv4 hash:ip|84 unique IPs|updated every 12 hours
[normshield_all_ddosbot](http://iplists.firehol.org/?ipset=normshield_all_ddosbot)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category ddosbot with severity all|ipv4 hash:ip|1 unique IPs|updated every 12 hours
[normshield_all_dnsscan](http://iplists.firehol.org/?ipset=normshield_all_dnsscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category dnsscan with severity all|ipv4 hash:ip|1 unique IPs|updated every 12 hours
[normshield_all_spam](http://iplists.firehol.org/?ipset=normshield_all_spam)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category spam with severity all|ipv4 hash:ip|12 unique IPs|updated every 12 hours
[normshield_all_suspicious](http://iplists.firehol.org/?ipset=normshield_all_suspicious)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category suspicious with severity all|ipv4 hash:ip|9 unique IPs|updated every 12 hours
[normshield_all_wannacry](http://iplists.firehol.org/?ipset=normshield_all_wannacry)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category wannacry with severity all|ipv4 hash:ip|654 unique IPs|updated every 12 hours
[normshield_all_webscan](http://iplists.firehol.org/?ipset=normshield_all_webscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category webscan with severity all|ipv4 hash:ip|40 unique IPs|updated every 12 hours
[normshield_all_wormscan](http://iplists.firehol.org/?ipset=normshield_all_wormscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category wormscan with severity all|ipv4 hash:ip|5 unique IPs|updated every 12 hours
[normshield_high_attack](http://iplists.firehol.org/?ipset=normshield_high_attack)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category attack with severity high|ipv4 hash:ip|133 unique IPs|updated every 12 hours
[normshield_high_bruteforce](http://iplists.firehol.org/?ipset=normshield_high_bruteforce)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category bruteforce with severity high|ipv4 hash:ip|84 unique IPs|updated every 12 hours
[normshield_high_ddosbot](http://iplists.firehol.org/?ipset=normshield_high_ddosbot)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category ddosbot with severity high|ipv4 hash:ip|1 unique IPs|updated every 12 hours
[normshield_high_dnsscan](http://iplists.firehol.org/?ipset=normshield_high_dnsscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category dnsscan with severity high|ipv4 hash:ip|1 unique IPs|updated every 12 hours
[normshield_high_spam](http://iplists.firehol.org/?ipset=normshield_high_spam)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category spam with severity high|ipv4 hash:ip|12 unique IPs|updated every 12 hours
[normshield_high_suspicious](http://iplists.firehol.org/?ipset=normshield_high_suspicious)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category suspicious with severity high|ipv4 hash:ip|9 unique IPs|updated every 12 hours
[normshield_high_wannacry](http://iplists.firehol.org/?ipset=normshield_high_wannacry)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category wannacry with severity high|ipv4 hash:ip|654 unique IPs|updated every 12 hours
[normshield_high_webscan](http://iplists.firehol.org/?ipset=normshield_high_webscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category webscan with severity high|ipv4 hash:ip|40 unique IPs|updated every 12 hours
[normshield_high_wormscan](http://iplists.firehol.org/?ipset=normshield_high_wormscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category wormscan with severity high|ipv4 hash:ip|5 unique IPs|updated every 12 hours
[nt_malware_dns](http://iplists.firehol.org/?ipset=nt_malware_dns)|[No Think](http://www.nothink.org/) Malware DNS (the original list includes hostnames and domains, which are ignored)|ipv4 hash:ip|235 unique IPs|updated every 1 hour from [this link](http://www.nothink.org/blacklist/blacklist_malware_dns.txt)
[nt_malware_http](http://iplists.firehol.org/?ipset=nt_malware_http)|[No Think](http://www.nothink.org/) Malware HTTP|ipv4 hash:ip|69 unique IPs|updated every 1 hour from [this link](http://www.nothink.org/blacklist/blacklist_malware_http.txt)
[nt_malware_irc](http://iplists.firehol.org/?ipset=nt_malware_irc)|[No Think](http://www.nothink.org/) Malware IRC|ipv4 hash:ip|42 unique IPs|updated every 1 hour from [this link](http://www.nothink.org/blacklist/blacklist_malware_irc.txt)
[nt_ssh_7d](http://iplists.firehol.org/?ipset=nt_ssh_7d)|[NoThink](http://www.nothink.org/) Last 7 days SSH attacks|ipv4 hash:ip|169 unique IPs|updated every 1 hour from [this link](http://www.nothink.org/blacklist/blacklist_ssh_week.txt)
[nullsecure](http://iplists.firehol.org/?ipset=nullsecure)|[nullsecure.org](http://nullsecure.org/) This is a free threat feed provided for use in any acceptable manner. This feed was aggregated using the [Tango Honeypot Intelligence Splunk App](https://github.com/aplura/Tango) by Brian Warehime, a Senior Security Analyst at Defense Point Security.|ipv4 hash:ip|29439 unique IPs|updated every 8 hours from [this link](http://nullsecure.org/threatfeed/master.txt)
[packetmail](http://iplists.firehol.org/?ipset=packetmail)|[PacketMail.net](https://www.packetmail.net/) IP addresses that have been detected performing TCP SYN to 206.82.85.196/30 to a non-listening service or daemon. No assertion is made, nor implied, that any of the below listed IP addresses are accurate, malicious, hostile, or engaged in nefarious acts. Use this list at your own risk.|ipv4 hash:ip|3986 unique IPs|updated every 4 hours from [this link](https://www.packetmail.net/iprep.txt)
[packetmail_emerging_ips](http://iplists.firehol.org/?ipset=packetmail_emerging_ips)|[PacketMail.net](https://www.packetmail.net/) IP addresses that have been detected as potentially of interest based on the number of unique users of the packetmail IP Reputation system. No assertion is made, nor implied, that any of the below listed IP addresses are accurate, malicious, hostile, or engaged in nefarious acts. Use this list at your own risk.|ipv4 hash:ip|26 unique IPs|updated every 4 hours from [this link](https://www.packetmail.net/iprep_emerging_ips.txt)
[packetmail_mail](http://iplists.firehol.org/?ipset=packetmail_mail)|[PacketMail.net](https://www.packetmail.net/) IP addresses that have been detected performing behavior not in compliance with the requirements this system enforces for email acceptance. No assertion is made, nor implied, that any of the below listed IP addresses are accurate, malicious, hostile, or engaged in nefarious acts. Use this list at your own risk.|ipv4 hash:ip|73 unique IPs|updated every 4 hours from [this link](https://www.packetmail.net/iprep_mail.txt)
[packetmail_ramnode](http://iplists.firehol.org/?ipset=packetmail_ramnode)|[PacketMail.net](https://www.packetmail.net/) IP addresses that have been detected performing TCP SYN to 81.4.103.251 to a non-listening service or daemon. No assertion is made, nor implied, that any of the below listed IP addresses are accurate, malicious, hostile, or engaged in nefarious acts. Use this list at your own risk.|ipv4 hash:ip|2502 unique IPs|updated every 4 hours from [this link](https://www.packetmail.net/iprep_ramnode.txt)
php_bad|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) bad web hosts (this list is composed using an RSS feed)|ipv4 hash:ip|disabled|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=b&rss=1)
[php_commenters](http://iplists.firehol.org/?ipset=php_commenters)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) comment spammers (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=c&rss=1)
[php_commenters_1d](http://iplists.firehol.org/?ipset=php_commenters_1d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) comment spammers (this list is composed using an RSS feed)|ipv4 hash:ip|86 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=c&rss=1)
[php_commenters_30d](http://iplists.firehol.org/?ipset=php_commenters_30d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) comment spammers (this list is composed using an RSS feed)|ipv4 hash:ip|858 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=c&rss=1)
[php_commenters_7d](http://iplists.firehol.org/?ipset=php_commenters_7d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) comment spammers (this list is composed using an RSS feed)|ipv4 hash:ip|279 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=c&rss=1)
[php_dictionary](http://iplists.firehol.org/?ipset=php_dictionary)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) directory attackers (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1)
[php_dictionary_1d](http://iplists.firehol.org/?ipset=php_dictionary_1d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) directory attackers (this list is composed using an RSS feed)|ipv4 hash:ip|98 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1)
[php_dictionary_30d](http://iplists.firehol.org/?ipset=php_dictionary_30d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) directory attackers (this list is composed using an RSS feed)|ipv4 hash:ip|1127 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1)
[php_dictionary_7d](http://iplists.firehol.org/?ipset=php_dictionary_7d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) directory attackers (this list is composed using an RSS feed)|ipv4 hash:ip|357 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1)
[php_harvesters](http://iplists.firehol.org/?ipset=php_harvesters)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) harvesters (IPs that surf the internet looking for email addresses) (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=h&rss=1)
[php_harvesters_1d](http://iplists.firehol.org/?ipset=php_harvesters_1d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) harvesters (IPs that surf the internet looking for email addresses) (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=h&rss=1)
[php_harvesters_30d](http://iplists.firehol.org/?ipset=php_harvesters_30d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) harvesters (IPs that surf the internet looking for email addresses) (this list is composed using an RSS feed)|ipv4 hash:ip|528 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=h&rss=1)
[php_harvesters_7d](http://iplists.firehol.org/?ipset=php_harvesters_7d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) harvesters (IPs that surf the internet looking for email addresses) (this list is composed using an RSS feed)|ipv4 hash:ip|169 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=h&rss=1)
[php_spammers](http://iplists.firehol.org/?ipset=php_spammers)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) spam servers (IPs used by spammers to send messages) (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=s&rss=1)
[php_spammers_1d](http://iplists.firehol.org/?ipset=php_spammers_1d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) spam servers (IPs used by spammers to send messages) (this list is composed using an RSS feed)|ipv4 hash:ip|100 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=s&rss=1)
[php_spammers_30d](http://iplists.firehol.org/?ipset=php_spammers_30d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) spam servers (IPs used by spammers to send messages) (this list is composed using an RSS feed)|ipv4 hash:ip|1168 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=s&rss=1)
[php_spammers_7d](http://iplists.firehol.org/?ipset=php_spammers_7d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) spam servers (IPs used by spammers to send messages) (this list is composed using an RSS feed)|ipv4 hash:ip|328 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=s&rss=1)
[proxylists](http://iplists.firehol.org/?ipset=proxylists)|[proxylists.net](http://www.proxylists.net/) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|2668 unique IPs|updated every 1 hour from [this link](http://www.proxylists.net/proxylists.xml)
[proxylists_1d](http://iplists.firehol.org/?ipset=proxylists_1d)|[proxylists.net](http://www.proxylists.net/) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|5094 unique IPs|updated every 1 hour from [this link](http://www.proxylists.net/proxylists.xml)
[proxylists_30d](http://iplists.firehol.org/?ipset=proxylists_30d)|[proxylists.net](http://www.proxylists.net/) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|10138 unique IPs|updated every 1 hour from [this link](http://www.proxylists.net/proxylists.xml)
[proxylists_7d](http://iplists.firehol.org/?ipset=proxylists_7d)|[proxylists.net](http://www.proxylists.net/) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|8263 unique IPs|updated every 1 hour from [this link](http://www.proxylists.net/proxylists.xml)
[proxyrss](http://iplists.firehol.org/?ipset=proxyrss)|[proxyrss.com](http://www.proxyrss.com) open proxies syndicated from multiple sources.|ipv4 hash:ip|596 unique IPs|updated every 4 hours from [this link](http://www.proxyrss.com/proxylists/all.gz)
[proxyrss_1d](http://iplists.firehol.org/?ipset=proxyrss_1d)|[proxyrss.com](http://www.proxyrss.com) open proxies syndicated from multiple sources.|ipv4 hash:ip|1602 unique IPs|updated every 4 hours from [this link](http://www.proxyrss.com/proxylists/all.gz)
[proxyrss_30d](http://iplists.firehol.org/?ipset=proxyrss_30d)|[proxyrss.com](http://www.proxyrss.com) open proxies syndicated from multiple sources.|ipv4 hash:ip|4899 unique IPs|updated every 4 hours from [this link](http://www.proxyrss.com/proxylists/all.gz)
[proxyrss_7d](http://iplists.firehol.org/?ipset=proxyrss_7d)|[proxyrss.com](http://www.proxyrss.com) open proxies syndicated from multiple sources.|ipv4 hash:ip|3612 unique IPs|updated every 4 hours from [this link](http://www.proxyrss.com/proxylists/all.gz)
[proxyspy_1d](http://iplists.firehol.org/?ipset=proxyspy_1d)|[ProxySpy](http://spys.ru/en/) open proxies (updated hourly)|ipv4 hash:ip|300 unique IPs|updated every 1 hour from [this link](http://txt.proxyspy.net/proxy.txt)
[proxyspy_30d](http://iplists.firehol.org/?ipset=proxyspy_30d)|[ProxySpy](http://spys.ru/en/) open proxies (updated hourly)|ipv4 hash:ip|6720 unique IPs|updated every 1 hour from [this link](http://txt.proxyspy.net/proxy.txt)
[proxyspy_7d](http://iplists.firehol.org/?ipset=proxyspy_7d)|[ProxySpy](http://spys.ru/en/) open proxies (updated hourly)|ipv4 hash:ip|2828 unique IPs|updated every 1 hour from [this link](http://txt.proxyspy.net/proxy.txt)
[proxz](http://iplists.firehol.org/?ipset=proxz)|[proxz.com](http://www.proxz.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|26 unique IPs|updated every 1 hour from [this link](http://www.proxz.com/proxylists.xml)
[proxz_1d](http://iplists.firehol.org/?ipset=proxz_1d)|[proxz.com](http://www.proxz.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|266 unique IPs|updated every 1 hour from [this link](http://www.proxz.com/proxylists.xml)
[proxz_30d](http://iplists.firehol.org/?ipset=proxz_30d)|[proxz.com](http://www.proxz.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|3338 unique IPs|updated every 1 hour from [this link](http://www.proxz.com/proxylists.xml)
[proxz_7d](http://iplists.firehol.org/?ipset=proxz_7d)|[proxz.com](http://www.proxz.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|1201 unique IPs|updated every 1 hour from [this link](http://www.proxz.com/proxylists.xml)
[pushing_inertia_blocklist](http://iplists.firehol.org/?ipset=pushing_inertia_blocklist)|[Pushing Inertia](https://github.com/pushinginertia/ip-blacklist) IPs of hosting providers that are known to host various bots, spiders, scrapers, etc. to block access from these providers to web servers.|ipv4 hash:net|892 subnets, 34648204 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/pushinginertia/ip-blacklist/master/ip_blacklist.conf)
[ransomware_cryptowall_ps](http://iplists.firehol.org/?ipset=ransomware_cryptowall_ps)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is CW_PS_IPBL: CryptoWall Ransomware Payment Sites IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/CW_PS_IPBL.txt)
[ransomware_feed](http://iplists.firehol.org/?ipset=ransomware_feed)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. The IPs in this list have been extracted from the tracker data feed.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/feeds/csv/)
[ransomware_locky_c2](http://iplists.firehol.org/?ipset=ransomware_locky_c2)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is LY_C2_IPBL: Locky Ransomware C2 URL blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/LY_C2_IPBL.txt)
[ransomware_locky_ps](http://iplists.firehol.org/?ipset=ransomware_locky_ps)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is LY_PS_IPBL: Locky Ransomware Payment Sites IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/LY_PS_IPBL.txt)
[ransomware_online](http://iplists.firehol.org/?ipset=ransomware_online)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. The IPs in this list have been extracted from the tracker data feed, filtering only online IPs.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/feeds/csv/)
[ransomware_rw](http://iplists.firehol.org/?ipset=ransomware_rw)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list includes TC_PS_IPBL, LY_C2_IPBL, TL_C2_IPBL, TL_PS_IPBL and it is the recommended blocklist. It might not catch everything, but the false positive rate should be low. However, false positives are possible, especially with regards to RW_IPBL. IP addresses associated with Ransomware Payment Sites (*_PS_IPBL) or Locky botnet C&Cs (LY_C2_IPBL) stay listed on RW_IPBL for a time of 30 days after the last appearance. This means that an IP address stays listed on RW_IPBL even after the threat has been eliminated (e.g. the VPS / server has been suspended by the hosting provider) for another 30 days.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt)
[ransomware_teslacrypt_ps](http://iplists.firehol.org/?ipset=ransomware_teslacrypt_ps)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is TC_PS_IPBL: TeslaCrypt Ransomware Payment Sites IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/TC_PS_IPBL.txt)
[ransomware_torrentlocker_c2](http://iplists.firehol.org/?ipset=ransomware_torrentlocker_c2)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is TL_C2_IPBL: TorrentLocker Ransomware C2 IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/TL_C2_IPBL.txt)
[ransomware_torrentlocker_ps](http://iplists.firehol.org/?ipset=ransomware_torrentlocker_ps)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is TL_PS_IPBL: TorrentLocker Ransomware Payment Sites IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/TL_PS_IPBL.txt)
[ri_connect_proxies](http://iplists.firehol.org/?ipset=ri_connect_proxies)|[rosinstrument.com](http://www.rosinstrument.com) open CONNECT proxies (this list is composed using an RSS feed)|ipv4 hash:ip|150 unique IPs|updated every 1 hour from [this link](http://tools.rosinstrument.com/proxy/plab100.xml)
[ri_connect_proxies_1d](http://iplists.firehol.org/?ipset=ri_connect_proxies_1d)|[rosinstrument.com](http://www.rosinstrument.com) open CONNECT proxies (this list is composed using an RSS feed)|ipv4 hash:ip|150 unique IPs|updated every 1 hour from [this link](http://tools.rosinstrument.com/proxy/plab100.xml)
[ri_connect_proxies_30d](http://iplists.firehol.org/?ipset=ri_connect_proxies_30d)|[rosinstrument.com](http://www.rosinstrument.com) open CONNECT proxies (this list is composed using an RSS feed)|ipv4 hash:ip|150 unique IPs|updated every 1 hour from [this link](http://tools.rosinstrument.com/proxy/plab100.xml)
[ri_connect_proxies_7d](http://iplists.firehol.org/?ipset=ri_connect_proxies_7d)|[rosinstrument.com](http://www.rosinstrument.com) open CONNECT proxies (this list is composed using an RSS feed)|ipv4 hash:ip|150 unique IPs|updated every 1 hour from [this link](http://tools.rosinstrument.com/proxy/plab100.xml)
[ri_web_proxies](http://iplists.firehol.org/?ipset=ri_web_proxies)|[rosinstrument.com](http://www.rosinstrument.com) open HTTP proxies (this list is composed using an RSS feed)|ipv4 hash:ip|139 unique IPs|updated every 1 hour from [this link](http://tools.rosinstrument.com/proxy/l100.xml)
[ri_web_proxies_1d](http://iplists.firehol.org/?ipset=ri_web_proxies_1d)|[rosinstrument.com](http://www.rosinstrument.com) open HTTP proxies (this list is composed using an RSS feed)|ipv4 hash:ip|139 unique IPs|updated every 1 hour from [this link](http://tools.rosinstrument.com/proxy/l100.xml)
[ri_web_proxies_30d](http://iplists.firehol.org/?ipset=ri_web_proxies_30d)|[rosinstrument.com](http://www.rosinstrument.com) open HTTP proxies (this list is composed using an RSS feed)|ipv4 hash:ip|139 unique IPs|updated every 1 hour from [this link](http://tools.rosinstrument.com/proxy/l100.xml)
[ri_web_proxies_7d](http://iplists.firehol.org/?ipset=ri_web_proxies_7d)|[rosinstrument.com](http://www.rosinstrument.com) open HTTP proxies (this list is composed using an RSS feed)|ipv4 hash:ip|139 unique IPs|updated every 1 hour from [this link](http://tools.rosinstrument.com/proxy/l100.xml)
[sblam](http://iplists.firehol.org/?ipset=sblam)|[sblam.com](http://sblam.com) IPs used by web form spammers, during the last month|ipv4 hash:ip|6627 unique IPs|updated every 1 day from [this link](http://sblam.com/blacklist.txt)
[shunlist](http://iplists.firehol.org/?ipset=shunlist)|[AutoShun.org](http://autoshun.org/) IPs identified as hostile by correlating logs from distributed snort installations running the autoshun plugin|ipv4 hash:ip|500 unique IPs|updated every 4 hours
[snort_ipfilter](http://iplists.firehol.org/?ipset=snort_ipfilter)|[labs.snort.org](https://labs.snort.org/) supplied IP blacklist (this list seems to be updated frequently, but we found no information about it)|ipv4 hash:ip|788 unique IPs|updated every 12 hours from [this link](http://labs.snort.org/feeds/ip-filter.blf)
[socks_proxy](http://iplists.firehol.org/?ipset=socks_proxy)|[socks-proxy.net](http://www.socks-proxy.net/) open SOCKS proxies|ipv4 hash:ip|300 unique IPs|updated every 10 mins from [this link](http://www.socks-proxy.net/)
[socks_proxy_1d](http://iplists.firehol.org/?ipset=socks_proxy_1d)|[socks-proxy.net](http://www.socks-proxy.net/) open SOCKS proxies|ipv4 hash:ip|6482 unique IPs|updated every 10 mins from [this link](http://www.socks-proxy.net/)
[socks_proxy_30d](http://iplists.firehol.org/?ipset=socks_proxy_30d)|[socks-proxy.net](http://www.socks-proxy.net/) open SOCKS proxies|ipv4 hash:ip|17331 unique IPs|updated every 10 mins from [this link](http://www.socks-proxy.net/)
[socks_proxy_7d](http://iplists.firehol.org/?ipset=socks_proxy_7d)|[socks-proxy.net](http://www.socks-proxy.net/) open SOCKS proxies|ipv4 hash:ip|10013 unique IPs|updated every 10 mins from [this link](http://www.socks-proxy.net/)
[sorbs_anonymizers](http://iplists.firehol.org/?ipset=sorbs_anonymizers)|[Sorbs.net](https://www.sorbs.net/) List of open HTTP and SOCKS proxies.|ipv4 hash:net|597391 subnets, 610263 unique IPs|updated every 1 min
sorbs_block|[Sorbs.net](https://www.sorbs.net/) List of hosts demanding that they never be tested by SORBS.|ipv4 hash:net|disabled|
[sorbs_dul](http://iplists.firehol.org/?ipset=sorbs_dul)|[Sorbs.net](https://www.sorbs.net/) Dynamic IP Addresses.|ipv4 hash:net|607718 subnets, 375474210 unique IPs|updated every 1 min
[sorbs_escalations](http://iplists.firehol.org/?ipset=sorbs_escalations)|[Sorbs.net](https://www.sorbs.net/) Netblocks of spam supporting service providers, including those who provide websites, DNS or drop boxes for a spammer. Spam supporters are added on a 'third strike and you are out' basis, where the third spam will cause the supporter to be added to the list.|ipv4 hash:net|8 subnets, 2304 unique IPs|updated every 1 min
[sorbs_new_spam](http://iplists.firehol.org/?ipset=sorbs_new_spam)|[Sorbs.net](https://www.sorbs.net/) List of hosts that have been noted as sending spam/UCE/UBE within the last 48 hours|ipv4 hash:net|33977 subnets, 35967 unique IPs|updated every 1 min
[sorbs_noserver](http://iplists.firehol.org/?ipset=sorbs_noserver)|[Sorbs.net](https://www.sorbs.net/) IP addresses and netblocks of where system administrators and ISPs owning the network have indicated that servers should not be present.|ipv4 hash:net|15066 subnets, 22951270 unique IPs|updated every 1 min
[sorbs_recent_spam](http://iplists.firehol.org/?ipset=sorbs_recent_spam)|[Sorbs.net](https://www.sorbs.net/) List of hosts that have been noted as sending spam/UCE/UBE within the last 28 days (includes sorbs_new_spam)|ipv4 hash:net|522240 subnets, 555438 unique IPs|updated every 1 min
[sorbs_smtp](http://iplists.firehol.org/?ipset=sorbs_smtp)|[Sorbs.net](https://www.sorbs.net/) List of SMTP Open Relays.|ipv4 hash:net|1968 subnets, 1976 unique IPs|updated every 1 min
[sorbs_web](http://iplists.firehol.org/?ipset=sorbs_web)|[Sorbs.net](https://www.sorbs.net/) List of IPs which have spammer abusable vulnerabilities (e.g. FormMail scripts)|ipv4 hash:net|5895259 subnets, 6375029 unique IPs|updated every 1 min
[sorbs_zombie](http://iplists.firehol.org/?ipset=sorbs_zombie)|[Sorbs.net](https://www.sorbs.net/) List of networks hijacked from their original owners, some of which have already used for spamming.|ipv4 hash:net|78 subnets, 1903876 unique IPs|updated every 1 min
[spamhaus_drop](http://iplists.firehol.org/?ipset=spamhaus_drop)|[Spamhaus.org](http://www.spamhaus.org) DROP list (according to their site this list should be dropped at tier-1 ISPs globally)|ipv4 hash:net|763 subnets, 19377152 unique IPs|updated every 12 hours from [this link](http://www.spamhaus.org/drop/drop.txt)
[spamhaus_edrop](http://iplists.firehol.org/?ipset=spamhaus_edrop)|[Spamhaus.org](http://www.spamhaus.org) EDROP (extended matches that should be used with DROP)|ipv4 hash:net|76 subnets, 963584 unique IPs|updated every 12 hours from [this link](http://www.spamhaus.org/drop/edrop.txt)
[sslbl](http://iplists.firehol.org/?ipset=sslbl)|[Abuse.ch SSL Blacklist](https://sslbl.abuse.ch/) bad SSL traffic related to malware or botnet activities|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://sslbl.abuse.ch/blacklist/sslipblacklist.csv)
[sslbl_aggressive](http://iplists.firehol.org/?ipset=sslbl_aggressive)|[Abuse.ch SSL Blacklist](https://sslbl.abuse.ch/) The aggressive version of the SSL IP Blacklist contains all IPs that SSLBL ever detected being associated with a malicious SSL certificate. Since IP addresses can be reused (e.g. when the customer changes), this blacklist may cause false positives. Hence I highly recommend you to use the standard version instead of the aggressive one.|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.csv)
[sslproxies](http://iplists.firehol.org/?ipset=sslproxies)|[SSLProxies.org](http://www.sslproxies.org/) open SSL proxies|ipv4 hash:ip|100 unique IPs|updated every 10 mins from [this link](http://www.sslproxies.org/)
[sslproxies_1d](http://iplists.firehol.org/?ipset=sslproxies_1d)|[SSLProxies.org](http://www.sslproxies.org/) open SSL proxies|ipv4 hash:ip|1229 unique IPs|updated every 10 mins from [this link](http://www.sslproxies.org/)
[sslproxies_30d](http://iplists.firehol.org/?ipset=sslproxies_30d)|[SSLProxies.org](http://www.sslproxies.org/) open SSL proxies|ipv4 hash:ip|6296 unique IPs|updated every 10 mins from [this link](http://www.sslproxies.org/)
[sslproxies_7d](http://iplists.firehol.org/?ipset=sslproxies_7d)|[SSLProxies.org](http://www.sslproxies.org/) open SSL proxies|ipv4 hash:ip|2859 unique IPs|updated every 10 mins from [this link](http://www.sslproxies.org/)
[stopforumspam](http://iplists.firehol.org/?ipset=stopforumspam)|[StopForumSpam.com](http://www.stopforumspam.com) Banned IPs used by forum spammers|ipv4 hash:ip|141249 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/bannedips.zip)
[stopforumspam_180d](http://iplists.firehol.org/?ipset=stopforumspam_180d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers (last 180 days)|ipv4 hash:ip|271524 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/listed_ip_180.zip)
[stopforumspam_1d](http://iplists.firehol.org/?ipset=stopforumspam_1d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers in the last 24 hours|ipv4 hash:ip|6969 unique IPs|updated every 1 hour from [this link](http://www.stopforumspam.com/downloads/listed_ip_1.zip)
[stopforumspam_30d](http://iplists.firehol.org/?ipset=stopforumspam_30d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers (last 30 days)|ipv4 hash:ip|60480 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/listed_ip_30.zip)
[stopforumspam_365d](http://iplists.firehol.org/?ipset=stopforumspam_365d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers (last 365 days)|ipv4 hash:ip|498091 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/listed_ip_365.zip)
[stopforumspam_7d](http://iplists.firehol.org/?ipset=stopforumspam_7d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers (last 7 days)|ipv4 hash:ip|20293 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/listed_ip_7.zip)
[stopforumspam_90d](http://iplists.firehol.org/?ipset=stopforumspam_90d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers (last 90 days)|ipv4 hash:ip|142199 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/listed_ip_90.zip)
[stopforumspam_toxic](http://iplists.firehol.org/?ipset=stopforumspam_toxic)|[StopForumSpam.com](http://www.stopforumspam.com) Networks that have large amounts of spambots and are flagged as toxic. Toxic IP ranges are infrequently changed.|ipv4 hash:net|41 subnets, 119627 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/toxic_ip_cidr.txt)
[taichung](http://iplists.firehol.org/?ipset=taichung)|[Taichung Education Center](https://www.tc.edu.tw/net/netflow/lkout/recent/30) Blocked IP Addresses (attacks and bots).|ipv4 hash:ip|23385 unique IPs|updated every 1 day from [this link](https://www.tc.edu.tw/net/netflow/lkout/recent/30)
[talosintel_ipfilter](http://iplists.firehol.org/?ipset=talosintel_ipfilter)|[TalosIntel.com](http://talosintel.com/additional-resources/) List of known malicious network threats|ipv4 hash:ip|788 unique IPs|updated every 15 mins from [this link](http://talosintel.com/feeds/ip-filter.blf)
[threatcrowd](http://iplists.firehol.org/?ipset=threatcrowd)|[Crowdsourced IP feed from ThreatCrowd](http://threatcrowd.blogspot.gr/2016/02/crowdsourced-feeds-from-threatcrowd.html). These feeds are not a substitute for the scale of auto-extracted command and control domains or the quality of some commercially provided feeds. But crowd-sourcing does go some way towards the quick sharing of threat intelligence between the community.|ipv4 hash:ip|977 unique IPs|updated every 1 hour from [this link](https://www.threatcrowd.org/feeds/ips.txt)
[tor_exits](http://iplists.firehol.org/?ipset=tor_exits)|[TorProject.org](https://www.torproject.org) list of all current TOR exit points (TorDNSEL)|ipv4 hash:ip|1211 unique IPs|updated every 5 mins from [this link](https://check.torproject.org/exit-addresses)
[tor_exits_1d](http://iplists.firehol.org/?ipset=tor_exits_1d)|[TorProject.org](https://www.torproject.org) list of all current TOR exit points (TorDNSEL)|ipv4 hash:ip|1211 unique IPs|updated every 5 mins from [this link](https://check.torproject.org/exit-addresses)
[tor_exits_30d](http://iplists.firehol.org/?ipset=tor_exits_30d)|[TorProject.org](https://www.torproject.org) list of all current TOR exit points (TorDNSEL)|ipv4 hash:ip|1739 unique IPs|updated every 5 mins from [this link](https://check.torproject.org/exit-addresses)
[tor_exits_7d](http://iplists.firehol.org/?ipset=tor_exits_7d)|[TorProject.org](https://www.torproject.org) list of all current TOR exit points (TorDNSEL)|ipv4 hash:ip|1297 unique IPs|updated every 5 mins from [this link](https://check.torproject.org/exit-addresses)
[turris_greylist](http://iplists.firehol.org/?ipset=turris_greylist)|[Turris Greylist](https://www.turris.cz/en/greylist) IPs that are blocked on the firewalls of Turris routers. The data is processed and clasified every week and behaviour of IP addresses that accessed a larger number of Turris routers is evaluated. The result is a list of addresses that have tried to obtain information about services on the router or tried to gain access to them. We do not recommend to use these data as a list of addresses that should be blocked but it can be used for example in analysis of the traffic in other networks.|ipv4 hash:ip|26194 unique IPs|updated every 7 days from [this link](https://www.turris.cz/greylist-data/greylist-latest.csv)
[urandomusto_dns](http://iplists.firehol.org/?ipset=urandomusto_dns)|IP Feed about dns, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|67 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=dns&out=txt&submit=go)
[urandomusto_ftp](http://iplists.firehol.org/?ipset=urandomusto_ftp)|IP Feed about ftp, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|152 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=ftp&out=txt&submit=go)
[urandomusto_http](http://iplists.firehol.org/?ipset=urandomusto_http)|IP Feed about http, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|289 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=http&out=txt&submit=go)
[urandomusto_mailer](http://iplists.firehol.org/?ipset=urandomusto_mailer)|IP Feed about mailer, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|259 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=mailer&out=txt&submit=go)
[urandomusto_malware](http://iplists.firehol.org/?ipset=urandomusto_malware)|IP Feed about malware, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|1 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=malware&out=txt&submit=go)
[urandomusto_ntp](http://iplists.firehol.org/?ipset=urandomusto_ntp)|IP Feed about ntp, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|72 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=ntp&out=txt&submit=go)
[urandomusto_rdp](http://iplists.firehol.org/?ipset=urandomusto_rdp)|IP Feed about rdp, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|133 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=rdp&out=txt&submit=go)
[urandomusto_smb](http://iplists.firehol.org/?ipset=urandomusto_smb)|IP Feed about smb, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|45 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=smb&out=txt&submit=go)
[urandomusto_spam](http://iplists.firehol.org/?ipset=urandomusto_spam)|IP Feed about spam, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|4 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=spam&out=txt&submit=go)
[urandomusto_ssh](http://iplists.firehol.org/?ipset=urandomusto_ssh)|IP Feed about ssh, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|126 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=ssh&out=txt&submit=go)
[urandomusto_telnet](http://iplists.firehol.org/?ipset=urandomusto_telnet)|IP Feed about telnet, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|299 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=telnet&out=txt&submit=go)
[urandomusto_unspecified](http://iplists.firehol.org/?ipset=urandomusto_unspecified)|IP Feed about unspecified, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|178 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=unspecified&out=txt&submit=go)
[urandomusto_vnc](http://iplists.firehol.org/?ipset=urandomusto_vnc)|IP Feed about vnc, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|27 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=vnc&out=txt&submit=go)
[urlvir](http://iplists.firehol.org/?ipset=urlvir)|[URLVir.com](http://www.urlvir.com/) Active Malicious IP Addresses Hosting Malware. URLVir is an online security service developed by NoVirusThanks Company Srl that automatically monitors changes of malicious URLs (executable files).|ipv4 hash:ip|171 unique IPs|updated every 1 day from [this link](http://www.urlvir.com/export-ip-addresses/)
[uscert_hidden_cobra](http://iplists.firehol.org/?ipset=uscert_hidden_cobra)|Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace. DHS and FBI assess that HIDDEN COBRA actors will continue to use cyber operations to advance their government’s military and strategic objectives. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware. Variants of malware and tools used by HIDDEN COBRA actors include Destover, Wild Positron/Duuzer and Hangman.|ipv4 hash:ip|627 unique IPs|updated every 1 day from [this link](https://www.us-cert.gov/sites/default/files/publications/TA-17-164A_csv.csv)
[voipbl](http://iplists.firehol.org/?ipset=voipbl)|[VoIPBL.org](http://www.voipbl.org/) a distributed VoIP blacklist that is aimed to protects against VoIP Fraud and minimizing abuse for network that have publicly accessible PBX's. Several algorithms, external sources and manual confirmation are used before they categorize something as an attack and determine the threat level.|ipv4 hash:net|17875 subnets, 18585 unique IPs|updated every 4 hours from [this link](http://www.voipbl.org/update/)
[vxvault](http://iplists.firehol.org/?ipset=vxvault)|[VxVault](http://vxvault.net) The latest 100 additions of VxVault.|ipv4 hash:ip|45 unique IPs|updated every 12 hours from [this link](http://vxvault.net/ViriList.php?s=0&m=100)
[xforce_bccs](http://iplists.firehol.org/?ipset=xforce_bccs)|[IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/) Botnet Command and Control Servers|ipv4 hash:ip|411 unique IPs|updated every 1 day from [this link](https://api.xforce.ibmcloud.com/taxii)
[xroxy](http://iplists.firehol.org/?ipset=xroxy)|[xroxy.com](http://www.xroxy.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|63 unique IPs|updated every 1 hour from [this link](http://www.xroxy.com/proxyrss.xml)
[xroxy_1d](http://iplists.firehol.org/?ipset=xroxy_1d)|[xroxy.com](http://www.xroxy.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|246 unique IPs|updated every 1 hour from [this link](http://www.xroxy.com/proxyrss.xml)
[xroxy_30d](http://iplists.firehol.org/?ipset=xroxy_30d)|[xroxy.com](http://www.xroxy.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|894 unique IPs|updated every 1 hour from [this link](http://www.xroxy.com/proxyrss.xml)
[xroxy_7d](http://iplists.firehol.org/?ipset=xroxy_7d)|[xroxy.com](http://www.xroxy.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|568 unique IPs|updated every 1 hour from [this link](http://www.xroxy.com/proxyrss.xml)
[yoyo_adservers](http://iplists.firehol.org/?ipset=yoyo_adservers)|[Yoyo.org](http://pgl.yoyo.org/adservers/) IPs of ad servers|ipv4 hash:ip|10706 unique IPs|updated every 12 hours from [this link](http://pgl.yoyo.org/adservers/iplist.php?ipformat=plain&showintro=0&mimetype=plaintext)
[zeus](http://iplists.firehol.org/?ipset=zeus)|[Abuse.ch Zeus tracker](https://zeustracker.abuse.ch) standard, contains the same data as the ZeuS IP blocklist (zeus_badips) but with the slight difference that it doesn't exclude hijacked websites (level 2) and free web hosting providers (level 3). This means that this blocklist contains all IPv4 addresses associated with ZeuS C&Cs which are currently being tracked by ZeuS Tracker. Hence this blocklist will likely cause some false positives.|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://zeustracker.abuse.ch/blocklist.php?download=ipblocklist)
[zeus_badips](http://iplists.firehol.org/?ipset=zeus_badips)|[Abuse.ch Zeus tracker](https://zeustracker.abuse.ch) badips includes IPv4 addresses that are used by the ZeuS trojan. It is the recommened blocklist if you want to block only ZeuS IPs. It excludes IP addresses that ZeuS Tracker believes to be hijacked (level 2) or belong to a free web hosting provider (level 3). Hence the false postive rate should be much lower compared to the standard ZeuS IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://zeustracker.abuse.ch/blocklist.php?download=badips)

