Robot
/
blocklist-ipsets
mirror of https://github.com/firehol/blocklist-ipsets.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

restarted

This commit is contained in:
Costa Tsaousis 2016-11-20 06:30:07 +00:00
commit 59ec3e0969
1109 changed files with 7224421 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

98
.gitignore vendored Normal file
View File

@ -0,0 +1,98 @@
bogons.netset
.cache
.cache.old
dragon_http.netset
dragon_*.ipset
dragon_*.netset
dragon_sshpauth.netset
dragon_vncprobe.netset
dronebl_anonymizers.netset
dronebl_auto_botnets.netset
dronebl_autorooting_worms.netset
dronebl_compromised.netset
dronebl_ddos_drones.netset
dronebl_dns_mx_on_irc.netset
dronebl_*.ipset
dronebl_irc_drones.netset
dronebl_*.netset
dronebl_unknown.netset
dronebl_worms_bots.netset
errors/
fullbogons.netset
history/
ib_*.ipset
iblocklist_ads.netset
iblocklist_ads.*set
iblocklist_badpeers.ipset
iblocklist_badpeers.*set
iblocklist_bogons.netset
iblocklist_bogons