275659
alienvault_reputation.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

30
asprox_c2.ipset Normal file
View File

@ -0,0 +1,30 @@
#
# asprox_c2
#
# ipv4 hash:ip ipset
#
# [h3x.eu] (http://atrack.h3x.eu/) ASPROX Tracker - Asprox
# C&C Sites
#
# Maintainer : h3x.eu
# Maintainer URL : http://atrack.h3x.eu/
# List source URL : http://atrack.h3x.eu/c2
# Source File Date: Mon Nov 6 03:04:11 UTC 2017
#
# Category : malware
# Version : 1
#
# This File Date : Sun Jun 3 05:36:21 UTC 2018
# Update Frequency: 1 day
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=asprox_c2
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

167
bambenek_banjori.ipset Normal file
View File

@ -0,0 +1,167 @@
#
# bambenek_banjori
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of banjori C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/banjori-iplist.txt
# Source File Date: Wed Jul 29 20:05:53 UTC 2020
#
# Category : malware
# Version : 17534
#
# This File Date : Wed Jul 29 20:12:14 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 136 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_banjori
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
3.216.121.17
5.79.79.212
13.59.74.74
14.192.4.75
18.213.250.117
18.215.128.143
23.89.20.107
23.89.102.123
23.107.124.53
23.110.15.74
23.226.53.226
23.227.38.65
23.231.218.195
23.236.62.147
34.98.99.30
34.102.136.180
35.186.238.101
35.226.69.129
43.230.142.125
43.241.196.105
43.249.76.176
47.91.170.222
47.245.10.59
50.117.86.130
52.4.209.250
52.25.92.0
52.58.78.16
54.65.172.3
54.85.65.140
62.149.142.219
67.20.112.155
74.208.236.219
74.220.199.8
78.24.9.52
78.46.156.194
81.169.145.88
81.169.145.159
81.169.145.160
81.169.145.161
89.188.24.70
92.53.96.22
94.130.109.30
95.211.75.10
96.30.52.60
103.70.226.182
104.24.102.57
104.24.103.57
104.24.108.92
104.24.109.92
104.164.181.36
104.171.23.69
104.171.23.70
107.165.137.88
107.180.26.185
108.59.12.99
108.59.12.101
109.70.4.246
109.71.54.17
112.78.125.29
112.121.187.246
119.3.179.174
119.188.157.23
121.40.153.149
121.54.175.96
122.10.99.22
130.211.40.170
133.130.35.90
133.242.195.32
134.73.61.187
137.175.15.6
145.131.10.247
149.255.58.42
150.95.255.38
154.95.106.131
154.195.133.14
154.195.209.90
154.201.77.14
154.213.139.148
154.216.122.13
154.216.243.104
156.224.61.139
156.225.101.57
156.238.79.182
156.247.12.40
156.250.218.137
158.177.208.8
160.121.36.178
160.153.96.67
162.209.205.67
162.210.102.66
162.210.195.111
163.43.102.74
169.50.13.61
169.50.57.89
172.67.143.254
172.67.211.10
172.106.32.42
175.29.102.46
178.22.59.66
180.153.100.94
185.104.45.33
185.135.241.4
185.216.113.170
186.202.153.222
192.169.243.26
192.190.87.140
193.222.100.37
196.22.132.17
198.23.48.104
198.38.83.24
198.54.117.197
198.54.117.198
198.54.117.199
198.54.117.200
198.54.121.133
199.58.179.10
199.59.242.153
202.124.241.178
202.181.97.76
202.254.234.152
203.156.192.80
208.73.210.202
208.73.210.217
208.73.211.165
208.73.211.177
208.91.197.91
208.109.80.14
212.12.54.87
213.176.50.208
213.186.33.5
216.40.47.17
217.26.53.16
217.26.63.20
217.70.184.38
219.118.71.121
219.235.5.224

31
bambenek_bebloh.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_bebloh
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of bebloh C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/bebloh-iplist.txt
# Source File Date: Thu Jun 7 00:02:37 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:33 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_bebloh
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

517
bambenek_c2.ipset Normal file
View File

@ -0,0 +1,517 @@
#
# bambenek_c2
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) master feed of
# known, active and non-sinkholed C&Cs IP addresses
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/c2-ipmasterlist.txt
# Source File Date: Tue Apr 14 23:17:00 UTC 2020
#
# Category : malware
# Version : 16212
#
# This File Date : Tue Apr 14 23:20:06 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 486 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_c2
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
3.90.198.217
5.63.155.65
5.79.79.211
5.157.84.170
5.180.102.147
13.90.196.81
14.128.136.68
14.192.4.35
18.213.250.117
18.215.128.143
18.218.40.17
18.224.184.93
23.89.20.107
23.89.102.123
23.89.102.127
23.107.49.18
23.107.124.53
23.110.15.74
23.227.38.65
23.229.213.5
23.231.218.195
23.236.62.147
31.11.32.144
31.186.169.41
31.217.192.121
34.197.76.50
34.206.12.234
34.225.182.233
35.169.58.188
35.186.238.101
35.187.36.248
35.209.70.88
35.214.186.61
35.224.11.86
35.226.69.129
37.152.88.55
40.255.0.62
43.230.112.86
43.230.142.125
43.241.196.105
45.33.2.79
45.33.23.183
45.38.3.236
45.56.79.23
45.77.226.209
45.79.19.196
45.82.253.244
45.88.202.115
45.114.106.55
45.136.245.235
45.202.208.234
45.204.37.242
45.204.41.153
46.28.105.107
46.30.215.126
46.30.215.145
46.30.215.194
46.165.220.141
46.165.220.142
46.165.220.143
46.165.220.144
46.165.220.145
46.165.220.146
46.165.220.147
46.165.220.148
46.165.220.149
46.165.220.150
46.165.220.151
46.165.220.152
46.165.220.153
46.165.220.154
46.165.220.155
46.165.221.136
46.165.221.144
46.165.221.154
46.165.229.164
46.165.229.165
46.165.229.166
46.165.229.167
46.165.254.193
46.165.254.194
46.165.254.195
46.165.254.196
46.165.254.197
46.165.254.198
46.165.254.199
46.165.254.200
46.165.254.201
46.165.254.202
46.165.254.203
46.165.254.204
46.165.254.205
46.165.254.206
46.165.254.207
46.165.254.208
46.165.254.209
46.165.254.210
46.165.254.211
46.165.254.212
46.165.254.213
46.165.254.214
46.242.242.252
46.249.43.105
50.63.103.1
50.87.145.146
50.87.146.132
50.93.202.39
50.118.129.167
52.0.217.44
52.4.209.250
52.58.78.16
52.63.118.238
52.218.36.4
52.218.98.4
52.218.100.36
54.72.11.253
54.88.108.200
54.208.77.124
59.188.232.88
62.97.115.37
62.129.200.14
62.149.128.72
62.149.128.74
62.149.128.151
62.149.128.154
62.149.128.157
62.149.128.160
62.149.128.163
62.149.128.166
62.149.142.219
62.153.122.95
63.251.106.29
64.21.149.167
64.68.200.46
64.95.103.189
64.135.149.51
64.207.140.209
64.235.41.10
65.127.154.211
66.29.58.119
66.96.149.31
66.175.208.22
67.20.112.155
67.23.117.19
67.59.157.51
67.229.184.183
68.66.216.25
68.71.58.245
69.15.64.241
69.41.162.77
69.103.233.16
69.191.176.179
69.195.124.132
72.5.161.7
72.26.218.70
72.26.218.83
74.208.215.45
74.208.236.219
74.220.199.8
75.5.255.185
77.111.240.32
77.111.240.52
78.24.9.52
78.46.156.194
78.47.106.15
79.170.40.236
80.67.28.246
80.85.86.6
80.237.132.180
80.237.132.244
81.2.194.62
81.2.194.128
81.2.194.176
81.169.145.68
81.169.145.83
81.169.145.84
81.169.145.88
81.169.145.93
81.169.145.94
81.169.145.105
81.169.145.144
81.169.145.159
81.169.145.160
81.169.145.161
81.177.165.51
82.98.135.43
82.100.220.53
82.112.184.197
82.220.91.188
84.38.224.155
85.13.129.76
85.13.132.239
85.13.158.14
85.114.135.128
85.128.185.12
85.236.47.218
87.98.230.60
88.198.56.106
89.31.143.1
89.46.108.57
89.188.24.70
89.223.109.60
91.121.59.137
91.121.154.229
91.174.205.10
91.195.240.13
91.195.240.82
91.195.240.87
91.199.77.50
91.212.28.29
91.223.145.130
92.43.203.171
92.53.96.22
92.61.39.239
93.89.19.124
93.185.103.42
94.130.109.30
94.152.8.56
94.229.72.116
94.229.72.123
96.30.52.60
96.126.123.244
103.4.217.55
103.70.226.182
103.120.83.30
103.224.212.222
104.18.40.160
104.18.41.160
104.18.58.253
104.18.59.253
104.24.108.81
104.24.109.81
104.27.180.130
104.27.180.160
104.27.181.130
104.27.181.160
104.27.184.30
104.27.185.30
104.28.26.243
104.28.27.243
104.28.28.252
104.28.29.252
104.149.174.100
104.156.57.40
104.171.23.69
104.171.23.70
104.195.23.59
104.197.104.56
104.202.22.13
104.202.87.74
104.203.167.207
104.206.78.18
104.244.75.32
107.6.74.80
107.6.74.93
107.151.119.204
107.180.41.146
108.59.12.98
108.59.12.99
108.59.12.100
108.61.19.11
108.61.19.14
108.179.252.199
109.70.4.246
109.71.54.17
109.248.10.176
112.78.125.29
112.121.187.246
116.202.231.184
119.3.179.174
119.188.157.23
120.107.3.165
120.227.100.34
121.35.145.102
121.40.153.149
121.41.147.32
121.54.175.96
121.241.144.35
121.254.178.252
122.10.99.22
123.254.108.81
129.181.96.164
130.211.40.170
130.229.91.0
132.148.25.127
132.148.231.248
132.213.126.70
133.37.107.164
133.130.35.90
133.242.195.32
134.73.61.187
134.73.142.227
134.73.209.244
137.74.151.103
137.74.217.60
138.68.142.109
141.105.126.87
142.111.199.16
143.95.79.234
143.215.15.199
145.131.10.247
146.148.34.125
149.216.106.61
149.255.58.42
150.95.255.38
154.80.242.31
154.90.36.229
154.90.37.102
154.95.135.196
154.195.209.90
154.196.20.154
154.198.219.27
154.212.209.96
154.214.250.73
154.216.243.104
155.159.53.217
155.159.172.76
156.225.101.57
156.232.185.254
156.234.43.65
156.238.79.182
156.245.93.85
157.7.44.219
157.7.184.14
157.7.184.17
157.7.188.207
157.230.67.179
159.8.210.35
160.16.199.126
160.16.223.90
160.121.17.22
160.121.22.55
160.181.164.88
162.144.26.233
162.209.205.41
162.210.102.66
162.217.99.132
162.217.99.137
162.243.55.152
162.255.119.102
162.255.119.204
163.43.102.74
163.172.86.124
164.155.160.223
164.155.160.228
164.155.163.203
169.50.13.61
172.98.192.37
172.104.243.27
172.120.167.67
172.120.168.177
172.252.250.177
173.231.184.61
173.231.184.117
173.231.184.123
173.236.178.74
173.239.5.6
173.239.8.164
178.22.59.66
178.254.10.14
180.153.100.94
180.215.129.7
185.26.105.244
185.42.107.8
185.51.65.38
185.66.237.14
185.104.45.33
185.114.108.15
185.135.241.4
185.181.104.74
185.183.8.67
185.232.248.163
186.202.153.222
188.165.143.5
189.50.110.40
192.64.119.63
192.64.119.107
192.64.119.138
192.64.147.231
192.74.245.227
192.124.249.106
192.155.198.18
192.185.72.119
192.190.87.140
193.41.64.176
193.146.253.35
193.146.253.36
193.146.253.37
193.146.253.38
193.146.253.51
193.222.100.37
194.9.94.85
194.9.94.86
194.150.113.18
194.150.113.50
194.242.61.31
195.74.38.62
195.110.124.188
195.123.216.248
196.22.132.17
198.23.48.104
198.38.83.24
198.54.117.197
198.54.117.198
198.54.117.199
198.54.117.200
198.54.121.133
198.58.118.167
199.34.228.76
199.58.179.10
199.59.242.153
202.124.241.178
202.181.97.76
202.254.234.152
203.88.111.122
203.156.192.80
205.144.171.124
206.189.61.126
207.10.232.16
207.10.232.21
208.73.210.202
208.73.210.217
208.73.211.165
208.73.211.177
208.91.197.26
208.91.197.27
208.91.197.66
208.91.197.91
208.109.80.14
209.99.40.222
209.99.40.223
209.99.64.33
209.140.30.61
209.160.65.66
210.172.183.32
211.43.203.53
212.12.54.87
212.57.32.149
212.85.106.71
213.176.50.208
213.186.33.5
213.186.33.19
213.186.33.87
213.247.47.190
216.40.47.17
217.20.116.129
217.20.116.130
217.20.116.131
217.20.116.132
217.20.116.133
217.20.116.134
217.20.116.135
217.20.116.136
217.20.116.137
217.20.116.138
217.20.116.139
217.20.116.140
217.20.116.141
217.20.116.142
217.20.116.143
217.20.116.145
217.20.116.146
217.20.116.147
217.20.116.148
217.20.116.149
217.20.116.150
217.20.116.151
217.20.116.152
217.20.116.153
217.26.53.16
217.26.63.20
217.70.184.38
217.74.71.168
217.116.16.235
217.160.0.27
217.160.0.59
217.160.0.169
217.160.0.225
217.160.0.231
217.160.0.239
217.160.122.61
217.160.223.127
217.160.233.84
219.94.129.157
219.235.5.224
220.158.225.187

31
bambenek_cl.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_cl
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of cl C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/cl-iplist.txt
# Source File Date: Fri Dec 14 00:05:01 UTC 2018
#
# Category : malware
# Version : 18
#
# This File Date : Fri Dec 14 00:08:08 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_cl
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

31
bambenek_cryptowall.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_cryptowall
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of cryptowall C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/cryptowall-iplist.txt
# Source File Date: Thu Dec 3 12:25:05 UTC 2015
#
# Category : malware
# Version : 5
#
# This File Date : Thu Jun 7 00:08:34 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_cryptowall
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

33
bambenek_dircrypt.ipset Normal file
View File

@ -0,0 +1,33 @@
#
# bambenek_dircrypt
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of dircrypt C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/dircrypt-iplist.txt
# Source File Date: Sat Jul 18 09:06:23 UTC 2020
#
# Category : malware
# Version : 260
#
# This File Date : Sat Jul 18 09:08:07 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 2 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_dircrypt
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
164.155.216.36
169.50.13.61

31
bambenek_dyre.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_dyre
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of dyre C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/dyre-iplist.txt
# Source File Date: Thu Jun 7 00:03:08 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:34 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_dyre
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

31
bambenek_geodo.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_geodo
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of geodo C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/geodo-iplist.txt
# Source File Date: Thu Jun 7 00:02:33 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:34 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_geodo
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

33
bambenek_hesperbot.ipset Normal file
View File

@ -0,0 +1,33 @@
#
# bambenek_hesperbot
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of hesperbot C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/hesperbot-iplist.txt
# Source File Date: Sat Jul 18 10:07:53 UTC 2020
#
# Category : malware
# Version : 234
#
# This File Date : Sat Jul 18 10:12:32 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 2 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_hesperbot
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
72.5.161.7
164.155.219.11

32
bambenek_matsnu.ipset Normal file
View File

@ -0,0 +1,32 @@
#
# bambenek_matsnu
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of matsnu C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/matsnu-iplist.txt
# Source File Date: Mon Jul 27 04:09:06 UTC 2020
#
# Category : malware
# Version : 522
#
# This File Date : Mon Jul 27 04:12:41 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_matsnu
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
64.207.152.130

44
bambenek_necurs.ipset Normal file
View File

@ -0,0 +1,44 @@
#
# bambenek_necurs
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of necurs C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/necurs-iplist.txt
# Source File Date: Wed Jul 29 01:11:02 UTC 2020
#
# Category : malware
# Version : 10186
#
# This File Date : Wed Jul 29 01:16:08 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 13 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_necurs
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
40.121.206.97
64.47.209.23
64.63.188.85
64.231.250.149
65.79.10.48
65.159.138.178
66.7.34.215
66.247.157.54
68.199.246.20
69.47.125.180
69.79.159.208
70.23.145.183
70.63.91.183

31
bambenek_p2pgoz.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_p2pgoz
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of p2pgoz C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/p2pgoz-iplist.txt
# Source File Date: Sun Jul 26 15:10:57 UTC 2020
#
# Category : malware
# Version : 478
#
# This File Date : Sun Jul 26 15:16:09 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_p2pgoz
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

31
bambenek_pushdo.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_pushdo
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of pushdo C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/pushdo-iplist.txt
# Source File Date: Sat Jun 20 05:15:31 UTC 2020
#
# Category : malware
# Version : 12
#
# This File Date : Sat Jun 20 05:20:06 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_pushdo
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

36
bambenek_pykspa.ipset Normal file
View File

@ -0,0 +1,36 @@
#
# bambenek_pykspa
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of pykspa C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/pykspa-iplist.txt
# Source File Date: Wed Jul 29 04:13:10 UTC 2020
#
# Category : malware
# Version : 1373
#
# This File Date : Wed Jul 29 04:16:06 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 5 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_pykspa
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
40.255.0.62
78.47.106.15
169.50.13.61
189.50.110.40
193.146.253.37

33
bambenek_qakbot.ipset Normal file
View File

@ -0,0 +1,33 @@
#
# bambenek_qakbot
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of qakbot C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/qakbot-iplist.txt
# Source File Date: Sun Jul 26 12:13:39 UTC 2020
#
# Category : malware
# Version : 453
#
# This File Date : Sun Jul 26 12:16:47 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 2 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_qakbot
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
72.26.218.72
199.21.76.82

129
bambenek_ramnit.ipset Normal file
View File

@ -0,0 +1,129 @@
#
# bambenek_ramnit
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of ramnit C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/ramnit-iplist.txt
# Source File Date: Wed Jul 29 20:18:04 UTC 2020
#
# Category : malware
# Version : 3671
#
# This File Date : Wed Jul 29 20:24:06 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 98 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_ramnit
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.180.102.147
13.90.196.81
18.213.250.117
18.215.128.143
34.197.76.50
34.225.182.233
35.224.11.86
46.17.47.67
46.165.220.141
46.165.220.142
46.165.220.143
46.165.220.144
46.165.220.145
46.165.220.146
46.165.220.147
46.165.220.148
46.165.220.149
46.165.220.150
46.165.220.151
46.165.220.152
46.165.220.153
46.165.220.154
46.165.220.155
46.165.221.136
46.165.221.144
46.165.221.154
46.165.229.164
46.165.229.165
46.165.229.166
46.165.229.167
46.165.254.193
46.165.254.194
46.165.254.195
46.165.254.196
46.165.254.197
46.165.254.198
46.165.254.199
46.165.254.200
46.165.254.201
46.165.254.202
46.165.254.203
46.165.254.204
46.165.254.205
46.165.254.206
46.165.254.207
46.165.254.208
46.165.254.209
46.165.254.210
46.165.254.211
46.165.254.212
46.165.254.213
46.165.254.214
47.91.170.222
52.4.209.250
72.26.218.70
82.112.184.197
88.212.208.67
109.248.10.176
154.216.211.122
160.16.199.126
160.16.223.90
164.155.216.31
169.50.13.61
173.239.5.6
173.239.8.164
178.33.69.68
193.146.253.36
193.146.253.38
193.146.253.44
194.67.71.41
194.67.71.114
208.91.197.66
213.186.33.19
213.247.47.190
217.20.116.129
217.20.116.130
217.20.116.131
217.20.116.132
217.20.116.133
217.20.116.134
217.20.116.135
217.20.116.136
217.20.116.137
217.20.116.138
217.20.116.139
217.20.116.140
217.20.116.141
217.20.116.142
217.20.116.143
217.20.116.145
217.20.116.146
217.20.116.147
217.20.116.148
217.20.116.149
217.20.116.150
217.20.116.151
217.20.116.152
217.20.116.153

31
bambenek_ranbyus.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_ranbyus
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of ranbyus C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/ranbyus-iplist.txt
# Source File Date: Thu Feb 14 14:06:27 UTC 2019
#
# Category : malware
# Version : 101
#
# This File Date : Thu Feb 14 14:12:10 UTC 2019
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_ranbyus
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

162
bambenek_simda.ipset Normal file
View File

@ -0,0 +1,162 @@
#
# bambenek_simda
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of simda C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/simda-iplist.txt
# Source File Date: Wed Jul 29 20:19:03 UTC 2020
#
# Category : malware
# Version : 17362
#
# This File Date : Wed Jul 29 20:24:07 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 131 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_simda
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.157.84.170
14.128.136.68
23.89.102.127
23.236.62.147
31.11.32.144
31.186.169.41
31.217.192.121
34.98.99.30
34.102.136.180
45.82.253.244
46.28.105.107
46.30.215.127
46.30.215.202
46.242.242.252
46.249.43.105
52.25.92.0
52.58.78.16
54.65.172.3
62.97.115.37
62.129.200.14
62.149.128.72
62.149.128.74
62.149.128.151
62.149.128.154
62.149.128.157
62.149.128.160
62.149.128.163
62.149.128.166
62.149.181.236
62.153.122.95
67.229.36.115
69.162.80.54
69.162.80.58
77.111.240.49
77.111.240.59
79.170.40.236
80.85.86.6
80.237.132.180
81.2.194.62
81.2.194.128
81.2.194.176
81.169.145.68
81.169.145.84
81.169.145.93
81.169.145.94
81.169.145.105
81.169.145.161
81.177.165.51
82.98.135.43
82.100.220.53
84.38.224.155
85.13.129.76
85.13.132.239
85.114.135.128
85.128.185.12
85.236.47.218
87.98.230.60
88.198.56.106
89.31.143.1
89.46.108.57
91.121.59.137
91.121.154.229
91.174.205.10
91.195.241.136
91.199.77.50
91.212.28.29
91.223.145.130
92.43.203.171
92.61.39.239
93.185.103.42
93.190.48.3
94.152.8.56
95.211.117.215
95.211.219.65
104.27.180.160
104.27.181.160
104.28.26.243
104.28.27.243
104.28.28.252
104.28.29.252
116.202.231.184
141.105.126.87
146.148.34.125
149.216.106.61
157.7.188.207
162.217.99.134
162.255.119.102
163.172.86.124
169.50.13.61
172.67.156.67
172.67.157.206
172.67.184.127
173.236.178.74
178.254.10.14
185.26.105.244
185.51.65.38
185.66.237.14
185.114.108.15
185.181.104.74
185.183.8.67
185.232.248.163
188.93.150.101
188.165.143.5
192.64.147.231
193.41.64.176
194.9.94.85
194.9.94.86
194.150.113.18
194.242.61.31
195.74.38.62
195.110.124.188
199.34.228.76
199.59.242.153
205.144.171.124
208.91.197.91
209.140.30.61
210.172.183.32
211.43.203.53
212.57.32.149
212.85.106.71
213.186.33.5
217.70.184.38
217.74.71.168
217.116.16.235
217.160.0.59
217.160.0.97
217.160.0.169
217.160.0.225
217.160.0.239
217.160.122.61
217.160.233.84

139
bambenek_suppobox.ipset Normal file
View File

@ -0,0 +1,139 @@
#
# bambenek_suppobox
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of suppobox C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/suppobox-iplist.txt
# Source File Date: Wed Jul 29 20:19:32 UTC 2020
#
# Category : malware
# Version : 9682
#
# This File Date : Wed Jul 29 20:24:08 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 108 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_suppobox
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
18.216.20.136
23.83.35.75
23.227.38.65
23.236.62.147
34.102.136.180
34.198.7.77
34.202.122.77
34.225.38.128
35.169.225.248
35.186.238.101
35.231.184.193
39.106.40.57
43.226.23.42
45.133.2.132
45.192.23.245
45.199.245.19
46.30.213.209
46.166.189.98
52.0.7.30
54.36.56.87
54.84.104.245
62.233.121.5
63.251.235.71
66.6.44.4
66.96.161.157
67.195.197.24
67.227.226.240
69.163.184.176
69.172.201.218
72.26.218.72
74.96.70.52
74.208.236.135
75.2.37.224
80.77.123.65
81.28.232.67
83.140.241.13
84.49.232.107
87.98.242.65
89.106.12.49
94.136.40.82
95.143.172.148
97.74.182.1
98.124.199.77
103.67.235.120
104.16.12.194
104.16.13.194
104.16.14.194
104.16.15.194
104.16.16.194
104.27.188.229
104.27.189.229
104.248.50.87
104.248.60.43
104.248.63.231
104.248.63.248
106.249.28.73
112.216.156.206
121.42.239.99
121.78.197.82
121.254.178.233
137.220.193.208
138.207.69.72
139.129.156.33
150.95.255.38
151.80.184.231
154.208.167.236
157.65.171.29
157.245.130.6
159.8.210.35
161.47.102.211
162.217.99.134
162.217.99.139
162.217.99.141
162.241.194.34
162.241.224.134
162.241.224.200
162.243.212.245
162.255.119.8
162.255.119.250
172.67.154.177
173.231.184.119
173.231.189.30
173.236.166.37
185.55.85.123
192.64.119.20
192.64.119.148
192.64.119.202
192.227.107.19
193.93.253.54
194.59.222.76
198.54.117.197
198.54.117.198
198.54.117.199
198.54.117.200
199.34.228.69
199.59.242.153
206.191.152.37
206.191.152.49
207.96.1.77
208.91.197.26
208.91.197.27
208.91.197.46
208.91.197.91
208.91.197.194
212.96.137.160
213.186.33.5
213.250.113.193
217.160.0.16

32
bambenek_symmi.ipset Normal file
View File

@ -0,0 +1,32 @@
#
# bambenek_symmi
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of symmi C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/symmi-iplist.txt
# Source File Date: Fri Jun 26 10:49:11 UTC 2020
#
# Category : malware
# Version : 14
#
# This File Date : Fri Jun 26 10:56:26 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_symmi
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
208.100.26.245

35
bambenek_tinba.ipset Normal file
View File

@ -0,0 +1,35 @@
#
# bambenek_tinba
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of tinba C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/tinba-iplist.txt
# Source File Date: Wed Jul 29 16:20:23 UTC 2020
#
# Category : malware
# Version : 3576
#
# This File Date : Wed Jul 29 16:24:10 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 4 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_tinba
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
198.54.117.197
198.54.117.198
198.54.117.199
198.54.117.200

32
bambenek_volatile.ipset Normal file
View File

@ -0,0 +1,32 @@
#
# bambenek_volatile
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of volatile C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/volatile-iplist.txt
# Source File Date: Fri Feb 7 15:08:38 UTC 2020
#
# Category : malware
# Version : 10
#
# This File Date : Fri Feb 7 15:12:21 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_volatile
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
169.50.13.61

2717
bbcan177_ms1.netset Normal file
View File

File diff suppressed because it is too large Load Diff

1175
bbcan177_ms3.netset Normal file
View File

File diff suppressed because it is too large Load Diff

4732
bds_atif.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

20458
bi_any_0_1d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

1031
bi_any_1_7d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

340
bi_any_2_1d.ipset Normal file
View File

@ -0,0 +1,340 @@
#
# bi_any_2_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# any with score above 2 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/any/2?age=1d
# Source File Date: Fri Aug 14 10:20:08 UTC 2020
#
# Category : attacks
# Version : 34380
#
# This File Date : Fri Aug 14 10:20:08 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 310 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_any_2_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.179.182.186
5.135.177.168
5.196.67.41
13.75.158.218
14.63.167.192
31.173.168.226
31.185.104.19
31.185.104.20
31.185.104.21
36.66.69.33
36.67.106.109
36.80.48.9
36.84.80.31
37.49.224.14
37.49.224.79
37.49.224.160
37.49.226.129
37.187.181.182
41.33.229.210
41.72.197.182
46.29.248.238
46.59.11.243
46.148.20.25
46.148.21.32
46.148.192.41
46.182.106.190
49.68.146.28
49.254.216.241
51.254.37.192
51.254.120.159
51.254.220.20
51.255.35.58
52.178.134.11
54.36.182.244
54.37.69.251
54.37.232.137
54.38.33.186
54.38.183.181
58.17.243.151
58.210.96.156
58.213.88.82
58.250.79.7
58.250.164.246
60.2.10.190
60.18.243.94
60.167.113.42
60.191.38.77
61.12.38.162
61.72.255.26
61.76.169.138
61.144.195.209
61.161.209.134
61.177.172.13
61.177.172.41
61.177.172.54
61.177.172.61
61.183.144.188
61.189.243.28
62.24.104.71
62.94.206.57
62.210.37.82
62.210.105.116
64.113.32.29
66.11.32.201
66.240.205.34
66.240.219.146
66.249.73.149
66.249.73.151
66.249.73.153
69.30.213.138
69.172.87.212
70.98.78.129
70.98.78.130
77.82.90.234
77.247.181.162
77.247.181.163
77.247.181.165
78.131.56.62
78.195.178.119
78.229.158.27
78.252.42.110
79.137.79.167
80.21.147.85
80.67.172.162
80.82.70.118
80.82.78.85
80.82.78.104
80.93.96.26
80.229.253.212
81.133.189.239
81.142.80.97
82.64.15.106
82.145.72.180
82.200.65.218
82.200.226.226
83.12.107.106
83.240.247.202
85.95.185.78
85.114.107.230
89.97.218.142
89.234.157.254
89.248.172.16
91.121.67.107
91.121.91.82
91.121.156.27
91.134.140.32
91.134.173.103
92.222.70.236
92.222.84.15
93.63.150.10
93.126.11.249
93.174.93.133
93.174.93.143
94.23.145.124
94.102.51.78
94.102.56.238
94.181.94.12
95.85.30.24
95.128.43.164
95.142.161.63
95.167.39.12
96.57.82.166
97.74.237.196
101.69.200.162
101.251.197.238
103.4.217.139
103.23.100.87
103.43.185.166
103.89.90.42
103.205.68.2
103.207.36.223
103.234.220.197
104.236.63.99
106.38.99.158
107.170.63.221
107.170.227.141
109.227.63.3
111.11.181.53
111.93.205.186
111.93.235.74
111.230.157.219
112.80.35.2
112.85.42.194
112.215.113.10
115.84.91.63
115.88.201.58
115.238.97.2
117.144.189.69
117.232.127.51
118.24.8.99
118.25.44.66
118.25.96.30
118.89.231.109
118.194.132.112
119.29.2.157
119.252.170.2
120.92.173.154
120.192.90.182
121.12.151.250
121.18.39.22
121.186.122.216
122.227.159.84
123.30.149.76
123.138.199.66
123.206.226.149
123.206.255.17
123.207.74.24
124.235.171.114
125.19.153.156
125.43.69.155
125.160.17.32
125.212.233.50
125.227.236.60
129.122.16.156
138.68.226.234
138.197.164.222
138.246.253.15
139.99.105.138
139.162.122.110
139.199.14.128
142.4.204.122
142.4.214.151
144.217.42.212
145.239.76.62
148.215.18.103
149.56.15.98
149.56.23.154
149.202.56.228
151.80.41.64
151.80.155.98
157.55.39.15
157.55.39.23
157.55.39.32
158.69.194.115
162.243.158.198
162.247.72.199
163.44.197.189
163.121.250.2
163.172.49.56
163.172.185.51
164.132.47.139
164.132.51.91
164.132.56.243
164.132.225.151
164.163.99.10
165.227.124.168
165.227.194.176
171.25.193.20
171.25.193.25
171.25.193.77
171.25.193.78
175.207.13.22
176.31.128.45
177.124.184.44
178.20.55.16
178.20.55.18
180.76.160.50
180.76.232.80
180.97.80.246
180.166.192.66
181.40.76.162
181.53.251.181
181.62.248.12
182.74.25.246
182.75.33.14
185.100.85.61
185.100.87.206
185.100.87.207
185.107.47.171
185.117.215.9
185.129.62.62
185.165.168.229
185.181.102.18
185.220.100.252
185.220.101.6
185.220.102.4
185.220.102.6
185.220.102.7
185.220.102.8
185.234.217.39
185.234.217.41
187.58.132.251
188.35.187.50
188.166.1.95
188.214.104.146
188.240.208.26
189.59.5.81
189.59.69.3
190.13.106.123
190.64.135.122
190.98.228.54
190.144.14.170
192.0.2.1
192.42.116.13
192.42.116.16
192.42.116.22
192.169.200.145
193.112.42.13
193.112.191.228
194.105.205.42
195.176.3.19
195.254.135.76
196.38.70.24
196.52.43.66
198.96.155.3
200.44.50.155
200.69.218.197
200.119.112.204
200.204.174.163
201.22.95.52
201.91.86.28
201.184.169.106
202.55.72.10
202.57.11.126
202.131.152.2
202.152.21.213
203.66.168.81
203.213.66.170
203.236.51.35
206.174.214.90
206.189.127.6
210.12.127.66
210.21.226.2
211.147.216.19
211.253.10.96
212.21.66.6
212.170.50.203
213.158.29.179
216.218.134.12
216.239.90.19
217.170.198.18
218.2.197.240
218.17.162.119
218.28.238.162
218.153.168.50
219.239.47.66
220.120.106.254
221.7.213.133
221.12.100.170
221.143.48.143
221.207.32.250
222.186.15.62
222.186.15.158
222.186.15.246
222.186.30.76
222.186.30.112
222.186.42.57
222.186.42.213
222.186.190.14
223.197.188.206

6945
bi_any_2_30d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

771
bi_any_2_7d.ipset Normal file
View File

@ -0,0 +1,771 @@
#
# bi_any_2_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# any with score above 2 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/any/2?age=7d
# Source File Date: Fri Aug 14 08:32:09 UTC 2020
#
# Category : attacks
# Version : 3098
#
# This File Date : Fri Aug 14 08:32:09 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 741 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_any_2_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.9.21.100
1.34.164.204
1.119.10.198
1.179.182.82
1.179.182.186
1.202.165.40
2.139.209.78
2.237.133.169
5.8.10.202
5.88.161.197
5.135.177.168
5.188.211.13
5.188.211.15
5.189.146.133
5.196.67.41
5.196.68.145
5.196.95.183
5.249.149.30
13.75.158.218
14.63.167.192
14.232.160.213
31.27.38.242
31.173.168.226
31.184.194.114
31.185.104.19
31.185.104.20
31.185.104.21
35.0.127.52
36.66.69.33
36.67.106.109
36.80.48.9
36.84.80.31
37.49.224.14
37.49.224.79
37.49.224.109
37.49.224.113
37.49.224.114
37.49.224.155
37.49.224.157
37.49.224.160
37.49.224.162
37.49.224.174
37.49.224.185
37.49.224.186
37.49.224.189
37.49.224.204
37.49.224.226
37.49.224.240
37.49.226.129
37.49.230.113
37.59.66.56
37.187.0.20
37.187.114.136
37.187.125.87
37.187.181.182
37.187.252.148
41.21.200.254
41.39.134.88
41.67.59.14
41.72.197.182
41.85.161.132
41.128.185.155
41.208.150.114
41.210.128.37
41.223.142.211
41.228.12.149
46.29.248.238
46.59.11.243
46.148.20.25
46.148.21.32
46.148.192.41
46.182.106.190
47.88.159.100
47.91.92.228
47.94.210.211
49.68.146.28
49.204.80.198
49.254.216.241
51.15.80.14
51.38.51.200
51.254.37.192
51.254.120.159
51.254.220.20
51.255.35.58
52.178.134.11
52.191.210.85
54.36.182.244
54.37.69.251
54.37.232.137
54.38.33.186
54.38.183.181
54.149.191.237
58.17.243.151
58.58.26.66
58.210.96.156
58.213.88.82
58.216.218.236
58.250.79.7
58.250.164.246
60.2.10.190
60.18.243.94
60.30.73.250
60.51.166.197
60.144.94.199
60.167.113.42
60.191.38.77
61.12.38.162
61.37.150.6
61.72.255.26
61.76.169.138
61.144.195.209
61.148.16.162
61.161.209.134
61.177.172.13
61.177.172.41
61.177.172.54
61.177.172.61
61.183.144.188
61.189.243.28
62.24.104.71
62.94.206.57
62.122.103.86
62.210.37.82
62.210.105.116
62.210.185.4
62.219.208.63
64.113.32.29
66.11.32.201
66.240.192.138
66.240.205.34
66.240.219.146
66.249.66.203
66.249.66.205
66.249.66.207
66.249.69.222
66.249.73.149
66.249.73.151
66.249.73.153
69.30.213.138
69.172.87.212
70.98.78.129
70.98.78.130
70.98.78.135
71.6.146.130
71.6.146.186
74.82.47.3
76.72.169.18
77.82.90.234
77.131.145.74
77.247.181.162
77.247.181.163
77.247.181.165
78.131.56.62
78.195.178.119
78.222.13.216
78.229.158.27
78.252.42.110
79.137.79.167
80.21.147.85
80.67.172.162
80.82.64.134
80.82.70.118
80.82.77.33
80.82.77.139
80.82.78.85
80.82.78.104
80.93.96.26
80.211.232.174
80.229.253.212
81.133.189.239
81.142.80.97
82.64.15.106
82.85.143.181
82.117.216.38
82.145.72.180
82.200.65.218
82.200.226.226
82.208.65.46
82.221.105.6
83.12.107.106
83.169.208.218
83.221.223.108
83.240.247.202
84.236.2.26
85.95.185.78
85.114.107.230
85.233.150.13
85.248.227.163
85.248.227.164
85.248.227.165
89.97.218.142
89.234.157.254
89.248.172.16
89.248.172.90
91.121.67.107
91.121.91.82
91.121.156.27
91.134.140.32
91.134.173.103
91.229.20.91
92.62.131.124
92.222.70.236
92.222.84.15
93.63.150.10
93.97.219.82
93.126.11.249
93.174.93.133
93.174.93.143
93.174.95.106
93.189.27.197
94.23.145.124
94.23.196.177
94.23.218.10
94.102.49.7
94.102.51.78
94.102.56.151
94.102.56.181
94.102.56.238
94.125.122.90
94.181.94.12
95.77.99.194
95.85.30.24
95.128.43.164
95.142.161.63
95.167.39.12
96.47.10.53
96.57.82.166
96.125.228.110
97.74.237.196
101.28.247.133
101.68.81.66
101.69.200.162
101.71.130.200
101.230.211.162
101.231.101.140
101.231.154.154
101.231.241.170
101.251.197.238
103.1.40.189
103.4.217.139
103.9.22.94
103.9.88.249
103.10.168.254
103.14.229.253
103.23.100.87
103.27.238.202
103.28.38.166
103.28.219.152
103.28.225.131
103.36.84.100
103.43.185.166
103.47.184.22
103.51.153.235
103.68.38.86
103.76.252.6
103.78.159.6
103.84.238.240
103.89.90.42
103.202.132.175
103.205.68.2
103.207.36.223
103.207.37.60
103.207.39.67
103.216.60.85
103.219.61.2
103.225.124.29
103.231.78.221
103.234.220.197
103.242.56.122
103.242.175.60
103.244.82.231
103.249.100.12
103.249.100.22
103.249.205.78
103.251.221.22
103.252.50.15
104.52.24.81
104.131.57.64
104.236.63.99
104.236.64.223
104.236.119.79
104.236.198.255
104.236.246.16
104.238.92.100
104.245.147.82
105.67.10.10
106.38.3.253
106.38.99.158
106.51.230.186
106.75.107.146
106.120.216.2
106.243.87.162
107.170.48.64
107.170.63.221
107.170.227.141
108.58.41.139
109.173.40.60
109.190.77.152
109.194.19.243
109.195.198.27
109.227.63.3
110.170.166.101
111.10.24.147
111.11.181.53
111.40.87.150
111.68.46.68
111.93.58.18
111.93.205.186
111.93.235.74
111.230.140.177
111.230.157.219
111.230.247.243
111.231.119.141
112.80.35.2
112.85.42.194
112.95.225.158
112.215.113.10
113.53.232.245
113.98.193.58
113.160.178.148
113.160.224.28
113.161.4.51
114.34.75.88
114.134.88.138
114.199.112.138
114.241.52.2
115.84.91.63
115.84.105.146
115.84.112.138
115.88.201.58
115.133.128.125
115.159.25.60
115.178.73.2
115.238.97.2
116.117.157.69
116.196.99.241
117.50.13.29
117.66.243.77
117.102.76.182
117.107.163.240
117.144.189.69
117.232.127.50
117.232.127.51
118.24.8.99
118.25.44.66
118.25.96.30
118.89.231.109
118.98.127.138
118.122.92.219
118.126.105.120
118.163.58.117
118.163.97.19
118.163.135.17
118.163.135.18
118.194.132.112
118.228.152.210
119.29.2.157
119.29.10.25
119.29.89.242
119.29.135.216
119.29.170.170
119.29.170.202
119.252.170.2
120.92.173.154
120.188.87.21
120.192.90.182
120.194.7.10
120.197.183.123
121.12.151.250
121.14.43.169
121.18.39.22
121.58.192.58
121.128.135.73
121.186.122.216
122.14.217.58
122.152.210.200
122.176.40.9
122.224.203.228
122.227.159.84
123.30.149.76
123.127.107.70
123.138.199.66
123.206.226.149
123.206.255.17
123.207.74.24
124.193.185.98
124.235.171.114
125.19.153.156
125.43.69.155
125.160.17.32
125.212.207.205
125.212.233.50
125.227.236.60
128.199.118.27
129.122.16.156
131.108.156.69
137.226.113.10
138.68.85.35
138.68.226.234
138.118.214.71
138.197.164.222
138.246.253.15
139.59.65.173
139.99.105.138
139.159.3.18
139.162.75.112
139.162.99.243
139.162.122.110
139.199.8.208
139.199.14.128
139.199.45.89
139.199.112.85
139.220.192.57
140.143.223.242
140.143.241.251
140.143.250.121
142.4.204.122
142.4.214.151
144.16.2.2
144.217.42.212
145.239.76.62
148.215.18.103
149.56.15.98
149.56.23.154
149.202.56.228
150.95.135.190
151.80.41.64
151.80.155.98
151.237.50.158
154.66.219.20
157.55.39.15
157.55.39.23
157.55.39.32
157.55.39.138
157.55.39.167
158.69.64.9
158.69.194.115
158.140.140.32
162.243.55.188
162.243.158.198
162.247.72.199
163.44.197.189
163.121.250.2
163.172.49.56
163.172.180.76
163.172.185.51
163.172.216.91
164.52.24.164
164.52.24.168
164.132.24.138
164.132.47.139
164.132.51.91
164.132.56.243
164.132.225.151
164.163.99.10
165.227.124.168
165.227.194.176
166.70.207.2
169.255.5.138
171.25.193.20
171.25.193.25
171.25.193.77
171.25.193.78
171.25.193.235
171.221.210.158
173.212.197.48
173.212.205.145
175.207.13.22
176.10.99.200
176.10.107.180
176.31.128.45
177.19.164.149
177.19.187.79
177.22.91.247
177.43.251.153
177.69.104.168
177.124.184.44
177.135.101.5
177.135.101.101
177.135.103.94
178.20.55.16
178.20.55.18
178.32.219.209
178.33.45.156
178.73.215.171
179.107.111.106
179.190.96.146
179.232.1.252
180.76.135.236
180.76.160.50
180.76.162.111
180.76.174.246
180.76.187.94
180.76.232.80
180.76.246.38
180.97.80.246
180.166.192.66
180.250.210.165
181.40.76.162
181.48.79.178
181.53.251.181
181.55.94.22
181.55.188.187
181.62.248.12
181.118.94.57
181.129.14.218
182.18.180.44
182.73.222.70
182.74.25.246
182.75.33.14
183.82.0.15
183.87.157.202
183.102.114.251
183.196.172.36
183.234.11.43
184.105.247.196
185.9.230.228
185.14.187.133
185.43.108.138
185.53.168.96
185.100.85.61
185.100.86.154
185.100.87.190
185.100.87.206
185.100.87.207
185.100.87.245
185.100.87.246
185.100.87.247
185.100.87.248
185.100.87.249
185.100.87.250
185.107.47.171
185.117.215.9
185.129.62.62
185.143.223.135
185.165.168.229
185.181.102.18
185.190.98.230
185.210.218.108
185.220.100.252
185.220.100.253
185.220.101.1
185.220.101.6
185.220.101.8
185.220.101.9
185.220.101.10
185.220.101.12
185.220.101.13
185.220.101.20
185.220.102.4
185.220.102.6
185.220.102.7
185.220.102.8
185.234.217.39
185.234.217.41
185.234.217.61
186.5.109.211
186.87.32.48
186.112.214.158
186.215.130.159
186.215.130.242
186.215.143.149
186.215.195.249
186.215.197.15
186.215.198.137
187.58.132.251
187.58.134.87
187.58.139.171
187.60.36.104
187.190.236.88
187.216.113.99
187.217.199.20
188.11.67.165
188.35.187.50
188.165.221.36
188.165.235.21
188.166.1.95
188.166.34.129
188.166.230.236
188.214.104.146
188.240.208.26
189.28.166.216
189.59.5.81
189.59.69.3
189.90.255.173
189.112.109.185
189.114.67.195
190.3.179.66
190.52.166.83
190.64.135.122
190.85.108.186
190.98.228.54
190.144.14.170
190.145.5.170
190.202.44.194
190.210.182.93
191.96.51.36
192.0.2.1
192.42.116.13
192.42.116.16
192.42.116.22
192.160.102.165
192.160.102.168
192.160.102.169
192.169.200.145
193.58.196.146
193.70.0.42
193.70.6.197
193.110.157.151
193.112.42.13
193.112.191.228
193.201.224.82
193.201.224.236
194.105.205.42
194.143.231.202
195.81.64.102
195.158.29.222
195.176.3.19
195.176.3.20
195.178.222.29
195.208.185.27
195.254.135.76
196.38.70.24
196.52.43.62
196.52.43.66
198.12.90.154
198.50.180.172
198.96.155.3
199.87.154.255
200.6.188.38
200.6.251.100
200.37.97.194
200.44.50.155
200.69.218.197
200.110.172.2
200.119.112.204
200.126.102.218
200.175.104.103
200.195.171.74
200.199.114.226
200.204.166.143
200.204.174.163
200.216.31.20
201.22.95.52
201.91.86.28
201.134.248.44
201.140.110.78
201.184.137.194
201.184.169.106
201.184.241.243
202.51.110.214
202.55.72.10
202.57.11.126
202.88.252.53
202.131.152.2
202.152.21.213
203.66.168.81
203.81.78.180
203.154.162.168
203.213.66.170
203.236.51.35
206.174.214.90
206.189.127.6
207.46.13.71
207.194.35.197
207.244.70.35
208.100.26.229
208.100.26.230
208.100.26.231
208.100.26.232
208.100.26.233
208.100.26.235
208.100.26.236
208.100.26.237
210.12.127.66
210.21.226.2
210.206.92.137
211.20.181.113
211.41.100.89
211.75.13.207
211.147.216.19
211.155.225.104
211.159.154.136
211.253.10.96
212.16.104.33
212.21.66.6
212.34.228.170
212.170.50.203
212.227.126.131
212.227.126.134
212.227.126.187
213.32.52.1
213.158.29.179
216.218.134.12
216.239.90.19
217.23.74.198
217.77.221.85
217.79.34.202
217.115.10.132
217.170.198.18
217.182.76.241
218.2.197.240
218.17.162.119
218.19.252.203
218.22.100.42
218.28.238.162
218.56.11.181
218.69.16.26
218.75.132.59
218.153.168.50
218.200.235.178
218.249.69.210
219.142.19.70
219.153.31.186
219.239.47.66
220.120.106.254
220.130.148.106
220.231.47.58
220.247.235.48
221.7.213.133
221.12.100.170
221.143.48.143
221.207.32.250
222.122.179.208
222.184.30.6
222.185.231.246
222.186.15.62
222.186.15.158
222.186.15.246
222.186.30.76
222.186.30.112
222.186.31.136
222.186.42.57
222.186.42.213
222.186.190.14
222.211.78.73
223.71.139.98
223.71.139.186
223.85.222.251
223.112.190.70
223.197.188.206

42
bi_apache-404_0_1d.ipset Normal file
View File

@ -0,0 +1,42 @@
#
# bi_apache-404_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# apache-404 with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/apache-404/0?age=1d
# Source File Date: Fri Aug 14 08:24:37 UTC 2020
#
# Category : attacks
# Version : 3359
#
# This File Date : Fri Aug 14 08:24:37 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 12 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_apache-404_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
40.74.87.111
79.142.76.206
80.82.65.62
84.16.248.172
91.123.157.56
93.158.66.42
93.158.66.43
93.158.66.45
93.158.66.47
93.158.66.50
118.24.233.67
216.244.66.227

39
bi_apache-modsec_0_1d.ipset Normal file
View File

@ -0,0 +1,39 @@
#
# bi_apache-modsec_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# apache-modsec with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/apache-modsec/0?age=1d
# Source File Date: Mon May 11 19:48:08 UTC 2020
#
# Category : attacks
# Version : 11439
#
# This File Date : Mon May 11 19:48:08 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 9 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_apache-modsec_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
45.227.255.227
67.205.168.118
68.183.33.11
92.253.200.145
138.201.130.12
159.89.137.243
171.25.193.77
185.30.32.51
204.8.156.142

66
bi_apache-noscript_0_1d.ipset Normal file
View File

@ -0,0 +1,66 @@
#
# bi_apache-noscript_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# apache-noscript with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/apache-noscript/0?age=1d
# Source File Date: Fri Aug 14 10:24:37 UTC 2020
#
# Category : attacks
# Version : 25818
#
# This File Date : Fri Aug 14 10:24:38 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 36 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_apache-noscript_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.180.156.219
31.13.127.21
46.229.168.135
46.229.168.142
46.229.168.150
49.235.92.147
52.214.22.75
64.64.104.10
79.142.76.206
80.82.65.62
93.174.93.91
95.91.230.184
103.27.62.222
104.131.8.207
107.155.132.188
107.155.152.3
107.155.152.28
111.229.206.199
111.230.179.199
114.119.166.192
129.226.125.7
139.155.1.8
173.231.59.201
180.215.219.53
185.22.152.85
185.150.189.165
192.241.222.112
193.118.53.194
193.118.53.210
193.169.252.37
195.54.160.21
195.54.160.66
216.18.204.132
216.244.66.230
216.244.66.239
222.186.61.19

37
bi_apache-noscript_2_30d.ipset Normal file
View File

@ -0,0 +1,37 @@
#
# bi_apache-noscript_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# apache-noscript with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/apache-noscript/2?age=30d
# Source File Date: Thu Aug 13 01:00:46 UTC 2020
#
# Category : attacks
# Version : 357
#
# This File Date : Thu Aug 13 01:00:46 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 7 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_apache-noscript_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
51.15.43.205
85.248.227.165
157.55.39.5
157.55.39.34
157.55.39.36
185.100.87.245
185.220.101.26

31
bi_apache-phpmyadmin_0_1d.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bi_apache-phpmyadmin_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# apache-phpmyadmin with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/apache-phpmyadmin/0?age=1d
# Source File Date: Wed Aug 12 06:44:36 UTC 2020
#
# Category : attacks
# Version : 5353
#
# This File Date : Wed Aug 12 06:44:36 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_apache-phpmyadmin_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
80.82.65.62

300
bi_apache-scriddies_0_1d.ipset Normal file
View File

@ -0,0 +1,300 @@
#
# bi_apache-scriddies_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# apache-scriddies with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/apache-scriddies/0?age=1d
# Source File Date: Fri Aug 14 08:24:38 UTC 2020
#
# Category : attacks
# Version : 13316
#
# This File Date : Fri Aug 14 08:24:38 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 270 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_apache-scriddies_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.62.25
13.88.29.97
13.90.214.212
24.212.207.197
35.240.128.54
39.71.42.76
39.71.83.189
39.71.85.72
39.71.86.186
39.82.201.233
40.112.253.124
43.225.159.251
45.32.118.121
45.233.178.218
49.81.172.42
49.81.175.245
51.104.34.42
51.158.97.41
52.149.213.85
52.154.76.49
52.188.22.25
52.255.139.97
54.249.44.51
58.209.98.36
58.214.185.163
58.214.187.97
59.52.37.59
59.52.37.181
59.52.101.143
59.52.103.67
59.55.114.21
59.55.155.53
59.61.164.42
59.61.164.63
59.61.164.207
59.61.164.211
59.61.164.238
60.180.184.48
60.216.180.237
61.52.72.3
61.52.72.136
61.52.73.86
61.52.73.241
61.52.74.164
61.52.76.95
61.52.76.134
61.52.76.201
61.52.79.172
69.10.39.18
70.174.225.13
78.24.220.1
78.31.71.213
79.142.76.206
80.82.65.62
82.165.253.224
85.25.177.219
85.204.246.240
89.46.105.110
91.148.94.83
95.216.172.194
95.216.244.183
101.71.232.127
101.71.232.194
101.71.233.3
101.71.233.56
101.71.233.147
101.71.234.72
101.71.234.192
104.248.68.63
106.4.161.78
110.52.235.6
110.52.235.15
110.52.235.39
110.52.235.45
110.52.235.78
110.52.235.86
110.52.235.111
110.52.235.112
110.52.235.166
110.52.235.168
110.52.235.179
110.52.235.187
110.52.235.208
110.52.235.233
110.52.235.240
110.52.235.250
110.90.12.60
110.90.12.90
110.90.12.107
110.90.12.143
110.166.89.107
111.164.172.159
111.164.172.178
111.164.174.36
111.164.174.185
111.164.175.17
111.164.175.18
111.164.175.32
112.231.145.192
113.58.238.227
113.58.240.222
113.58.244.38
113.58.244.54
113.58.244.67
113.234.161.119
113.234.165.255
113.234.167.12
113.234.168.100
113.234.168.156
113.234.170.196
113.234.175.35
114.216.54.166
114.216.54.204
114.217.113.38
114.217.113.126
114.217.113.173
114.220.233.49
114.225.8.185
114.225.187.174
114.234.154.122
114.234.154.137
114.234.156.244
114.234.158.99
114.234.159.166
115.148.152.96
115.202.66.138
115.202.75.95
115.202.81.7
115.202.81.131
115.202.81.171
115.202.87.133
115.202.91.24
116.2.64.37
116.2.65.117
116.2.69.11
116.2.70.7
116.2.70.112
116.2.79.86
116.2.81.89
116.2.82.106
116.2.84.29
116.2.87.159
116.2.87.236
116.2.88.22
116.2.88.208
116.2.94.123
116.2.94.163
117.25.6.24
117.25.6.48
117.25.6.53
117.25.6.85
117.29.120.53
117.29.120.95
117.29.120.99
117.29.120.135
117.40.114.220
117.40.114.252
117.81.84.148
117.82.33.204
120.32.38.58
120.32.38.112
121.29.80.11
121.29.80.17
121.29.80.143
121.29.80.167
121.29.81.12
121.29.81.58
121.29.81.61
121.29.81.97
121.29.81.144
121.29.81.199
121.29.81.238
121.204.0.67
121.204.0.102
121.236.201.79
124.72.0.82
125.104.228.69
125.104.231.133
125.104.238.239
125.104.250.230
125.104.253.0
125.111.40.164
125.111.41.13
125.111.41.59
125.111.41.63
125.111.41.139
125.111.41.193
125.111.41.233
125.111.42.175
125.111.43.164
125.111.43.222
140.224.112.3
140.224.112.49
148.70.33.148
150.255.2.125
150.255.6.151
150.255.7.217
161.10.138.173
161.97.84.175
171.116.205.215
171.116.207.122
173.194.91.28
175.113.33.167
175.171.177.86
175.171.183.93
180.104.187.147
180.104.193.243
180.104.194.94
180.104.239.72
180.112.16.171
180.112.17.165
180.112.18.125
180.112.18.226
180.112.19.173
180.114.10.2
180.114.10.29
180.114.220.19
180.123.224.185
180.124.82.54
180.124.83.243
180.124.126.42
181.225.242.244
182.101.63.130
183.185.85.168
183.185.90.196
183.185.196.50
185.81.157.189
192.200.215.91
193.36.224.45
193.169.254.93
201.17.122.202
217.64.110.80
218.5.28.35
218.74.224.151
218.74.224.194
218.74.225.107
218.74.226.47
218.74.226.100
218.74.226.247
218.74.227.241
220.160.18.80
220.175.166.57
220.175.166.104
220.175.166.113
220.175.166.118
220.175.166.123
220.175.166.133
220.175.166.139
220.175.166.144
220.175.166.153
220.175.166.159
220.175.166.160
220.175.166.167
220.175.166.187
220.175.166.188
220.175.166.197
220.175.166.198
220.175.166.214
220.175.166.237
220.177.9.22
220.177.9.100
220.177.9.163
222.76.6.21
222.76.6.121
222.87.198.38
222.135.230.106
222.135.231.64
222.191.174.142
222.191.174.207
222.191.174.247

495
bi_apache_0_1d.ipset Normal file
View File

@ -0,0 +1,495 @@
#
# bi_apache_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# apache with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/apache/0?age=1d
# Source File Date: Fri Aug 14 10:20:08 UTC 2020
#
# Category : attacks
# Version : 34877
#
# This File Date : Fri Aug 14 10:20:08 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 465 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_apache_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.180.156.219
2.50.146.183
5.188.62.25
13.88.29.97
13.90.214.212
23.102.128.239
24.212.207.197
27.32.232.54
31.13.127.21
31.37.50.155
31.128.21.198
31.131.169.12
31.202.248.70
35.187.98.101
35.221.220.51
35.240.128.54
39.71.42.76
39.71.83.189
39.71.85.72
39.71.86.186
39.82.201.233
40.74.87.111
40.84.151.15
40.112.253.124
42.157.195.85
43.225.159.251
45.32.118.121
45.115.106.190
45.133.88.9
45.233.178.218
46.229.168.135
46.229.168.142
46.229.168.150
47.30.147.149
49.81.172.42
49.81.175.245
49.144.96.56
49.235.92.147
51.4.147.32
51.79.21.92
51.104.34.42
51.158.97.41
52.149.213.85
52.154.76.49
52.170.157.176
52.188.22.25
52.188.125.24
52.214.22.75
52.255.139.97
54.249.44.51
58.209.98.36
58.214.185.163
58.214.187.97
58.216.12.251
59.52.37.59
59.52.37.181
59.52.101.143
59.52.103.67
59.55.114.21
59.55.155.53
59.61.164.42
59.61.164.63
59.61.164.207
59.61.164.211
59.61.164.238
59.97.117.0
59.97.118.189
60.180.184.48
60.216.180.237
61.52.72.3
61.52.72.136
61.52.73.86
61.52.73.241
61.52.74.164
61.52.76.95
61.52.76.134
61.52.76.201
61.52.79.172
61.132.225.100
62.210.209.245
62.234.218.151
64.64.104.10
66.249.69.204
66.249.69.206
66.249.72.68
66.249.72.72
66.249.72.87
66.249.72.89
66.249.75.241
66.249.75.243
66.249.75.245
69.10.39.18
70.174.225.13
76.65.216.208
77.30.230.109
77.88.5.7
77.88.5.26
77.88.5.38
77.88.5.73
77.88.5.76
77.88.5.113
77.88.5.149
77.88.5.151
77.110.130.222
77.141.227.201
77.163.18.92
78.24.220.1
78.31.71.213
78.97.7.213
79.142.76.206
80.82.65.62
81.170.239.2
81.196.177.75
82.17.21.160
82.17.105.203
82.165.253.224
83.97.20.31
83.223.235.27
84.16.248.172
85.25.177.219
85.204.246.240
87.210.177.5
89.46.105.110
90.248.248.208
91.123.157.56
91.148.94.83
93.158.66.42
93.158.66.43
93.158.66.45
93.158.66.47
93.158.66.50
93.158.161.44
93.158.161.65
93.174.93.91
94.132.60.129
95.19.157.168
95.91.230.184
95.163.255.94
95.163.255.95
95.163.255.97
95.163.255.99
95.216.172.194
95.216.244.183
96.60.196.69
99.253.30.210
101.71.232.127
101.71.232.194
101.71.233.3
101.71.233.56
101.71.233.147
101.71.234.72
101.71.234.192
102.163.24.150
102.176.105.70
103.27.62.222
103.70.155.22
103.94.253.30
103.109.238.26
103.119.62.79
103.142.120.151
103.240.195.96
103.253.151.36
104.131.8.207
104.209.184.121
104.248.68.63
105.159.192.120
106.4.161.78
106.13.67.199
106.52.83.188
106.75.32.254
106.201.76.242
107.152.101.211
107.155.132.188
107.155.152.3
107.155.152.28
109.28.118.128
110.36.152.158
110.52.235.6
110.52.235.15
110.52.235.39
110.52.235.45
110.52.235.78
110.52.235.86
110.52.235.111
110.52.235.112
110.52.235.166
110.52.235.168
110.52.235.179
110.52.235.187
110.52.235.208
110.52.235.233
110.52.235.240
110.52.235.250
110.90.12.60
110.90.12.90
110.90.12.107
110.90.12.143
110.166.89.107
111.164.172.159
111.164.172.178
111.164.174.36
111.164.174.185
111.164.175.17
111.164.175.18
111.164.175.32
111.229.206.199
111.230.179.199
112.134.214.235
112.201.71.163
112.206.7.134
112.231.145.192
113.58.238.227
113.58.240.222
113.58.244.38
113.58.244.54
113.58.244.67
113.234.161.119
113.234.165.255
113.234.167.12
113.234.168.100
113.234.168.156
113.234.170.196
113.234.175.35
114.119.166.192
114.216.54.166
114.216.54.204
114.217.113.38
114.217.113.126
114.217.113.173
114.218.163.69
114.220.233.49
114.225.8.185
114.225.187.174
114.234.154.122
114.234.154.137
114.234.156.244
114.234.158.99
114.234.159.166
115.96.146.158
115.148.152.96
115.202.66.138
115.202.75.95
115.202.81.7
115.202.81.131
115.202.81.171
115.202.87.133
115.202.91.24
116.2.64.37
116.2.65.117
116.2.69.11
116.2.70.7
116.2.70.112
116.2.79.86
116.2.81.89
116.2.82.106
116.2.84.29
116.2.87.159
116.2.87.236
116.2.88.22
116.2.88.208
116.2.94.123
116.2.94.163
117.25.6.24
117.25.6.48
117.25.6.53
117.25.6.85
117.29.120.53
117.29.120.95
117.29.120.99
117.29.120.135
117.40.114.220
117.40.114.252
117.81.84.148
117.82.33.204
118.24.233.67
119.74.192.165
119.95.190.101
120.29.76.227
120.32.38.58
120.32.38.112
121.29.80.11
121.29.80.17
121.29.80.143
121.29.80.167
121.29.81.12
121.29.81.58
121.29.81.61
121.29.81.97
121.29.81.144
121.29.81.199
121.29.81.238
121.204.0.67
121.204.0.102
121.236.201.79
122.224.155.227
123.126.105.36
124.72.0.82
125.23.149.182
125.104.228.69
125.104.231.133
125.104.238.239
125.104.250.230
125.104.253.0
125.111.40.164
125.111.41.13
125.111.41.59
125.111.41.63
125.111.41.139
125.111.41.193
125.111.41.233
125.111.42.175
125.111.43.164
125.111.43.222
128.4.12.93
128.14.133.58
128.14.134.170
128.14.209.242
129.226.125.7
132.232.5.28
138.91.224.48
139.155.1.8
140.86.12.202
140.224.112.3
140.224.112.49
142.44.251.104
148.70.33.148
149.0.66.87
150.242.66.62
150.242.86.210
150.255.2.125
150.255.6.151
150.255.7.217
157.230.143.29
158.69.38.243
159.65.145.160
161.10.138.173
161.97.84.175
164.132.98.229
170.79.170.186
171.116.205.215
171.116.207.122
172.58.56.7
173.194.91.28
173.231.59.201
174.2.166.146
175.113.33.167
175.171.177.86
175.171.183.93
176.88.141.10
176.136.117.16
176.140.26.5
176.171.244.251
177.184.43.194
178.27.206.222
178.32.197.90
180.104.187.147
180.104.193.243
180.104.194.94
180.104.239.72
180.112.16.171
180.112.17.165
180.112.18.125
180.112.18.226
180.112.19.173
180.114.10.2
180.114.10.29
180.114.220.19
180.123.224.185
180.124.82.54
180.124.83.243
180.124.126.42
180.215.219.53
181.44.131.136
181.171.129.132
181.225.242.244
182.61.148.212
182.70.140.186
182.101.63.130
183.185.85.168
183.185.90.196
183.185.196.50
185.22.152.85
185.39.11.105
185.79.156.187
185.81.157.189
185.150.189.165
185.202.2.147
187.187.225.174
188.51.70.241
188.156.50.105
188.166.56.4
190.39.153.169
190.44.171.78
190.171.102.53
191.30.54.248
191.235.112.72
192.35.168.219
192.200.215.91
192.241.222.112
193.36.224.45
193.118.53.194
193.118.53.210
193.169.252.37
193.169.254.93
194.87.139.104
195.54.160.21
195.54.160.66
196.112.95.206
197.19.188.148
197.210.65.219
198.12.156.214
201.17.122.202
202.173.126.110
203.57.214.201
203.211.143.85
203.213.107.155
207.180.231.227
213.127.91.113
216.18.204.132
216.244.66.227
216.244.66.230
216.244.66.239
217.64.110.80
218.5.28.35
218.74.224.151
218.74.224.194
218.74.225.107
218.74.226.47
218.74.226.100
218.74.226.247
218.74.227.241
218.153.168.50
220.160.18.80
220.162.133.150
220.175.166.57
220.175.166.104
220.175.166.113
220.175.166.118
220.175.166.123
220.175.166.133
220.175.166.139
220.175.166.144
220.175.166.153
220.175.166.159
220.175.166.160
220.175.166.167
220.175.166.187
220.175.166.188
220.175.166.197
220.175.166.198
220.175.166.214
220.175.166.237
220.177.9.22
220.177.9.100
220.177.9.163
220.247.202.227
222.76.6.21
222.76.6.121
222.87.198.38
222.135.230.106
222.135.231.64
222.186.61.19
222.191.174.142
222.191.174.207
222.191.174.247

55
bi_apache_1_7d.ipset Normal file
View File

@ -0,0 +1,55 @@
#
# bi_apache_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# apache with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/apache/1?age=7d
# Source File Date: Fri Aug 14 04:40:20 UTC 2020
#
# Category : attacks
# Version : 2192
#
# This File Date : Fri Aug 14 04:40:21 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 25 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_apache_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
66.240.205.34
66.249.66.203
66.249.66.205
66.249.66.207
66.249.69.206
66.249.69.222
66.249.75.251
74.82.47.3
94.102.49.7
94.102.56.151
94.102.56.181
137.226.113.10
138.246.253.15
139.162.113.204
157.55.39.167
172.104.108.109
176.10.99.200
178.73.215.171
184.105.247.196
185.100.87.245
185.100.87.250
207.46.13.71
216.244.66.239
218.153.168.50
223.112.190.70

84
bi_apache_2_30d.ipset Normal file
View File

@ -0,0 +1,84 @@
#
# bi_apache_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# apache with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/apache/2?age=30d
# Source File Date: Fri Aug 14 08:32:09 UTC 2020
#
# Category : attacks
# Version : 696
#
# This File Date : Fri Aug 14 08:32:09 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 54 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_apache_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
40.77.167.45
40.77.167.63
46.37.206.23
51.15.43.205
62.210.180.62
66.240.205.34
66.249.64.205
66.249.66.151
66.249.66.153
66.249.66.202
66.249.66.203
66.249.66.205
66.249.66.207
66.249.69.218
66.249.69.222
74.82.47.3
77.247.181.163
80.82.77.139
85.248.227.163
85.248.227.165
87.118.116.90
93.174.95.106
94.102.49.7
94.102.56.151
94.102.56.181
128.199.194.131
137.226.113.10
138.246.253.15
139.162.106.181
139.162.116.133
139.162.119.197
157.55.39.5
157.55.39.23
157.55.39.34
157.55.39.36
157.55.39.167
162.213.3.221
171.25.193.77
172.104.108.109
176.10.99.200
178.73.215.171
184.105.247.196
184.105.247.252
185.100.87.207
185.100.87.245
185.100.87.250
185.117.215.9
185.220.101.26
207.46.13.71
207.244.70.35
208.100.26.231
216.243.31.2
218.153.168.50
223.112.190.70

30
bi_apacheddos_0_1d.ipset Normal file
View File

@ -0,0 +1,30 @@
#
# bi_apacheddos_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# apacheddos with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/apacheddos/0?age=1d
# Source File Date: Sun Jul 12 18:40:13 UTC 2020
#
# Category : attacks
# Version : 3065
#
# This File Date : Sun Jul 12 19:12:37 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_apacheddos_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

74
bi_assp_0_1d.ipset Normal file
View File

@ -0,0 +1,74 @@
#
# bi_assp_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# assp with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/assp/0?age=1d
# Source File Date: Fri Aug 14 04:24:36 UTC 2020
#
# Category : attacks
# Version : 15667
#
# This File Date : Fri Aug 14 04:24:36 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 44 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_assp_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
60.167.52.38
60.167.52.191
60.167.53.114
60.167.53.203
60.167.112.158
60.167.112.172
60.167.112.174
60.167.112.240
60.167.113.150
60.167.116.133
60.167.118.150
60.167.118.155
60.167.118.176
60.167.119.165
60.169.94.205
60.169.94.237
60.169.94.246
60.169.114.182
60.169.114.192
60.169.115.101
60.169.115.180
77.40.2.125
77.40.3.82
77.40.3.191
87.246.7.11
87.246.7.138
114.99.130.8
114.99.130.179
114.99.130.192
114.99.131.118
114.99.131.207
114.99.131.216
114.231.46.89
114.231.82.245
142.11.253.114
198.27.115.120
223.241.54.40
223.241.54.70
223.241.54.126
223.241.55.3
223.241.55.14
223.241.55.133
223.241.55.177
223.241.55.232

85
bi_asterisk_0_1d.ipset Normal file
View File

@ -0,0 +1,85 @@
#
# bi_asterisk_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# asterisk with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/asterisk/0?age=1d
# Source File Date: Fri Aug 14 10:05:37 UTC 2020
#
# Category : attacks
# Version : 28604
#
# This File Date : Fri Aug 14 10:05:37 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 55 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_asterisk_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.189.141.39
34.96.129.124
34.125.76.3
35.154.14.95
35.235.75.155
37.49.230.27
37.59.6.23
45.143.223.30
45.143.223.47
45.143.223.55
45.143.223.58
45.143.223.64
45.143.223.134
51.89.16.194
52.242.75.150
54.39.51.192
62.210.151.21
66.117.9.222
81.218.45.141
82.135.148.92
85.114.107.230
85.114.116.141
103.145.12.40
103.145.12.67
103.145.12.177
103.145.12.219
113.141.67.163
113.141.70.204
124.133.230.74
144.217.254.241
156.96.117.164
156.96.117.183
156.96.117.187
156.96.117.189
156.96.119.148
156.96.128.199
156.96.154.53
156.96.154.55
156.96.155.61
156.96.156.77
163.172.121.109
170.150.153.93
185.36.81.37
185.53.88.9
185.53.88.232
185.147.212.8
185.147.212.14
188.72.95.25
192.210.152.10
194.187.251.26
205.209.166.66
205.209.166.69
205.209.166.92
205.209.166.110
217.147.0.97

33
bi_asterisk_2_30d.ipset Normal file
View File

@ -0,0 +1,33 @@
#
# bi_asterisk_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# asterisk with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/asterisk/2?age=30d
# Source File Date: Fri Jul 31 04:20:17 UTC 2020
#
# Category : attacks
# Version : 347
#
# This File Date : Fri Jul 31 04:20:17 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 3 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_asterisk_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
85.114.107.230
158.69.246.141
188.165.222.17

7727
bi_badbots_0_1d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

275
bi_badbots_1_7d.ipset Normal file
View File

@ -0,0 +1,275 @@
#
# bi_badbots_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# badbots with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/badbots/1?age=7d
# Source File Date: Fri Aug 14 10:01:14 UTC 2020
#
# Category : attacks
# Version : 2858
#
# This File Date : Fri Aug 14 10:01:14 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 245 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_badbots_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.179.182.82
5.8.10.202
5.135.177.168
31.27.38.242
31.184.194.114
36.66.69.33
36.80.48.9
36.84.80.31
37.49.224.113
37.59.66.56
37.187.125.87
37.187.181.182
37.220.36.240
41.21.200.254
41.208.150.114
41.223.142.211
46.59.11.243
46.148.192.41
49.254.216.241
51.254.37.192
51.254.220.20
51.255.35.58
54.36.182.244
54.37.69.251
54.37.232.137
54.38.33.186
54.38.183.181
58.17.243.151
58.210.96.156
59.127.236.228
60.2.10.190
60.18.243.94
60.191.38.77
61.12.38.162
61.72.255.26
61.76.169.138
61.144.195.209
61.177.172.41
61.177.172.54
61.177.172.61
61.183.144.188
62.24.104.71
62.94.206.57
62.210.37.82
64.113.32.29
66.240.205.34
66.249.64.76
66.249.69.65
66.249.73.149
66.249.73.151
66.249.73.153
69.172.87.212
77.82.90.234
77.247.181.163
78.131.56.62
78.195.178.119
78.229.158.27
79.137.79.167
80.21.147.85
80.67.172.162
80.82.70.118
80.82.78.104
80.93.96.26
80.229.253.212
81.133.189.239
81.142.80.97
82.64.15.106
82.145.72.180
82.200.65.218
83.12.107.106
85.95.185.78
89.234.157.254
89.248.172.90
91.121.67.107
91.121.156.27
91.134.140.32
91.134.173.103
92.222.70.236
92.222.84.15
93.63.150.10
93.126.11.249
93.174.93.143
94.23.145.124
94.23.196.177
94.102.51.78
94.181.94.12
95.128.43.164
95.167.39.12
96.57.82.166
103.23.100.87
103.36.84.100
103.225.124.29
104.236.63.99
106.38.3.253
106.243.87.162
107.170.48.64
108.58.41.139
109.120.167.1
109.194.19.243
109.227.63.3
110.170.166.101
111.11.181.53
111.93.205.186
111.231.119.141
112.85.42.194
112.95.225.158
112.215.113.10
113.53.232.245
113.160.178.148
114.108.181.139
114.241.52.2
115.88.201.58
115.178.73.2
115.238.97.2
117.50.13.29
117.232.127.50
117.232.127.51
118.25.96.30
118.98.127.138
118.126.105.120
120.52.120.5
121.12.151.250
122.154.46.5
122.176.40.9
122.227.159.84
123.207.107.144
123.207.157.108
124.235.171.114
125.19.153.156
125.43.69.155
125.227.236.60
131.108.156.69
138.118.214.71
138.246.253.15
139.99.105.138
139.199.8.208
140.143.241.251
140.143.250.121
141.8.144.50
142.4.204.122
142.4.214.151
145.239.76.62
148.215.18.103
149.56.23.154
150.95.135.190
157.55.39.2
157.55.39.15
157.55.39.23
157.55.39.32
162.247.72.199
163.172.216.91
164.132.47.139
164.132.51.91
164.132.56.243
171.25.193.20
171.25.193.25
171.25.193.77
171.25.193.78
171.25.193.235
177.69.104.168
179.190.96.146
180.76.187.94
180.76.246.38
180.250.210.165
181.40.76.162
182.73.222.70
182.74.25.246
185.43.108.138
185.100.86.154
185.100.87.206
185.100.87.207
185.117.215.9
185.143.223.135
185.165.168.229
185.190.98.230
185.220.100.253
185.220.102.6
185.234.216.28
185.234.216.29
185.234.217.39
185.234.217.61
186.5.109.211
186.87.32.48
186.112.214.158
187.216.113.99
188.165.221.36
188.240.208.26
189.90.255.173
189.112.109.185
190.98.228.54
190.144.14.170
192.42.116.14
192.42.116.16
192.160.102.165
192.160.102.168
192.160.102.169
192.243.56.76
193.58.196.146
193.70.6.197
193.70.34.209
193.112.42.13
193.201.224.82
193.201.224.236
194.143.231.202
195.158.29.222
195.178.222.29
195.208.185.27
196.38.70.24
198.96.155.3
199.87.154.255
200.110.172.2
200.126.102.218
200.195.171.74
200.204.174.163
201.22.95.52
201.184.137.194
201.184.169.106
202.51.110.214
202.88.252.53
203.81.78.180
203.154.162.168
203.213.66.170
206.174.214.90
207.194.35.197
207.244.70.35
210.21.226.2
210.206.92.137
211.253.10.96
212.16.104.33
212.21.66.6
212.170.50.203
213.32.52.1
213.174.147.83
216.244.66.229
217.115.10.132
217.182.76.241
218.2.197.240
218.249.69.210
219.142.19.70
219.153.31.186
220.120.106.254
220.130.148.106
220.181.108.172
222.122.179.208
222.186.31.136

7877
bi_bruteforce_0_1d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

277
bi_bruteforce_1_7d.ipset Normal file
View File

@ -0,0 +1,277 @@
#
# bi_bruteforce_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# bruteforce with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/bruteforce/1?age=7d
# Source File Date: Fri Aug 14 10:01:24 UTC 2020
#
# Category : attacks
# Version : 2871
#
# This File Date : Fri Aug 14 10:01:24 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 247 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_bruteforce_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.179.182.82
2.237.133.169
5.8.10.202
5.135.177.168
31.27.38.242
31.184.194.114
36.66.69.33
36.80.48.9
36.84.80.31
37.49.224.113
37.59.66.56
37.187.125.87
37.187.181.182
37.220.36.240
41.21.200.254
41.208.150.114
41.223.142.211
46.59.11.243
46.148.192.41
49.254.216.241
51.254.37.192
51.254.220.20
51.255.35.58
54.36.182.244
54.37.69.251
54.37.232.137
54.38.33.186
54.38.183.181
58.17.243.151
58.210.96.156
59.127.236.228
60.2.10.190
60.18.243.94
60.191.38.77
61.12.38.162
61.72.255.26
61.76.169.138
61.144.195.209
61.177.172.41
61.177.172.54
61.177.172.61
61.183.144.188
62.24.104.71
62.94.206.57
62.210.37.82
64.113.32.29
66.240.205.34
66.249.64.76
66.249.69.65
66.249.73.149
66.249.73.151
66.249.73.153
69.172.87.212
77.82.90.234
77.247.181.163
78.131.56.62
78.195.178.119
78.229.158.27
79.137.79.167
80.21.147.85
80.67.172.162
80.82.70.118
80.82.78.104
80.93.96.26
80.229.253.212
81.133.189.239
81.142.80.97
82.64.15.106
82.145.72.180
82.200.65.218
83.12.107.106
85.95.185.78
89.234.157.254
89.248.172.90
91.121.67.107
91.121.156.27
91.134.140.32
91.134.173.103
92.222.70.236
92.222.84.15
93.63.150.10
93.126.11.249
93.174.93.143
94.23.145.124
94.23.196.177
94.102.51.78
94.181.94.12
95.128.43.164
95.167.39.12
96.57.82.166
103.23.100.87
103.36.84.100
103.225.124.29
104.236.63.99
106.38.3.253
106.243.87.162
107.170.48.64
108.58.41.139
109.120.167.1
109.194.19.243
109.227.63.3
110.170.166.101
111.11.181.53
111.93.205.186
111.231.119.141
112.85.42.194
112.95.225.158
112.215.113.10
113.53.232.245
113.160.178.148
114.108.181.139
114.241.52.2
115.88.201.58
115.178.73.2
115.238.97.2
117.50.13.29
117.232.127.50
117.232.127.51
118.25.96.30
118.98.127.138
118.126.105.120
120.52.120.5
121.12.151.250
122.154.46.5
122.176.40.9
122.227.159.84
123.207.107.144
123.207.157.108
124.235.171.114
125.19.153.156
125.43.69.155
125.227.236.60
131.108.156.69
138.118.214.71
138.246.253.15
139.99.105.138
139.199.8.208
140.143.241.251
140.143.250.121
141.8.144.50
142.4.204.122
142.4.214.151
145.239.76.62
148.215.18.103
149.56.23.154
150.95.135.190
157.55.39.2
157.55.39.15
157.55.39.23
157.55.39.32
162.247.72.199
163.172.167.225
163.172.216.91
164.132.47.139
164.132.51.91
164.132.56.243
171.25.193.20
171.25.193.25
171.25.193.77
171.25.193.78
171.25.193.235
177.69.104.168
179.190.96.146
180.76.187.94
180.76.246.38
180.250.210.165
181.40.76.162
182.73.222.70
182.74.25.246
185.43.108.138
185.100.86.154
185.100.87.206
185.100.87.207
185.117.215.9
185.143.223.135
185.165.168.229
185.190.98.230
185.220.100.253
185.220.102.6
185.234.216.28
185.234.216.29
185.234.217.39
185.234.217.61
186.5.109.211
186.87.32.48
186.112.214.158
187.216.113.99
188.165.221.36
188.240.208.26
189.90.255.173
189.112.109.185
190.98.228.54
190.144.14.170
192.42.116.14
192.42.116.16
192.160.102.165
192.160.102.168
192.160.102.169
192.243.56.76
193.58.196.146
193.70.6.197
193.70.34.209
193.112.42.13
193.201.224.82
193.201.224.236
194.143.231.202
195.158.29.222
195.178.222.29
195.208.185.27
196.38.70.24
198.96.155.3
199.87.154.255
200.110.172.2
200.126.102.218
200.195.171.74
200.204.174.163
201.22.95.52
201.184.137.194
201.184.169.106
202.51.110.214
202.88.252.53
203.81.78.180
203.154.162.168
203.213.66.170
206.174.214.90
207.194.35.197
207.244.70.35
210.21.226.2
210.206.92.137
211.253.10.96
212.16.104.33
212.21.66.6
212.170.50.203
213.32.52.1
213.174.147.83
216.244.66.229
217.115.10.132
217.182.76.241
218.2.197.240
218.249.69.210
219.142.19.70
219.153.31.186
220.120.106.254
220.130.148.106
220.181.108.172
222.122.179.208
222.186.31.136

512
bi_cms_0_1d.ipset Normal file
View File

@ -0,0 +1,512 @@
#
# bi_cms_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# cms with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/cms/0?age=1d
# Source File Date: Fri Aug 14 10:05:39 UTC 2020
#
# Category : attacks
# Version : 35102
#
# This File Date : Fri Aug 14 10:05:39 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 482 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_cms_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.23.123.73
5.39.87.36
5.62.56.102
5.76.193.196
5.101.51.97
5.135.159.189
5.135.177.5
5.182.210.228
5.188.62.140
5.253.25.217
13.74.185.71
13.95.198.119
14.162.144.66
14.200.1.238
15.207.99.140
18.139.66.150
20.44.106.192
23.29.80.56
27.34.20.154
27.34.104.234
27.254.154.119
34.84.157.244
35.180.229.226
35.186.173.231
35.195.135.67
35.196.37.206
35.200.46.148
35.200.180.182
35.202.157.96
35.203.155.125
35.204.93.97
35.204.152.99
35.221.26.149
35.229.212.150
35.233.56.0
36.91.131.175
37.8.138.197
37.59.56.124
37.123.207.23
37.131.59.64
37.187.113.197
37.187.134.111
37.187.135.130
37.187.197.113
37.187.252.148
40.84.215.84
40.113.124.250
40.114.54.111
41.93.48.72
41.111.102.19
41.142.78.30
45.32.235.9
45.55.59.115
45.62.242.26
45.118.144.77
45.122.223.198
45.145.185.89
45.152.120.2
45.165.152.26
45.168.193.60
46.101.31.59
46.101.61.207
46.101.84.165
46.101.117.79
46.101.120.8
46.101.150.9
46.101.236.221
47.39.167.55
47.52.239.42
47.56.247.167
49.204.191.68
51.38.190.237
51.38.211.30
51.68.19.126
51.75.53.141
51.75.123.7
51.75.142.24
51.77.140.110
51.77.157.106
51.79.21.92
51.79.85.154
51.79.100.13
51.91.127.200
51.91.136.28
51.124.151.92
51.158.22.73
51.178.30.154
51.178.81.106
51.254.106.82
51.254.118.224
51.255.64.58
51.255.83.132
52.143.52.199
52.187.49.96
52.249.189.196
54.38.54.248
54.38.65.127
54.38.134.219
54.38.212.160
54.38.253.1
54.71.115.235
54.212.240.209
54.238.106.173
61.244.70.248
62.4.16.8
62.210.70.251
62.210.185.4
62.211.107.174
64.119.22.72
64.202.184.249
64.225.73.186
64.227.0.234
64.227.7.123
64.227.11.43
64.227.16.110
64.227.50.96
66.115.173.18
66.249.65.98
66.249.65.101
66.249.65.127
67.205.144.65
67.205.161.59
68.183.64.176
68.183.184.7
70.37.57.139
71.43.31.237
71.176.33.133
72.167.226.88
73.101.218.26
77.243.26.202
78.142.208.230
79.125.183.146
79.137.39.102
80.211.12.253
80.211.174.81
81.46.202.77
81.142.247.41
81.170.156.164
82.76.73.49
82.223.55.20
82.223.84.91
83.137.149.120
83.245.225.246
84.38.184.67
86.97.36.71
86.162.69.109
87.233.223.184
88.201.124.185
88.218.17.239
89.43.139.166
89.115.245.50
90.227.61.164
91.83.231.237
91.121.89.189
91.134.248.211
91.134.248.230
91.185.190.207
93.90.217.149
93.113.111.100
93.113.111.193
93.113.111.197
93.114.86.226
94.54.16.169
94.177.214.9
95.110.129.91
95.137.251.43
95.142.112.20
103.3.46.92
103.51.103.3
103.83.36.101
103.83.192.12
103.92.26.197
103.119.139.14
103.135.78.66
103.135.216.253
103.147.10.222
103.204.70.78
103.233.1.167
103.248.94.26
104.44.130.32
104.131.22.18
104.131.57.95
104.131.81.54
104.197.127.11
104.197.160.61
104.198.172.68
104.236.45.171
104.236.203.29
104.238.94.60
104.238.116.152
104.248.29.200
104.248.112.159
104.248.124.109
104.248.158.98
107.161.177.66
107.175.46.17
107.180.84.194
107.180.95.149
107.180.227.163
109.70.100.30
109.100.1.131
109.163.147.138
111.92.240.206
112.196.72.188
113.165.166.17
113.170.128.48
114.124.175.238
115.186.54.140
116.255.245.208
117.248.218.55
118.25.146.128
119.74.192.165
123.31.12.222
123.231.106.56
126.209.230.106
128.90.155.52
128.199.107.33
128.199.115.160
128.199.211.68
128.199.231.141
128.199.245.33
129.204.119.35
130.185.77.147
132.148.28.20
132.148.141.147
132.148.154.8
132.232.115.47
134.122.102.200
134.122.103.0
134.122.120.74
134.209.145.228
137.175.172.87
138.68.52.53
138.68.233.112
138.197.135.102
138.197.171.66
138.197.179.94
138.197.194.207
139.59.4.145
139.59.43.196
139.59.59.75
139.59.76.217
139.59.77.43
139.59.78.248
139.59.85.41
139.59.141.196
139.59.153.133
139.59.174.107
139.59.215.241
139.99.8.3
141.85.216.231
141.255.71.108
142.4.4.229
142.4.14.247
142.44.240.82
142.93.73.89
142.93.97.13
142.93.99.56
142.93.122.207
142.93.124.210
142.93.143.85
142.93.152.19
142.93.161.89
142.93.226.235
144.168.164.26
144.217.70.190
145.239.29.217
145.239.69.74
145.239.78.143
145.239.95.42
145.239.211.242
146.185.142.200
148.72.31.118
148.72.42.181
148.72.209.9
148.72.209.191
148.72.211.177
149.56.19.4
149.202.8.66
149.202.45.11
149.202.59.123
151.80.41.7
152.32.104.177
154.0.168.71
156.155.136.254
157.230.111.136
157.230.147.252
157.230.153.203
157.230.187.39
157.230.248.89
157.245.42.253
157.245.74.244
157.245.101.251
157.245.106.153
157.245.139.32
157.245.233.164
157.245.240.102
157.245.243.14
157.245.245.159
159.65.19.39
159.65.145.160
159.65.146.72
159.65.185.253
159.65.239.34
159.89.2.220
159.89.48.56
159.89.162.217
159.89.183.168
159.203.27.100
159.203.36.107
159.203.37.43
159.203.70.169
159.203.114.189
159.203.176.82
159.203.176.219
160.153.251.138
160.153.251.217
161.35.19.176
161.35.69.152
161.35.210.241
162.243.22.112
163.172.32.190
163.172.42.123
163.172.42.173
163.172.117.227
163.172.118.115
164.132.98.229
165.22.40.128
165.22.53.233
165.22.103.3
165.22.228.147
165.22.240.63
165.22.251.121
165.227.15.223
165.227.39.151
165.227.39.176
165.227.86.14
165.227.119.98
166.62.80.109
166.62.80.165
166.62.100.99
166.62.123.55
167.71.102.17
167.71.140.30
167.71.202.93
167.99.10.162
167.99.13.90
167.99.13.195
167.99.156.48
167.114.136.16
167.172.50.28
167.172.56.36
167.172.125.254
167.172.162.118
167.172.186.32
167.172.200.70
171.244.21.87
174.138.30.233
174.138.41.13
175.107.205.234
175.208.191.37
176.56.62.144
176.123.5.15
177.203.173.138
178.32.27.177
178.62.5.39
178.62.99.103
178.62.110.145
178.62.154.235
178.62.252.206
178.128.6.190
178.128.83.1
178.128.153.184
178.209.170.75
180.232.70.139
180.242.180.239
182.92.87.55
184.101.206.108
184.176.166.26
185.10.142.6
185.21.84.19
185.21.84.208
185.21.84.249
185.39.11.89
185.50.25.38
185.79.156.187
185.81.157.141
185.157.222.47
185.175.119.14
185.220.100.254
185.221.216.4
185.234.217.39
186.10.118.188
186.234.80.76
186.251.71.242
188.120.117.223
188.165.211.206
188.165.255.134
188.166.9.162
188.166.38.40
188.166.60.55
188.166.60.138
188.166.145.175
188.240.208.26
189.142.225.232
189.244.14.10
190.1.202.209
190.190.182.151
192.0.91.201
192.99.15.84
192.99.31.122
192.99.149.195
192.119.36.31
192.169.200.145
192.169.219.79
192.169.243.111
192.241.132.115
192.241.211.169
192.241.213.147
192.254.207.43
193.106.31.130
193.169.254.93
194.127.179.54
194.156.81.223
195.54.160.21
195.154.48.39
195.154.53.178
195.167.159.161
196.41.122.94
198.12.156.214
198.12.250.168
198.12.250.187
198.27.69.130
198.27.80.123
198.27.81.188
198.38.84.254
198.38.90.79
198.46.81.9
198.100.145.89
198.100.149.77
198.211.102.110
198.245.49.22
198.245.60.109
198.245.63.65
199.192.20.159
199.249.230.167
200.121.128.64
202.51.88.95
202.143.111.220
203.189.116.161
203.195.136.130
206.189.35.138
206.189.231.196
207.154.236.97
207.166.186.217
208.109.11.224
208.109.52.183
209.97.138.97
209.97.177.73
209.97.179.52
212.19.99.12
212.83.136.32
212.83.169.24
212.83.184.117
212.96.87.185
212.129.3.50
212.129.33.48
212.129.52.198
212.129.60.22
212.129.61.228
212.227.174.175
213.32.91.71
213.149.103.132
213.197.180.91
213.231.29.84
216.10.245.49
216.128.110.229
217.170.198.18
217.182.140.117
217.182.192.217
218.232.46.83
220.240.33.76

56
bi_cms_1_7d.ipset Normal file
View File

@ -0,0 +1,56 @@
#
# bi_cms_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# cms with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/cms/1?age=7d
# Source File Date: Fri Aug 14 04:32:13 UTC 2020
#
# Category : attacks
# Version : 2917
#
# This File Date : Fri Aug 14 04:32:13 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 26 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_cms_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.211.10
37.187.252.148
61.37.150.6
62.210.185.4
66.33.212.126
82.208.65.46
93.189.27.197
94.102.49.7
103.255.4.8
108.167.133.16
113.161.4.51
114.199.112.138
118.163.58.117
120.194.7.10
173.236.224.115
177.19.187.79
177.135.103.94
178.33.236.93
185.86.77.163
185.220.101.13
185.234.216.28
188.240.208.26
192.169.200.145
201.140.110.78
211.75.13.207
217.170.198.18

137
bi_cms_2_30d.ipset Normal file
View File

@ -0,0 +1,137 @@
#
# bi_cms_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# cms with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/cms/2?age=30d
# Source File Date: Thu Aug 13 19:26:30 UTC 2020
#
# Category : attacks
# Version : 770
#
# This File Date : Thu Aug 13 19:26:30 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 107 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_cms_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.211.22
5.199.130.188
31.13.227.4
35.0.127.52
37.139.8.104
37.187.252.148
41.33.229.210
41.128.185.155
46.29.248.238
46.165.230.5
46.182.106.190
51.15.43.205
58.220.234.18
61.37.150.6
62.210.185.4
66.11.32.201
77.221.130.145
77.247.181.162
77.247.181.163
77.247.181.165
82.208.65.46
85.248.227.163
85.248.227.164
89.221.250.3
89.234.157.254
91.134.248.211
91.134.248.245
91.134.248.253
91.183.149.230
91.200.12.22
91.208.99.2
93.174.93.133
93.189.27.197
94.102.49.7
108.167.133.16
109.69.67.17
112.27.129.154
113.161.4.51
114.35.243.41
114.199.112.138
115.84.112.138
118.163.58.117
118.163.135.18
118.163.146.70
119.29.82.97
120.194.7.10
121.78.144.139
121.128.135.75
128.31.0.13
137.74.169.241
145.239.91.37
149.202.238.204
162.247.72.199
171.25.193.20
171.25.193.25
171.25.193.77
173.201.196.100
173.201.196.174
176.10.99.200
176.10.104.240
177.19.187.79
177.135.103.94
182.71.129.34
182.190.4.53
185.86.93.10
185.86.93.29
185.86.93.32
185.86.93.58
185.100.86.154
185.100.87.207
185.107.47.171
185.117.215.9
185.220.101.5
185.220.101.6
185.220.101.8
185.220.101.9
185.220.101.10
185.220.101.12
185.220.101.13
185.220.101.20
185.220.101.21
185.220.101.33
185.220.102.4
185.220.102.6
185.220.102.7
186.215.197.15
188.214.104.146
188.240.208.26
190.210.182.93
192.42.116.16
192.160.102.170
192.169.200.145
193.169.145.66
195.81.64.102
195.176.3.19
195.176.3.20
195.254.134.194
201.140.110.78
206.214.8.241
210.16.189.4
211.75.13.207
212.21.66.6
212.142.226.93
216.218.134.12
217.70.186.133
217.170.198.18
218.92.229.178

31
bi_courierauth_0_1d.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bi_courierauth_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# courierauth with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/courierauth/0?age=1d
# Source File Date: Fri Aug 14 01:20:13 UTC 2020
#
# Category : attacks
# Version : 4603
#
# This File Date : Fri Aug 14 01:20:13 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_courierauth_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
86.26.211.140

31
bi_courierauth_2_30d.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bi_courierauth_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# courierauth with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/courierauth/2?age=30d
# Source File Date: Thu Aug 13 09:08:38 UTC 2020
#
# Category : attacks
# Version : 97
#
# This File Date : Thu Aug 13 09:08:38 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_courierauth_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
37.49.224.114

38
bi_default_0_1d.ipset Normal file
View File

@ -0,0 +1,38 @@
#
# bi_default_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# default with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/default/0?age=1d
# Source File Date: Fri Aug 14 10:05:41 UTC 2020
#
# Category : attacks
# Version : 26741
#
# This File Date : Fri Aug 14 10:05:41 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 8 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_default_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
18.217.36.29
61.188.18.25
110.154.181.138
111.170.68.249
115.152.48.188
122.51.95.85
138.201.137.107
223.155.41.77

30
bi_default_1_7d.ipset Normal file
View File

@ -0,0 +1,30 @@
#
# bi_default_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# default with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/default/1?age=7d
# Source File Date: Sun Jun 14 06:12:30 UTC 2020
#
# Category : attacks
# Version : 1953
#
# This File Date : Sun Jun 14 12:20:07 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_default_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

30
bi_default_2_30d.ipset Normal file
View File

@ -0,0 +1,30 @@
#
# bi_default_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# default with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/default/2?age=30d
# Source File Date: Mon Jul 6 23:44:15 UTC 2020
#
# Category : attacks
# Version : 571
#
# This File Date : Tue Jul 7 23:56:40 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_default_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

39
bi_dns_0_1d.ipset Normal file
View File

@ -0,0 +1,39 @@
#
# bi_dns_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# dns with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/dns/0?age=1d
# Source File Date: Fri Aug 14 08:12:42 UTC 2020
#
# Category : attacks
# Version : 6759
#
# This File Date : Fri Aug 14 08:12:42 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 9 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_dns_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
3.218.156.136
3.236.136.177
3.236.198.1
37.49.224.64
45.56.74.240
45.79.214.164
54.147.93.14
54.237.161.5
93.174.89.53

128
bi_dovecot-pop3imap_0_1d.ipset Normal file
View File

@ -0,0 +1,128 @@
#
# bi_dovecot-pop3imap_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# dovecot-pop3imap with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/dovecot-pop3imap/0?age=1d
# Source File Date: Fri Aug 14 10:20:10 UTC 2020
#
# Category : attacks
# Version : 28599
#
# This File Date : Fri Aug 14 10:20:10 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 98 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_dovecot-pop3imap_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
2.47.211.209
5.168.214.172
5.170.69.73
13.65.209.76
14.160.39.106
14.160.70.126
14.177.236.196
20.191.127.222
31.154.174.126
37.49.229.166
37.159.11.14
37.162.141.196
40.84.210.113
41.33.229.210
45.87.212.70
45.148.10.43
45.148.10.114
45.148.10.181
47.96.164.251
52.3.250.95
52.142.51.248
52.188.154.95
60.246.2.204
60.246.3.84
61.161.209.134
62.18.203.166
62.148.236.220
66.11.32.201
72.221.232.141
78.186.193.166
79.42.244.94
79.142.76.206
82.207.56.202
83.20.192.91
85.159.35.138
90.188.3.255
93.137.6.252
95.165.174.191
95.250.172.134
101.78.9.186
103.126.6.245
109.52.1.44
109.52.4.32
109.52.4.209
109.52.4.223
109.52.6.171
109.52.7.134
109.52.7.243
109.52.9.174
109.52.11.165
109.52.13.48
109.52.16.94
109.52.24.67
109.52.25.43
109.52.241.107
109.162.249.145
113.21.112.175
114.143.230.186
115.84.91.38
115.84.92.50
116.196.82.45
117.7.26.68
123.16.53.97
123.138.199.66
140.207.48.242
164.160.9.246
171.247.153.217
171.251.248.101
176.200.62.77
177.94.220.41
178.46.163.3
178.46.167.46
181.64.18.70
183.88.240.197
183.89.73.215
183.89.212.69
183.89.215.215
183.89.237.7
183.89.237.166
187.94.31.237
187.189.230.149
189.59.5.81
190.13.106.123
192.141.232.3
193.27.14.197
197.248.172.102
202.137.154.118
202.137.154.125
202.137.155.95
212.142.226.93
213.16.81.182
217.200.115.36
218.64.77.62
219.145.118.23
220.124.240.66
222.134.22.74
222.252.16.132
222.254.34.78

75
bi_dovecot-pop3imap_2_30d.ipset Normal file
View File

@ -0,0 +1,75 @@
#
# bi_dovecot-pop3imap_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# dovecot-pop3imap with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/dovecot-pop3imap/2?age=30d
# Source File Date: Thu Aug 13 23:44:11 UTC 2020
#
# Category : attacks
# Version : 476
#
# This File Date : Thu Aug 13 23:44:11 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 45 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_dovecot-pop3imap_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
14.161.48.14
14.177.235.133
31.13.227.4
37.49.224.143
41.33.229.210
41.128.185.155
61.37.150.6
61.161.209.134
66.11.32.201
71.6.146.130
82.130.202.35
115.84.105.146
115.84.112.138
118.163.58.117
118.163.97.19
118.163.135.17
118.163.135.18
118.163.143.170
119.90.34.135
120.203.25.58
121.128.135.73
123.138.199.66
177.19.164.149
177.19.187.79
177.43.251.153
177.135.101.5
177.135.101.101
183.102.114.251
186.215.130.159
186.215.130.242
186.215.143.149
186.215.195.249
187.58.134.87
187.58.139.171
189.59.5.81
189.59.69.3
190.202.44.194
190.210.182.93
200.175.104.103
201.140.110.78
201.184.241.243
211.20.181.113
218.22.100.42
218.90.162.234
222.229.112.168

122
bi_dovecot_0_1d.ipset Normal file
View File

@ -0,0 +1,122 @@
#
# bi_dovecot_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# dovecot with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/dovecot/0?age=1d
# Source File Date: Fri Aug 14 10:20:10 UTC 2020
#
# Category : attacks
# Version : 30458
#
# This File Date : Fri Aug 14 10:20:10 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 92 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_dovecot_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.6.110.153
5.154.5.119
5.188.206.197
14.63.166.243
14.226.41.7
36.69.2.143
41.89.211.5
45.164.202.52
46.92.213.43
46.229.230.4
49.49.235.108
49.49.240.153
49.49.241.235
49.228.152.163
49.230.138.19
58.215.0.90
60.246.1.113
61.90.31.165
78.128.113.116
78.186.193.166
79.142.76.206
87.246.7.141
88.199.126.52
91.240.68.149
94.74.129.129
94.74.182.244
95.143.133.180
101.51.141.106
103.113.3.70
103.113.106.226
103.126.6.245
103.206.118.109
103.237.56.85
104.201.94.186
110.77.247.50
110.171.154.239
110.171.155.152
112.15.38.248
117.102.87.138
119.42.67.44
124.120.34.38
124.120.152.138
124.122.96.36
124.122.96.129
125.27.251.160
141.98.80.67
156.96.116.16
158.140.137.39
170.233.69.13
171.96.191.34
171.236.137.169
173.236.136.70
174.196.208.168
176.235.178.183
177.54.251.169
177.128.209.58
177.136.209.207
180.101.145.234
181.211.252.186
182.16.170.246
183.88.243.213
185.89.64.213
185.104.184.213
185.215.229.168
186.211.110.10
186.216.153.128
186.250.158.171
187.58.132.251
187.120.223.98
188.75.190.138
189.59.69.3
189.114.67.217
190.157.86.63
190.214.12.34
191.53.198.57
193.150.88.173
193.193.230.211
197.211.238.220
197.248.25.49
201.184.43.133
202.138.242.6
202.158.64.170
202.176.102.3
202.176.110.136
202.176.110.243
212.70.149.3
212.70.149.19
213.205.192.50
213.205.192.75
222.168.44.140
223.24.92.226
223.24.169.41

45
bi_dovecot_1_7d.ipset Normal file
View File

@ -0,0 +1,45 @@
#
# bi_dovecot_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# dovecot with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/dovecot/1?age=7d
# Source File Date: Fri Aug 14 02:01:46 UTC 2020
#
# Category : attacks
# Version : 2158
#
# This File Date : Fri Aug 14 02:01:46 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 15 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_dovecot_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
103.28.38.166
118.163.97.19
118.163.135.17
177.19.187.79
177.135.101.5
186.215.195.249
186.215.197.15
186.215.198.137
187.58.132.251
189.59.5.81
189.59.69.3
189.114.67.195
195.81.64.102
200.175.104.103
219.93.121.22

75
bi_dovecot_2_30d.ipset Normal file
View File

@ -0,0 +1,75 @@
#
# bi_dovecot_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# dovecot with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/dovecot/2?age=30d
# Source File Date: Thu Aug 13 19:56:06 UTC 2020
#
# Category : attacks
# Version : 701
#
# This File Date : Thu Aug 13 19:56:06 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 45 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_dovecot_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
14.177.235.133
37.49.224.157
37.49.224.173
66.240.219.146
66.240.236.119
71.6.146.130
71.6.146.186
80.82.77.33
80.82.77.139
82.114.82.90
82.221.105.7
93.174.95.106
94.102.49.193
103.28.38.166
113.161.37.126
115.56.225.2
118.163.97.19
118.163.135.17
121.128.135.73
123.59.100.243
177.19.164.149
177.19.187.79
177.135.101.5
177.135.101.101
178.47.132.182
185.100.87.191
185.100.87.250
186.215.143.149
186.215.195.249
186.215.197.15
186.215.198.137
187.58.132.251
189.59.5.81
189.59.69.3
189.114.67.195
190.56.70.131
195.81.64.102
200.175.104.103
202.137.155.171
208.100.26.230
208.100.26.233
208.100.26.236
212.43.122.158
217.10.204.238
218.2.157.188

30
bi_drupal_0_1d.ipset Normal file
View File

@ -0,0 +1,30 @@
#
# bi_drupal_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# drupal with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/drupal/0?age=1d
# Source File Date: Sun Sep 29 20:36:48 UTC 2019
#
# Category : attacks
# Version : 3009
#
# This File Date : Sun Sep 29 21:08:27 UTC 2019
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_drupal_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

110
bi_exim_0_1d.ipset Normal file
View File

@ -0,0 +1,110 @@
#
# bi_exim_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# exim with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/exim/0?age=1d
# Source File Date: Fri Aug 14 10:28:09 UTC 2020
#
# Category : attacks
# Version : 12378
#
# This File Date : Fri Aug 14 10:28:09 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 80 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_exim_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.206.197
31.134.99.149
41.139.5.35
41.214.185.190
41.220.75.166
45.169.43.237
45.227.98.222
46.21.153.192
51.68.254.8
51.68.254.10
51.75.178.3
51.75.178.16
51.75.178.20
51.75.178.26
51.75.178.27
51.75.178.28
51.75.178.29
51.195.15.65
51.195.15.75
51.195.15.114
51.195.15.132
52.237.162.162
54.37.183.115
54.37.183.116
54.37.183.117
54.37.183.118
54.37.183.119
54.37.183.120
54.37.183.121
54.37.183.122
54.37.183.123
54.37.183.167
54.37.183.181
54.37.183.188
54.37.183.190
54.37.183.191
54.207.8.4
81.163.8.77
81.219.95.110
85.13.70.174
89.31.46.115
94.40.23.48
94.102.54.250
103.24.183.108
103.237.56.194
103.237.56.199
103.237.56.203
103.252.117.75
104.42.105.214
109.72.202.127
129.205.124.232
138.99.167.35
138.122.96.208
138.122.97.181
138.122.98.168
138.186.55.141
149.56.217.80
170.239.148.183
179.97.62.81
185.132.180.24
186.96.196.236
186.216.67.227
186.216.152.54
186.232.15.178
187.95.50.202
189.76.243.221
190.196.226.134
191.53.199.167
191.240.113.46
191.240.118.172
191.252.27.242
193.35.48.18
193.35.51.13
194.39.196.36
196.0.111.78
200.152.100.194
201.55.183.220
201.182.40.94
212.70.149.19
212.70.149.67

30
bi_exim_1_7d.ipset Normal file
View File

@ -0,0 +1,30 @@
#
# bi_exim_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# exim with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/exim/1?age=7d
# Source File Date: Sun Jul 19 21:16:08 UTC 2020
#
# Category : attacks
# Version : 210
#
# This File Date : Mon Jul 20 03:20:14 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_exim_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

105
bi_ftp_0_1d.ipset Normal file
View File

@ -0,0 +1,105 @@
#
# bi_ftp_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# ftp with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/ftp/0?age=1d
# Source File Date: Fri Aug 14 10:28:10 UTC 2020
#
# Category : attacks
# Version : 32866
#
# This File Date : Fri Aug 14 10:28:10 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 75 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_ftp_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
14.185.131.239
36.37.124.100
36.90.42.221
45.55.90.44
45.117.82.166
45.125.66.22
45.227.255.4
49.80.235.208
49.83.59.159
49.83.105.136
49.88.112.112
51.68.11.215
51.91.204.85
58.54.206.172
59.59.128.38
60.208.37.187
61.187.149.5
62.149.145.87
68.66.224.3
68.66.224.47
69.245.45.54
78.128.112.30
81.177.140.71
92.114.19.4
94.102.56.238
103.18.179.212
103.67.234.230
103.82.241.2
104.236.247.64
109.234.161.21
110.4.45.86
111.231.205.120
113.4.187.36
113.106.83.154
113.110.231.13
115.221.66.169
116.0.1.138
117.131.90.58
118.239.29.140
119.29.37.47
119.126.157.13
121.231.11.181
122.54.20.213
122.188.208.110
125.46.41.36
125.110.198.95
128.199.93.4
139.59.33.100
157.49.242.97
157.230.182.1
162.223.90.202
162.253.224.14
173.254.56.15
182.121.171.207
185.2.5.24
186.64.119.85
190.144.166.246
192.99.5.123
194.15.36.68
194.61.24.177
198.71.226.60
199.79.62.146
202.71.144.93
206.189.136.117
207.246.240.124
207.246.249.195
207.246.249.204
210.209.89.74
211.36.213.128
211.140.193.18
211.149.132.127
217.107.219.61
220.172.53.235
222.186.15.18
223.151.177.56

34
bi_ftp_1_7d.ipset Normal file
View File

@ -0,0 +1,34 @@
#
# bi_ftp_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# ftp with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/ftp/1?age=7d
# Source File Date: Wed Aug 12 22:09:20 UTC 2020
#
# Category : attacks
# Version : 1664
#
# This File Date : Wed Aug 12 22:09:20 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 4 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_ftp_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
45.117.82.166
77.79.246.200
83.149.21.32
113.160.224.28

36
bi_ftp_2_30d.ipset Normal file
View File

@ -0,0 +1,36 @@
#
# bi_ftp_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# ftp with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/ftp/2?age=30d
# Source File Date: Thu Aug 13 19:26:51 UTC 2020
#
# Category : attacks
# Version : 500
#
# This File Date : Thu Aug 13 19:26:51 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 6 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_ftp_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
74.63.197.26
105.235.112.20
110.52.151.59
113.160.224.28
119.44.217.242
221.202.168.254

1032
bi_http_0_1d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

93
bi_http_1_7d.ipset Normal file
View File

@ -0,0 +1,93 @@
#
# bi_http_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# http with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/http/1?age=7d
# Source File Date: Fri Aug 14 08:32:12 UTC 2020
#
# Category : attacks
# Version : 3047
#
# This File Date : Fri Aug 14 08:32:12 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 63 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_http_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.211.10
5.188.211.13
5.188.211.15
37.187.252.148
61.37.150.6
62.210.185.4
66.33.212.126
66.240.205.34
66.249.66.203
66.249.66.205
66.249.66.207
66.249.69.206
66.249.69.222
66.249.75.251
74.82.47.3
80.82.77.33
82.208.65.46
83.221.223.108
89.248.172.16
93.189.27.197
94.102.49.7
94.102.56.151
94.102.56.181
103.255.4.8
113.161.4.51
114.199.112.138
118.163.58.117
120.194.7.10
137.226.113.10
138.246.253.15
139.162.113.204
157.55.39.167
173.236.224.115
176.10.99.200
177.19.187.79
177.135.103.94
178.33.236.93
178.73.215.171
184.105.247.196
185.86.77.163
185.100.87.190
185.100.87.245
185.100.87.246
185.100.87.247
185.100.87.249
185.100.87.250
185.181.102.18
185.220.101.13
185.234.216.28
188.240.208.26
192.169.200.145
198.50.180.172
201.140.110.78
207.46.13.71
208.100.26.229
208.100.26.230
208.100.26.231
211.75.13.207
216.244.66.239
217.170.198.18
218.153.168.50
223.105.4.249
223.112.190.70

220
bi_http_2_30d.ipset Normal file
View File

@ -0,0 +1,220 @@
#
# bi_http_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# http with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/http/2?age=30d
# Source File Date: Thu Aug 13 07:48:10 UTC 2020
#
# Category : attacks
# Version : 782
#
# This File Date : Thu Aug 13 07:48:11 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 190 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_http_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.211.13
5.188.211.15
5.188.211.22
5.188.211.35
5.199.130.188
31.13.227.4
35.0.127.52
37.139.8.104
37.187.205.244
37.187.252.148
40.77.167.45
40.77.167.63
40.77.167.90
41.33.229.210
41.128.185.155
46.29.248.238
46.37.206.23
46.165.230.5
46.182.106.190
51.15.43.205
58.220.234.18
61.37.150.6
62.210.105.116
62.210.180.62
62.210.185.4
66.11.32.201
66.240.205.34
66.240.219.146
66.240.236.119
66.249.64.205
66.249.66.151
66.249.66.153
66.249.66.202
66.249.66.203
66.249.66.205
66.249.66.207
66.249.69.218
66.249.69.222
71.6.146.185
71.6.158.166
74.82.47.3
77.221.130.145
77.247.181.162
77.247.181.163
77.247.181.165
79.172.193.32
80.82.77.33
80.82.77.139
82.208.65.46
82.221.105.7
83.221.223.108
85.248.227.163
85.248.227.164
85.248.227.165
87.118.116.90
89.221.250.3
89.234.157.254
89.248.167.131
89.248.172.16
91.134.248.211
91.134.248.245
91.134.248.253
91.183.149.230
91.200.12.22
91.208.99.2
93.174.93.133
93.174.95.106
93.189.27.197
94.102.49.7
94.102.49.26
94.102.49.193
94.102.56.151
94.102.56.181
107.6.171.130
108.167.133.16
109.69.67.17
112.27.129.154
113.161.4.51
114.35.243.41
114.199.112.138
115.84.112.138
118.163.58.117
118.163.135.18
118.163.146.70
118.193.31.180
119.29.82.97
120.194.7.10
121.78.144.139
121.128.135.75
128.31.0.13
128.199.194.131
137.74.169.241
137.226.113.10
138.246.253.15
139.162.106.181
139.162.116.133
139.162.119.197
145.239.91.37
149.202.238.204
157.55.39.5
157.55.39.23
157.55.39.34
157.55.39.36
157.55.39.167
162.213.3.221
162.247.72.199
163.172.41.228
171.25.193.20
171.25.193.25
171.25.193.77
171.25.193.78
172.104.108.109
173.201.196.100
173.201.196.174
176.10.99.200
176.10.104.240
177.19.187.79
177.135.103.94
178.73.215.171
182.71.129.34
182.190.4.53
184.105.247.196
184.105.247.252
185.86.93.10
185.86.93.29
185.86.93.32
185.86.93.58
185.100.86.154
185.100.87.190
185.100.87.191
185.100.87.207
185.100.87.245
185.100.87.246
185.100.87.247
185.100.87.249
185.100.87.250
185.107.47.171
185.117.215.9
185.165.168.229
185.220.101.1
185.220.101.5
185.220.101.6
185.220.101.8
185.220.101.9
185.220.101.10
185.220.101.12
185.220.101.13
185.220.101.20
185.220.101.21
185.220.101.25
185.220.101.26
185.220.101.27
185.220.101.33
185.220.101.46
185.220.102.4
185.220.102.6
185.220.102.7
186.215.197.15
188.214.104.146
188.240.208.26
190.210.182.93
192.42.116.16
192.160.102.170
192.169.200.145
193.169.145.66
193.174.89.19
195.81.64.102
195.176.3.19
195.176.3.20
195.254.134.194
198.50.180.172
201.140.110.78
206.214.8.241
207.46.13.71
207.46.13.130
207.244.70.35
208.100.26.229
208.100.26.230
208.100.26.231
208.100.26.232
210.16.189.4
211.75.13.207
212.21.66.6
212.142.226.93
216.218.134.12
216.243.31.2
217.70.186.133
217.170.198.18
218.92.229.178
223.112.190.70

125
bi_imap_0_1d.ipset Normal file
View File

@ -0,0 +1,125 @@
#
# bi_imap_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# imap with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/imap/0?age=1d
# Source File Date: Fri Aug 14 10:12:45 UTC 2020
#
# Category : attacks
# Version : 12830
#
# This File Date : Fri Aug 14 10:12:45 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 95 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_imap_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.9.164.242
14.160.25.125
24.30.67.145
27.116.255.153
35.193.0.40
35.224.46.227
36.228.83.172
42.76.58.13
50.197.210.138
52.125.129.180
52.188.149.16
59.120.236.185
60.246.0.87
60.246.0.162
60.246.0.188
60.246.3.84
60.246.3.138
60.246.3.141
60.246.3.144
60.246.3.146
60.248.249.190
61.6.247.92
61.155.83.22
61.223.19.251
72.210.252.142
72.221.232.144
72.223.168.76
73.36.232.192
79.111.42.48
79.137.112.61
86.160.241.113
87.248.183.165
91.92.212.18
98.143.145.30
98.162.25.28
103.233.64.130
105.158.89.100
111.22.108.103
111.82.26.240
111.83.178.114
111.92.107.66
111.92.107.67
111.241.107.94
113.53.82.92
114.143.230.186
115.84.91.76
115.84.91.146
115.84.99.216
117.92.46.132
121.120.4.16
122.118.1.138
122.165.233.7
123.205.60.55
175.97.18.254
175.107.202.80
177.10.100.115
177.244.0.6
177.244.2.162
182.71.239.18
183.87.70.210
183.89.211.135
184.178.172.7
184.179.216.142
184.179.216.151
184.185.236.72
184.185.236.81
184.185.236.85
186.211.176.190
187.94.31.237
187.188.141.239
187.189.51.116
187.189.243.22
189.59.5.49
190.121.142.164
191.97.1.40
192.200.158.177
193.150.88.173
194.105.136.104
202.137.134.139
202.137.141.109
202.137.142.28
202.137.142.97
202.137.154.1
202.137.155.193
202.137.155.235
203.110.89.220
205.185.223.136
213.6.38.50
216.151.191.130
218.164.21.196
219.146.247.106
220.138.40.41
220.138.40.121
220.138.41.77
221.208.253.253

1902
bi_mail_0_1d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

198
bi_mail_1_7d.ipset Normal file
View File

@ -0,0 +1,198 @@
#
# bi_mail_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# mail with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/mail/1?age=7d
# Source File Date: Fri Aug 14 06:01:54 UTC 2020
#
# Category : attacks
# Version : 3105
#
# This File Date : Fri Aug 14 06:01:54 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 168 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_mail_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.211.10
5.190.189.173
37.49.224.14
37.49.224.65
37.49.224.68
37.49.224.79
37.49.224.109
37.49.224.114
37.49.224.155
37.49.224.157
37.49.224.162
37.49.224.185
37.49.224.186
37.49.224.226
37.49.224.240
39.113.224.34
41.85.161.132
41.128.185.155
49.68.144.216
49.68.145.86
49.68.146.28
51.15.80.14
54.37.16.241
54.149.191.237
54.149.191.240
58.216.218.236
59.152.98.163
60.167.112.29
60.167.113.42
60.169.114.42
60.169.115.103
60.169.115.221
61.37.150.6
61.161.209.134
62.4.55.37
66.11.32.201
66.240.192.138
70.98.78.129
70.98.78.130
70.98.78.135
70.98.78.151
70.98.78.163
71.6.146.130
71.6.146.186
77.247.181.162
77.247.181.165
80.82.70.118
80.82.77.139
82.221.105.6
83.169.208.218
85.248.227.163
85.248.227.164
85.248.227.165
89.234.157.254
89.248.172.16
91.144.93.182
93.99.134.148
93.174.95.106
94.97.63.59
94.230.208.148
95.77.99.194
103.28.38.166
103.84.238.240
103.199.157.130
103.207.37.60
105.67.10.10
112.217.215.213
113.194.136.13
114.134.88.138
114.235.249.231
115.79.4.223
115.84.105.146
115.84.112.138
117.92.165.4
117.92.203.58
118.163.58.117
118.163.97.19
118.163.135.17
118.163.135.18
120.188.87.21
121.128.135.73
121.157.71.47
123.21.29.75
123.138.199.66
131.100.81.219
139.162.99.243
162.247.74.7
162.247.74.74
162.247.74.201
163.121.250.2
164.52.24.168
173.0.84.225
173.247.238.201
176.10.99.200
176.10.107.180
177.19.164.149
177.19.187.79
177.43.251.153
177.135.101.5
177.135.101.101
178.159.37.88
183.102.114.251
185.43.206.103
185.100.87.207
185.100.87.245
185.100.87.248
185.107.47.171
185.220.100.252
185.220.100.253
185.220.101.1
185.220.101.2
185.220.101.6
185.220.101.7
185.220.101.8
185.220.101.9
185.220.101.10
185.220.101.12
185.220.101.13
185.220.101.14
185.220.101.17
185.220.101.18
185.220.101.20
185.220.102.4
185.234.217.41
186.215.130.159
186.215.130.242
186.215.143.149
186.215.195.249
186.215.197.15
186.215.198.137
187.58.132.251
187.58.134.87
187.58.139.171
188.163.109.153
188.165.235.21
189.59.5.81
189.59.69.3
189.114.67.195
190.202.44.194
190.210.182.93
192.42.116.22
192.160.102.168
192.160.102.169
192.162.98.20
195.33.204.170
195.81.64.102
195.176.3.19
195.176.3.20
195.176.3.23
200.152.107.173
200.175.104.103
200.199.114.226
201.140.110.78
201.184.241.243
202.57.11.126
208.100.26.232
208.100.26.233
208.100.26.235
208.100.26.236
208.100.26.237
211.20.181.113
212.129.16.53
212.227.15.26
212.227.126.131
212.227.126.134
212.227.126.187
218.22.100.42
219.93.121.22

469
bi_mail_2_30d.ipset Normal file
View File

@ -0,0 +1,469 @@
#
# bi_mail_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# mail with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/mail/2?age=30d
# Source File Date: Thu Aug 13 19:26:52 UTC 2020
#
# Category : attacks
# Version : 794
#
# This File Date : Thu Aug 13 19:26:52 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 439 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_mail_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.22.179.29
2.117.211.10
5.199.130.188
14.160.29.246
14.161.42.137
14.161.43.154
14.161.45.78
14.161.48.14
14.177.235.133
23.254.215.28
31.13.227.4
31.173.68.134
35.0.127.52
36.37.180.26
37.49.224.11
37.49.224.12
37.49.224.14
37.49.224.21
37.49.224.26
37.49.224.62
37.49.224.79
37.49.224.85
37.49.224.95
37.49.224.100
37.49.224.109
37.49.224.110
37.49.224.114
37.49.224.134
37.49.224.136
37.49.224.143
37.49.224.154
37.49.224.155
37.49.224.157
37.49.224.162
37.49.224.173
37.49.224.176
37.49.224.177
37.49.224.185
37.49.224.186
37.49.224.223
37.49.224.225
37.49.224.226
37.49.224.237
37.49.224.240
37.49.224.248
37.49.224.249
37.49.226.169
37.49.230.147
41.33.229.210
41.77.6.27
41.85.161.132
41.89.22.119
41.128.185.155
41.190.137.14
42.243.154.6
43.247.145.197
46.29.248.238
46.165.230.5
49.76.205.251
51.15.43.205
51.15.80.14
54.149.191.237
54.204.34.129
58.16.114.105
58.20.185.12
58.210.134.186
58.214.0.42
58.214.25.190
58.214.239.53
58.216.218.236
59.28.185.59
59.44.47.106
59.50.85.74
59.57.150.170
60.13.181.244
60.167.20.47
60.167.112.213
60.174.92.50
60.216.116.178
61.37.150.6
61.131.3.225
61.132.88.132
61.134.44.28
61.160.25.118
61.161.209.134
61.184.176.231
61.185.139.72
62.4.14.198
62.4.55.120
62.133.141.171
62.162.47.34
62.210.37.82
62.215.172.18
66.11.32.201
66.220.155.136
66.220.155.138
66.240.192.138
66.240.219.146
66.240.236.119
69.171.232.135
70.98.78.93
70.98.78.99
70.98.78.114
70.98.78.119
70.98.78.120
70.98.78.121
70.98.78.124
70.98.78.128
70.98.78.130
70.98.78.131
70.98.78.132
70.98.78.135
70.98.78.139
70.98.78.142
70.98.78.152
70.98.78.155
70.98.78.158
71.6.146.130
71.6.146.185
71.6.146.186
71.6.158.166
71.6.167.142
74.123.21.22
77.40.3.96
77.46.237.27
77.247.181.162
77.247.181.163
77.247.181.165
80.14.77.216
80.67.172.162
80.82.70.118
80.82.77.33
80.82.77.139
82.114.82.90
82.130.202.35
82.221.105.6
82.221.105.7
83.169.208.218
84.15.191.252
85.234.37.114
85.248.227.163
85.248.227.164
85.248.227.165
87.118.122.30
87.126.55.27
89.31.57.5
89.144.12.17
89.234.157.254
89.248.167.131
89.248.172.16
91.245.28.37
92.154.95.236
93.64.183.162
93.174.95.106
94.97.22.203
94.102.49.190
94.102.49.193
94.102.51.78
95.77.99.194
95.110.194.245
95.111.39.102
95.165.164.170
103.28.38.166
103.74.90.26
103.76.188.2
103.84.238.240
103.89.88.69
103.89.88.109
103.99.2.5
103.99.2.7
103.207.37.40
103.207.37.60
103.207.38.151
103.237.56.49
103.255.5.117
104.244.73.126
105.67.10.10
109.69.67.17
109.166.128.6
109.175.20.226
109.201.133.100
111.26.198.30
112.24.104.228
112.26.118.226
112.113.241.207
112.171.173.12
113.8.194.3
113.161.37.126
113.161.88.235
114.29.239.208
114.79.143.15
114.134.88.138
114.141.189.194
115.56.225.2
115.79.47.132
115.84.92.33
115.84.92.71
115.84.92.76
115.84.99.60
115.84.99.188
115.84.105.146
115.84.112.138
115.231.241.82
115.238.31.114
116.55.19.46
116.112.66.186
116.228.9.58
117.4.101.26
117.40.139.82
118.122.94.151
118.163.58.117
118.163.97.19
118.163.135.17
118.163.135.18
118.163.143.170
119.18.159.146
119.90.34.135
120.188.87.21
120.196.144.242
120.197.62.9
120.203.25.58
121.128.135.73
121.128.135.75
122.53.79.16
122.139.5.237
122.252.230.130
123.24.161.123
123.24.205.196
123.25.30.20
123.25.30.87
123.59.100.243
123.138.18.10
123.138.199.66
125.212.217.214
131.100.36.77
138.186.179.16
139.162.99.243
144.217.60.211
147.91.226.29
149.202.238.204
154.68.5.46
162.247.72.199
163.121.250.2
164.52.24.168
168.187.86.194
171.25.193.25
171.25.193.77
171.25.193.78
172.98.193.43
176.10.99.200
176.10.104.240
176.10.107.180
177.19.164.149
177.19.187.79
177.43.251.153
177.135.101.5
177.135.101.101
178.47.132.182
178.175.131.194
179.43.146.230
179.99.209.73
179.191.101.190
180.211.170.198
181.210.57.227
182.72.66.154
182.72.136.226
182.72.186.230
182.73.113.38
182.73.201.10
182.74.112.150
182.74.247.178
182.75.52.110
182.140.133.153
183.62.15.170
183.62.20.2
183.64.166.163
183.102.114.251
185.19.80.26
185.100.86.154
185.100.87.190
185.100.87.191
185.100.87.206
185.100.87.207
185.100.87.245
185.100.87.248
185.100.87.250
185.107.47.171
185.107.70.202
185.117.215.9
185.129.62.62
185.220.100.252
185.220.100.253
185.220.101.1
185.220.101.3
185.220.101.4
185.220.101.5
185.220.101.6
185.220.101.8
185.220.101.9
185.220.101.10
185.220.101.12
185.220.101.13
185.220.101.16
185.220.101.20
185.220.101.21
185.220.101.22
185.220.101.33
185.220.102.4
185.220.102.6
185.220.102.7
185.220.102.8
185.234.217.41
186.5.162.72
186.150.97.98
186.167.243.89
186.179.100.90
186.215.130.159
186.215.130.242
186.215.143.149
186.215.195.249
186.215.197.15
186.215.198.137
187.58.132.251
187.58.134.87
187.58.139.171
187.141.75.161
187.177.161.226
187.216.189.46
188.165.235.21
189.59.5.81
189.59.69.3
189.114.67.195
189.204.6.157
189.211.189.44
190.7.157.130
190.7.180.218
190.56.70.131
190.64.84.242
190.81.124.139
190.92.45.26
190.202.44.194
190.210.182.93
190.232.11.187
191.102.120.181
192.42.116.13
192.42.116.15
192.42.116.16
192.42.116.22
192.160.102.165
192.160.102.166
192.160.102.168
192.160.102.169
194.25.134.22
195.81.64.102
195.175.18.146
195.176.3.19
195.176.3.20
195.252.98.130
195.254.134.194
196.28.236.73
196.43.234.193
198.20.70.114
198.20.87.98
200.59.6.250
200.92.215.84
200.107.241.50
200.175.104.103
200.199.114.226
201.140.110.78
201.151.161.78
201.184.241.243
201.251.127.123
202.107.34.250
202.137.141.144
202.137.154.39
202.137.154.51
202.137.154.154
202.137.155.161
202.137.155.171
202.137.155.190
203.88.155.220
207.244.70.35
208.100.26.230
208.100.26.231
208.100.26.232
208.100.26.233
208.100.26.235
208.100.26.236
208.100.26.237
208.113.157.50
211.20.181.113
212.21.66.6
212.43.122.158
212.83.146.233
212.111.199.148
212.165.108.172
212.227.15.19
212.227.126.131
212.227.126.134
212.227.126.187
213.138.74.85
213.147.118.56
216.239.90.19
217.10.204.238
217.217.179.17
218.2.157.188
218.22.11.106
218.22.100.42
218.23.26.50
218.25.31.150
218.26.163.125
218.28.58.186
218.56.102.14
218.90.162.234
218.93.11.82
218.93.11.178
218.93.21.50
218.93.220.102
218.201.14.134
219.143.72.21
219.156.107.98
220.164.2.62
220.178.107.242
220.179.61.160
220.189.235.126
220.225.7.55
220.248.200.226
221.203.169.50
221.209.11.14
221.226.50.162
221.230.1.113
222.74.5.235
222.189.41.46
222.217.221.181
222.218.17.189
222.229.112.168
222.242.226.99
223.30.156.98
223.255.230.62

39
bi_named_0_1d.ipset Normal file
View File

@ -0,0 +1,39 @@
#
# bi_named_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# named with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/named/0?age=1d
# Source File Date: Fri Aug 14 08:08:09 UTC 2020
#
# Category : attacks
# Version : 6332
#
# This File Date : Fri Aug 14 08:08:09 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 9 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_named_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
3.218.156.136
3.236.136.177
3.236.198.1
37.49.224.64
45.56.74.240
45.79.214.164
54.147.93.14
54.237.161.5
93.174.89.53

30
bi_owncloud_0_1d.ipset Normal file
View File

@ -0,0 +1,30 @@
#
# bi_owncloud_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# owncloud with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/owncloud/0?age=1d
# Source File Date: Mon Nov 5 08:01:27 UTC 2018
#
# Category : attacks
# Version : 30
#
# This File Date : Mon Nov 5 08:32:46 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_owncloud_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

46
bi_plesk-postfix_0_1d.ipset Normal file
View File

@ -0,0 +1,46 @@
#
# bi_plesk-postfix_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# plesk-postfix with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/plesk-postfix/0?age=1d
# Source File Date: Fri Aug 14 05:56:14 UTC 2020
#
# Category : attacks
# Version : 11340
#
# This File Date : Fri Aug 14 05:56:14 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 16 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_plesk-postfix_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
52.238.175.163
87.246.7.130
104.244.79.26
185.234.217.151
185.234.217.164
193.56.28.144
193.169.253.27
193.169.253.48
193.169.253.128
193.169.253.136
193.169.253.137
193.169.253.138
193.169.255.40
193.169.255.41
212.70.149.3
212.70.149.67

186
bi_postfix-sasl_0_1d.ipset Normal file
View File

@ -0,0 +1,186 @@
#
# bi_postfix-sasl_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# postfix-sasl with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/postfix-sasl/0?age=1d
# Source File Date: Fri Aug 14 09:44:10 UTC 2020
#
# Category : attacks
# Version : 34191
#
# This File Date : Fri Aug 14 09:44:10 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 156 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_postfix-sasl_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.206.197
37.120.145.163
37.235.16.138
45.119.84.159
45.143.223.138
45.164.202.118
45.164.202.132
45.181.31.118
45.181.31.169
45.224.169.253
45.230.89.101
45.239.143.96
46.174.215.59
46.238.197.22
52.149.223.211
52.152.216.70
52.185.144.216
52.238.175.163
58.57.4.238
60.19.64.4
68.183.22.30
77.40.3.215
77.40.3.235
77.40.61.123
77.40.62.39
77.40.62.132
77.45.85.95
78.128.113.116
81.163.6.250
83.2.189.11
87.246.7.7
87.246.7.8
87.246.7.13
87.246.7.17
87.246.7.22
87.246.7.24
87.246.7.138
87.246.7.139
87.246.7.140
87.246.7.146
88.74.192.68
88.199.41.47
88.199.126.52
88.199.127.146
89.248.168.232
89.248.171.181
89.248.171.187
91.83.160.144
91.83.162.129
91.189.216.154
91.236.175.161
91.245.30.125
94.74.129.77
94.102.50.190
94.102.51.176
95.190.45.240
103.19.201.6
103.25.132.42
103.25.134.173
103.125.189.12
103.133.105.65
103.198.80.83
103.198.81.6
103.207.6.70
103.207.7.41
104.41.1.229
104.207.155.71
109.72.202.135
114.231.8.32
114.232.110.246
115.85.213.217
116.196.108.9
121.17.210.61
131.196.171.116
138.0.92.220
138.122.97.115
141.98.80.67
142.11.229.244
167.114.147.42
168.63.204.7
170.81.19.214
170.254.54.248
176.111.113.131
177.53.165.61
177.54.251.6
177.54.251.190
177.72.98.160
177.74.254.43
177.74.254.82
177.87.253.37
177.91.184.45
177.91.188.97
177.91.188.101
177.130.163.130
177.154.234.109
177.190.75.164
177.200.65.125
178.239.147.197
180.101.145.234
181.174.144.23
181.174.144.46
181.174.144.93
182.111.244.146
185.127.24.39
185.127.24.44
185.234.216.63
185.234.216.66
185.234.216.87
185.234.217.41
185.234.217.151
185.234.217.164
185.234.219.11
185.234.219.12
185.234.219.13
185.234.219.14
185.234.219.230
186.232.14.92
186.250.158.223
187.19.203.118
187.95.60.109
187.111.41.133
188.187.172.249
189.1.15.62
190.196.229.72
191.53.193.230
191.102.103.250
191.232.165.34
193.35.48.18
193.35.51.13
193.56.28.102
193.56.28.141
193.56.28.144
193.56.28.232
193.142.59.121
193.169.253.27
193.169.253.48
193.169.253.128
193.169.253.136
193.169.253.137
193.169.253.138
193.169.255.40
193.169.255.41
195.136.95.6
195.184.82.101
196.0.47.14
200.125.24.218
201.148.246.174
203.100.77.10
212.70.149.3
212.70.149.19
212.70.149.67
212.244.23.19
213.235.98.144
217.182.244.60
218.25.161.226
222.186.61.191

37
bi_postfix-sasl_1_7d.ipset Normal file
View File

@ -0,0 +1,37 @@
#
# bi_postfix-sasl_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# postfix-sasl with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/postfix-sasl/1?age=7d
# Source File Date: Fri Aug 14 01:03:00 UTC 2020
#
# Category : attacks
# Version : 1769
#
# This File Date : Fri Aug 14 01:03:01 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 7 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_postfix-sasl_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
37.49.224.68
37.49.224.157
37.49.224.185
37.49.224.186
58.216.218.236
93.99.134.148
185.234.217.41

45
bi_postfix-sasl_2_30d.ipset Normal file
View File

@ -0,0 +1,45 @@
#
# bi_postfix-sasl_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# postfix-sasl with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/postfix-sasl/2?age=30d
# Source File Date: Thu Aug 13 07:48:11 UTC 2020
#
# Category : attacks
# Version : 589
#
# This File Date : Thu Aug 13 07:48:11 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 15 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_postfix-sasl_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
37.49.224.14
37.49.224.21
37.49.224.85
37.49.224.100
37.49.224.134
37.49.224.157
37.49.224.173
37.49.224.176
37.49.224.185
37.49.224.186
37.49.224.237
58.216.218.236
60.167.20.47
77.40.3.96
196.28.236.73

642
bi_postfix_0_1d.ipset Normal file
View File

@ -0,0 +1,642 @@
#
# bi_postfix_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# postfix with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/postfix/0?age=1d
# Source File Date: Fri Aug 14 10:16:07 UTC 2020
#
# Category : attacks
# Version : 35104
#
# This File Date : Fri Aug 14 10:16:07 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 612 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_postfix_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.119.195.58
1.235.192.218
1.251.145.169
3.124.123.204
5.82.114.79
5.135.43.172
5.172.239.100
5.188.206.197
5.196.8.72
14.242.109.220
18.181.196.197
20.44.98.174
23.254.209.213
27.34.18.128
27.40.126.72
27.76.71.185
27.184.192.189
31.0.124.100
31.40.168.7
31.167.138.207
31.206.15.143
36.26.251.216
37.14.123.164
37.49.229.174
37.49.230.151
37.111.15.26
37.129.13.48
37.152.181.151
37.228.241.229
37.248.101.191
41.76.8.16
42.119.153.231
43.225.151.253
43.225.194.75
45.13.58.133
45.64.86.48
45.95.168.164
45.123.190.87
45.124.144.116
45.138.74.43
45.138.74.195
45.138.74.199
45.138.74.201
45.138.74.207
45.142.182.70
45.142.182.84
45.142.182.90
45.146.254.249
45.175.230.2
45.177.74.233
45.184.24.5
45.191.204.1
46.148.201.206
46.175.248.201
46.217.0.187
46.217.14.12
47.40.186.7
47.90.37.144
47.102.196.154
49.68.144.198
49.68.144.210
49.68.145.109
49.68.146.28
49.68.146.188
49.68.254.24
49.81.216.183
49.82.229.79
49.82.229.155
49.82.229.229
49.88.65.37
49.88.65.39
49.88.66.41
49.88.66.102
49.88.160.213
49.88.160.217
49.88.160.222
49.88.226.15
49.233.61.51
49.233.128.229
49.233.182.23
49.234.95.189
49.235.125.17
49.235.201.149
51.75.17.122
51.75.140.153
51.77.147.5
51.77.213.136
51.79.145.158
51.91.255.147
51.210.151.242
51.254.207.92
54.37.14.3
54.38.58.80
58.33.49.196
58.57.4.238
58.87.95.96
58.230.147.230
59.55.39.25
60.162.76.5
61.133.122.19
61.163.192.88
61.177.172.102
62.28.137.98
62.28.222.221
62.75.207.83
62.94.206.57
63.82.54.35
63.82.54.36
63.82.54.38
63.82.54.43
63.82.54.46
63.82.54.135
63.82.54.136
63.82.54.223
63.82.54.224
63.82.54.228
63.82.54.230
63.82.54.231
63.82.55.132
63.82.55.133
63.82.55.189
63.82.55.190
63.83.74.161
63.83.74.172
63.83.74.173
63.83.74.174
66.240.219.146
68.183.224.233
69.13.205.101
69.94.140.233
69.94.156.240
69.94.156.244
69.148.226.251
70.98.78.129
70.98.78.130
70.98.78.136
72.11.135.222
72.216.87.72
75.112.68.166
76.168.17.185
77.40.2.6
77.40.2.57
77.40.2.59
77.40.2.236
77.40.61.123
77.40.62.39
77.45.86.138
77.242.16.87
78.29.176.180
78.40.105.178
78.128.113.116
79.125.170.49
79.179.214.89
80.211.239.49
80.244.179.6
81.184.27.196
82.212.129.252
83.110.215.91
83.217.10.52
83.217.10.53
83.217.10.54
83.217.10.55
83.217.10.57
83.217.10.58
83.217.10.60
83.217.10.62
83.217.10.63
83.217.10.64
85.93.28.230
85.117.61.186
85.130.101.49
86.17.94.149
87.97.57.80
87.176.205.23
87.246.7.5
87.246.7.7
87.246.7.8
87.246.7.9
87.246.7.12
87.246.7.13
87.246.7.17
87.246.7.19
87.246.7.20
87.246.7.25
87.246.7.30
87.246.7.137
87.246.7.138
87.246.7.141
87.246.7.147
88.6.234.226
88.68.171.45
88.99.11.4
88.99.11.7
88.99.11.31
88.99.11.39
88.99.11.43
88.99.11.44
88.99.11.46
88.198.1.109
89.17.149.46
89.137.242.24
91.103.252.252
91.121.65.15
91.121.145.227
91.124.168.53
91.132.103.80
91.134.216.224
91.232.96.12
91.232.97.227
91.232.97.232
91.232.97.237
91.232.97.242
91.232.97.246
91.232.97.247
91.232.97.251
91.232.97.252
93.108.133.191
93.177.101.87
93.177.101.88
93.177.101.89
93.177.101.90
93.177.101.91
93.177.101.92
93.177.101.93
93.177.101.94
94.23.179.199
94.25.181.10
94.102.54.217
94.152.193.51
94.152.193.151
94.152.199.124
94.157.147.100
94.176.189.20
94.200.247.166
94.228.182.244
95.181.178.139
95.181.178.141
95.181.178.162
95.181.178.174
95.211.253.194
101.6.133.27
101.69.200.162
102.128.76.103
102.142.22.169
103.13.133.68
103.14.209.50
103.46.239.131
103.61.37.88
103.74.70.23
103.90.233.35
103.105.67.146
103.120.224.222
103.133.105.65
103.141.138.127
103.149.12.54
103.221.252.46
103.235.170.162
103.246.240.26
104.131.182.167
104.168.144.250
104.223.197.227
104.236.142.89
105.112.90.140
105.235.134.106
106.12.72.135
106.12.116.75
106.12.172.207
106.12.217.176
106.53.40.211
106.54.197.97
106.110.164.232
106.111.118.65
106.111.118.171
107.158.89.57
107.158.89.94
107.174.245.4
108.60.243.123
109.86.230.166
109.110.216.29
109.237.96.33
109.237.96.37
109.237.96.43
109.237.96.119
109.237.96.131
109.237.96.156
109.237.96.157
109.237.96.194
109.237.96.216
109.237.96.223
109.237.96.224
109.237.96.230
109.237.96.231
109.237.96.235
109.242.227.129
110.35.80.82
110.39.190.114
111.93.235.74
111.175.186.150
112.13.200.154
112.78.188.194
112.85.42.104
112.85.42.229
112.85.64.238
112.197.70.141
113.66.197.129
113.200.60.74
114.141.55.185
114.231.8.94
114.231.8.193
114.232.110.15
114.232.110.185
114.232.110.246
114.234.60.181
114.234.246.181
114.234.247.23
114.234.252.197
114.237.109.13
114.237.109.31
114.237.109.35
114.237.109.36
114.237.109.130
114.237.109.162
114.237.109.205
114.237.109.245
114.237.134.47
114.237.140.194
114.237.156.216
114.237.188.154
114.237.188.166
114.237.188.180
114.237.188.241
114.237.188.247
114.237.188.252
115.84.82.174
115.202.129.92
115.202.129.135
115.204.36.151
115.216.159.137
115.216.187.46
116.109.227.223
116.236.147.38
117.69.31.35
117.69.31.98
117.69.31.184
117.69.46.237
117.69.47.73
117.69.47.111
117.69.47.223
117.86.8.58
117.87.219.74
117.92.16.202
117.92.16.220
117.92.16.229
118.25.222.235
118.36.62.128
118.71.253.20
118.89.27.72
119.28.51.99
119.45.12.105
119.90.61.10
120.131.11.49
121.18.39.22
122.51.64.150
122.51.225.107
122.51.254.201
122.181.16.134
122.231.162.255
123.13.203.67
123.20.216.243
123.161.115.50
124.113.219.169
124.126.18.162
124.156.218.80
124.160.83.138
125.87.90.107
125.141.56.117
125.214.48.165
129.152.141.71
129.205.124.234
129.211.171.24
129.226.68.181
129.226.73.26
130.185.108.164
130.185.108.169
130.185.108.174
130.185.108.179
130.185.108.183
130.185.108.188
131.0.86.139
131.72.189.14
131.196.221.218
132.232.37.206
134.209.155.186
138.68.148.177
138.197.180.29
139.59.169.37
139.99.237.183
139.155.17.76
139.155.26.79
140.213.187.127
141.98.9.54
144.217.19.8
149.28.229.115
149.72.24.112
149.72.128.240
149.72.135.47
149.72.179.210
149.72.192.47
149.72.195.140
149.72.219.87
149.72.238.76
151.80.60.151
154.117.81.109
154.204.25.158
156.96.62.82
157.52.193.83
157.52.193.85
159.65.144.102
159.65.236.182
159.203.25.76
162.243.128.171
163.121.250.2
164.77.117.10
167.89.83.202
167.114.147.42
167.249.224.136
168.245.25.157
168.245.96.167
170.84.225.35
171.225.154.79
171.229.169.86
172.241.13.149
172.241.13.197
172.245.93.118
175.139.3.41
175.139.202.201
176.77.209.27
177.74.142.178
177.124.184.44
177.155.159.179
178.63.148.209
178.87.20.8
178.120.247.224
178.126.255.147
178.128.21.38
178.150.184.114
178.210.39.78
179.6.208.140
179.108.249.114
180.76.121.28
180.76.168.54
180.104.22.122
180.104.23.208
180.104.175.42
180.104.175.68
180.104.175.246
180.121.134.100
180.123.25.174
180.123.157.49
180.124.77.159
180.124.78.65
180.124.78.205
180.124.79.14
180.124.79.174
180.124.146.106
180.124.146.201
180.127.79.57
180.127.79.176
180.127.79.211
180.127.93.167
180.127.111.66
180.212.38.138
181.130.207.30
181.143.172.106
181.188.182.210
182.111.246.209
182.189.240.39
182.232.185.136
183.87.28.34
183.136.225.44
183.166.98.82
183.166.99.103
185.74.5.156
185.98.21.5
185.127.24.39
185.142.236.34
185.143.223.210
185.152.124.69
185.181.211.13
185.181.211.14
185.181.211.23
185.181.211.24
185.181.211.25
185.181.211.26
185.181.211.27
185.181.211.28
185.181.211.31
185.181.211.32
185.181.211.33
185.181.211.34
185.181.211.35
185.181.211.36
185.181.211.37
185.181.211.98
185.183.161.119
185.183.161.146
185.230.202.112
186.4.242.37
186.47.21.116
186.200.181.130
186.226.14.106
186.251.95.167
187.8.226.10
187.11.124.60
187.187.193.76
188.40.198.236
188.125.170.228
188.125.170.229
188.125.170.230
188.125.170.231
188.125.170.232
188.125.170.233
188.125.170.234
188.125.170.235
188.129.34.213
188.131.131.59
188.138.75.115
188.212.99.159
189.93.99.52
190.40.215.185
190.46.10.42
190.150.53.70
190.197.4.133
190.237.22.99
191.85.201.99
191.102.81.8
191.209.82.106
192.35.168.219
192.35.169.48
192.236.179.176
192.241.212.195
192.241.233.246
193.35.48.18
193.35.51.13
193.56.28.144
193.56.28.186
193.164.5.81
193.164.5.82
193.164.5.83
193.164.5.84
193.164.5.85
193.164.5.86
193.164.5.87
193.164.5.88
193.165.236.162
193.169.212.191
193.169.212.196
193.169.212.229
193.228.91.123
194.61.24.55
195.62.46.112
195.62.46.114
195.206.129.9
196.229.229.200
197.238.16.64
198.143.133.154
200.59.54.170
200.127.70.70
201.46.29.149
201.62.73.92
201.140.10.243
201.231.115.87
202.62.224.61
202.77.105.98
202.147.198.154
202.168.205.181
202.188.20.123
203.189.118.19
203.189.119.44
209.160.97.74
212.18.29.52
212.70.149.3
212.70.149.19
212.70.149.67
212.129.38.177
213.32.23.58
213.32.111.52
213.154.70.102
217.112.142.223
218.75.110.41
218.92.0.215
218.92.0.216
218.92.0.219
218.204.70.179
220.176.46.243
221.121.31.235
222.74.4.70
222.186.30.112
223.71.167.164
223.73.84.25
223.188.149.133
223.199.23.93
223.242.228.85
223.242.228.115
223.242.228.146
223.242.228.217
223.242.228.243
223.242.229.35
223.242.229.231
223.245.212.154
223.245.213.85
223.245.213.240

77
bi_postfix_1_7d.ipset Normal file
View File

@ -0,0 +1,77 @@
#
# bi_postfix_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# postfix with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/postfix/1?age=7d
# Source File Date: Fri Aug 14 05:08:13 UTC 2020
#
# Category : attacks
# Version : 3069
#
# This File Date : Fri Aug 14 05:08:13 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 47 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_postfix_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
37.49.224.65
37.49.224.109
37.49.224.226
37.49.224.240
41.85.161.132
49.68.144.216
49.68.145.86
49.68.146.28
54.149.191.237
59.152.98.163
66.240.192.138
70.98.78.129
70.98.78.130
70.98.78.135
70.98.78.151
70.98.78.163
71.6.146.130
71.6.146.186
80.82.77.139
82.221.105.6
83.169.208.218
89.248.172.16
93.174.95.106
94.97.63.59
95.77.99.194
114.235.249.231
115.79.4.223
117.92.165.4
117.92.203.58
120.188.87.21
121.157.71.47
123.21.29.75
139.162.99.243
163.121.250.2
164.52.24.168
173.0.84.225
185.43.206.103
188.165.235.21
200.199.114.226
208.100.26.232
208.100.26.235
208.100.26.237
212.129.16.53
212.227.15.26
212.227.126.131
212.227.126.134
212.227.126.187

169
bi_postfix_2_30d.ipset Normal file
View File

@ -0,0 +1,169 @@
#
# bi_postfix_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# postfix with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/postfix/2?age=30d
# Source File Date: Thu Aug 13 19:40:47 UTC 2020
#
# Category : attacks
# Version : 784
#
# This File Date : Thu Aug 13 19:40:47 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 139 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_postfix_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.22.179.29
23.254.215.28
36.37.180.26
37.49.224.12
37.49.224.21
37.49.224.26
37.49.224.62
37.49.224.79
37.49.224.95
37.49.224.109
37.49.224.110
37.49.224.134
37.49.224.143
37.49.224.154
37.49.224.157
37.49.224.162
37.49.224.173
37.49.224.177
37.49.224.185
37.49.224.223
37.49.224.225
37.49.224.226
37.49.224.237
37.49.224.240
37.49.224.248
37.49.224.249
37.49.230.147
41.77.6.27
41.85.161.132
41.190.137.14
43.247.145.197
49.76.205.251
54.149.191.237
54.204.34.129
61.184.176.231
62.4.14.198
62.4.55.120
62.162.47.34
62.215.172.18
66.220.155.136
66.240.192.138
66.240.219.146
66.240.236.119
70.98.78.93
70.98.78.99
70.98.78.114
70.98.78.119
70.98.78.120
70.98.78.121
70.98.78.124
70.98.78.128
70.98.78.130
70.98.78.131
70.98.78.132
70.98.78.135
70.98.78.139
70.98.78.142
70.98.78.152
70.98.78.155
70.98.78.158
71.6.146.130
71.6.146.185
71.6.146.186
71.6.167.142
77.46.237.27
77.247.181.162
80.82.70.118
80.82.77.33
80.82.77.139
82.221.105.6
82.221.105.7
83.169.208.218
84.15.191.252
87.118.122.30
87.126.55.27
89.248.167.131
89.248.172.16
92.154.95.236
93.174.95.106
94.97.22.203
94.102.49.190
95.77.99.194
95.111.39.102
103.74.90.26
103.89.88.109
103.99.2.5
103.255.5.117
105.67.10.10
114.79.143.15
115.79.47.132
120.188.87.21
122.53.79.16
123.25.30.20
123.138.18.10
125.212.217.214
138.186.179.16
139.162.99.243
163.121.250.2
164.52.24.168
168.187.86.194
179.99.209.73
179.191.101.190
181.210.57.227
185.19.80.26
186.150.97.98
186.167.243.89
187.141.75.161
187.177.161.226
187.216.189.46
188.165.235.21
190.7.157.130
190.81.124.139
190.92.45.26
190.232.11.187
194.25.134.22
195.175.18.146
196.28.236.73
196.43.234.193
198.20.70.114
198.20.87.98
200.59.6.250
200.92.215.84
200.107.241.50
200.199.114.226
201.151.161.78
202.137.141.144
208.100.26.230
208.100.26.232
208.100.26.233
208.100.26.235
208.100.26.237
212.83.146.233
212.165.108.172
212.227.15.19
212.227.126.131
212.227.126.134
212.227.126.187
222.242.226.99
223.30.156.98

73
bi_proftpd_0_1d.ipset Normal file
View File

@ -0,0 +1,73 @@
#
# bi_proftpd_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# proftpd with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/proftpd/0?age=1d
# Source File Date: Fri Aug 14 10:16:07 UTC 2020
#
# Category : attacks
# Version : 29293
#
# This File Date : Fri Aug 14 10:16:07 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 43 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_proftpd_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
36.90.42.221
45.117.82.166
45.125.66.22
45.227.255.4
49.83.59.159
49.83.105.136
49.88.112.112
51.68.11.215
51.91.204.85
60.208.37.187
62.149.145.87
68.66.224.3
68.66.224.47
81.177.140.71
92.114.19.4
94.102.56.238
103.18.179.212
103.67.234.230
103.82.241.2
104.236.247.64
109.234.161.21
119.29.37.47
122.54.20.213
122.188.208.110
125.46.41.36
128.199.93.4
157.230.182.1
162.223.90.202
162.253.224.14
185.2.5.24
186.64.119.85
192.99.5.123
194.15.36.68
194.61.24.177
198.71.226.60
199.79.62.146
206.189.136.117
207.246.240.124
207.246.249.195
207.246.249.204
210.209.89.74
211.149.132.127
222.186.15.18

32
bi_proftpd_1_7d.ipset Normal file
View File

@ -0,0 +1,32 @@
#
# bi_proftpd_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# proftpd with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/proftpd/1?age=7d
# Source File Date: Mon Aug 10 21:32:35 UTC 2020
#
# Category : attacks
# Version : 1405
#
# This File Date : Mon Aug 10 21:32:35 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 2 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_proftpd_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
45.117.82.166
83.149.21.32

32
bi_proftpd_2_30d.ipset Normal file
View File

@ -0,0 +1,32 @@
#
# bi_proftpd_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# proftpd with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/proftpd/2?age=30d
# Source File Date: Fri Jul 31 05:12:25 UTC 2020
#
# Category : attacks
# Version : 449
#
# This File Date : Fri Jul 31 05:12:25 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 2 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_proftpd_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
105.235.112.20
110.52.151.59

47
bi_pureftpd_0_1d.ipset Normal file
View File

@ -0,0 +1,47 @@
#
# bi_pureftpd_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# pureftpd with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/pureftpd/0?age=1d
# Source File Date: Fri Aug 14 10:20:11 UTC 2020
#
# Category : attacks
# Version : 22024
#
# This File Date : Fri Aug 14 10:20:12 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 17 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_pureftpd_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
14.185.131.239
45.55.90.44
45.125.66.22
49.80.235.208
58.54.206.172
59.59.128.38
61.187.149.5
113.4.187.36
113.106.83.154
113.110.231.13
115.221.66.169
116.0.1.138
119.126.157.13
121.231.11.181
125.110.198.95
139.59.33.100
211.36.213.128

32
bi_pureftpd_1_7d.ipset Normal file
View File

@ -0,0 +1,32 @@
#
# bi_pureftpd_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# pureftpd with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/pureftpd/1?age=7d
# Source File Date: Wed Aug 12 15:20:41 UTC 2020
#
# Category : attacks
# Version : 924
#
# This File Date : Wed Aug 12 15:20:41 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 2 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_pureftpd_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
45.117.82.166
113.160.224.28

33
bi_pureftpd_2_30d.ipset Normal file
View File

@ -0,0 +1,33 @@
#
# bi_pureftpd_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# pureftpd with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/pureftpd/2?age=30d
# Source File Date: Wed Aug 12 15:20:42 UTC 2020
#
# Category : attacks
# Version : 342
#
# This File Date : Wed Aug 12 15:20:42 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 3 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_pureftpd_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
110.52.151.59
113.160.224.28
119.44.217.242

37
bi_qmail-smtp_0_1d.ipset Normal file
View File

@ -0,0 +1,37 @@
#
# bi_qmail-smtp_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# qmail-smtp with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/qmail-smtp/0?age=1d
# Source File Date: Fri Aug 14 08:56:11 UTC 2020
#
# Category : attacks
# Version : 18194
#
# This File Date : Fri Aug 14 08:56:11 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 7 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_qmail-smtp_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
87.246.7.138
93.174.89.111
94.25.181.133
113.69.131.131
185.127.24.39
200.125.24.218
222.186.61.191

35
bi_rdp_0_1d.ipset Normal file
View File

@ -0,0 +1,35 @@
#
# bi_rdp_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# rdp with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/rdp/0?age=1d
# Source File Date: Fri Aug 14 09:12:41 UTC 2020
#
# Category : attacks
# Version : 5973
#
# This File Date : Fri Aug 14 09:12:41 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 5 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_rdp_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
18.219.117.227
51.68.222.54
88.218.16.118
150.95.88.107
192.35.168.89

150
bi_sasl_0_1d.ipset Normal file
View File

@ -0,0 +1,150 @@
#
# bi_sasl_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# sasl with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/sasl/0?age=1d
# Source File Date: Fri Aug 14 10:16:08 UTC 2020
#
# Category : attacks
# Version : 35222
#
# This File Date : Fri Aug 14 10:16:08 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 120 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_sasl_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.186.61.194
5.39.78.104
5.188.206.197
23.254.253.35
31.170.48.162
37.49.230.151
45.6.27.240
45.118.32.70
45.143.223.138
45.143.223.144
45.160.131.97
45.167.9.236
45.167.11.135
45.167.25.238
45.181.31.250
45.227.98.69
46.23.132.101
46.151.72.70
52.185.144.216
52.238.175.163
58.57.4.238
60.19.64.4
77.40.2.125
77.40.2.211
77.40.3.218
77.40.3.242
77.40.61.123
78.128.113.116
81.15.197.110
81.15.197.111
87.246.7.8
87.246.7.13
87.246.7.17
87.246.7.22
87.246.7.130
87.246.7.136
87.246.7.137
87.246.7.138
87.246.7.140
87.246.7.141
87.246.7.142
91.222.58.107
92.52.207.77
93.99.134.132
93.174.89.111
94.25.181.237
94.102.50.190
94.102.54.250
95.143.137.208
96.44.162.82
103.16.144.85
103.87.46.227
103.104.127.211
103.133.105.65
103.141.138.127
103.207.7.37
104.41.1.229
111.26.172.222
111.75.149.221
112.15.38.248
112.33.112.170
113.119.177.147
114.231.8.32
114.231.8.94
114.232.110.185
114.232.110.246
115.85.213.217
116.196.108.9
117.86.8.58
121.17.210.61
141.98.80.67
156.96.56.52
156.96.116.136
162.255.87.241
168.63.204.7
170.238.140.82
170.238.140.133
170.238.143.153
177.91.87.95
177.184.218.236
178.217.114.49
180.101.145.234
181.114.208.238
181.174.144.60
182.111.244.146
185.127.24.39
185.127.24.51
185.196.8.234
185.234.216.63
185.234.216.64
185.234.219.11
185.234.219.12
185.234.219.13
185.234.219.14
185.234.219.227
185.234.219.228
185.234.219.229
185.234.219.230
186.216.67.206
188.241.25.189
191.37.8.91
192.162.98.20
193.35.48.18
193.35.51.13
193.56.28.141
193.56.28.144
193.56.28.186
193.142.59.184
193.169.253.27
193.169.253.128
193.169.253.136
198.27.115.120
200.125.24.218
202.56.184.30
207.106.22.128
212.70.149.3
212.70.149.19
212.70.149.35
212.70.149.67
222.186.61.191

41
bi_sasl_1_7d.ipset Normal file
View File

@ -0,0 +1,41 @@
#
# bi_sasl_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# sasl with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/sasl/1?age=7d
# Source File Date: Fri Aug 14 08:56:11 UTC 2020
#
# Category : attacks
# Version : 2850
#
# This File Date : Fri Aug 14 08:56:11 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 11 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_sasl_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.190.189.173
37.49.224.162
60.169.115.103
60.169.115.221
91.144.93.182
103.199.157.130
103.207.37.60
131.100.81.219
185.234.217.41
192.162.98.20
200.152.107.173

182
bi_sasl_2_30d.ipset Normal file
View File

@ -0,0 +1,182 @@
#
# bi_sasl_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# sasl with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/sasl/2?age=30d
# Source File Date: Thu Aug 13 19:26:54 UTC 2020
#
# Category : attacks
# Version : 751
#
# This File Date : Thu Aug 13 19:26:54 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 152 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_sasl_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
14.160.29.246
14.161.42.137
14.161.43.154
14.161.45.78
31.173.68.134
37.49.224.11
37.49.224.134
37.49.224.157
37.49.224.162
37.49.224.173
37.49.224.176
37.49.224.186
37.49.224.237
37.49.226.169
41.89.22.119
42.243.154.6
58.16.114.105
58.20.185.12
58.210.134.186
58.214.0.42
58.214.25.190
58.214.239.53
58.216.218.236
59.28.185.59
59.44.47.106
59.50.85.74
59.57.150.170
60.13.181.244
60.167.112.213
60.174.92.50
60.216.116.178
61.131.3.225
61.132.88.132
61.134.44.28
61.160.25.118
61.161.209.134
61.185.139.72
62.133.141.171
74.123.21.22
77.40.3.96
80.14.77.216
85.234.37.114
91.245.28.37
93.64.183.162
95.110.194.245
95.165.164.170
103.76.188.2
103.89.88.69
103.99.2.7
103.207.37.40
103.207.37.60
103.237.56.49
109.166.128.6
109.175.20.226
111.26.198.30
112.24.104.228
112.26.118.226
112.113.241.207
112.171.173.12
113.8.194.3
113.161.88.235
114.29.239.208
114.141.189.194
115.84.92.33
115.84.92.71
115.84.92.76
115.84.99.60
115.84.99.188
115.84.112.138
115.231.241.82
115.238.31.114
116.55.19.46
116.112.66.186
116.228.9.58
117.4.101.26
117.40.139.82
118.122.94.151
119.18.159.146
120.196.144.242
120.197.62.9
122.139.5.237
122.252.230.130
123.24.205.196
123.25.30.87
123.138.199.66
131.100.36.77
147.91.226.29
180.211.170.198
182.72.66.154
182.72.136.226
182.72.186.230
182.73.113.38
182.73.201.10
182.74.112.150
182.74.247.178
182.75.52.110
182.140.133.153
183.62.15.170
183.62.20.2
183.64.166.163
185.234.217.41
186.179.100.90
189.204.6.157
189.211.189.44
190.7.180.218
190.202.44.194
190.210.182.93
191.102.120.181
195.252.98.130
196.28.236.73
201.140.110.78
201.251.127.123
202.107.34.250
202.137.154.39
202.137.154.51
202.137.154.154
202.137.155.161
202.137.155.190
203.88.155.220
212.111.199.148
213.138.74.85
213.147.118.56
217.217.179.17
218.22.11.106
218.22.100.42
218.23.26.50
218.25.31.150
218.26.163.125
218.28.58.186
218.56.102.14
218.90.162.234
218.93.11.82
218.93.11.178
218.93.21.50
218.93.220.102
218.201.14.134
219.143.72.21
219.156.107.98
220.164.2.62
220.178.107.242
220.179.61.160
220.189.235.126
220.225.7.55
220.248.200.226
221.203.169.50
221.209.11.14
221.226.50.162
221.230.1.113
222.74.5.235
222.189.41.46
222.218.17.189
223.255.230.62

43
bi_sip_0_1d.ipset Normal file
View File

@ -0,0 +1,43 @@
#
# bi_sip_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# sip with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/sip/0?age=1d
# Source File Date: Fri Aug 14 08:40:30 UTC 2020
#
# Category : attacks
# Version : 10721
#
# This File Date : Fri Aug 14 08:40:30 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 13 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_sip_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
45.143.223.104
51.89.153.80
81.83.7.136
84.195.192.178
94.110.83.251
103.145.13.41
103.145.13.108
105.160.41.94
105.160.46.97
105.160.82.135
178.117.229.190
185.147.212.8
195.130.156.202

Some files were not shown because too many files have changed in this diff Show More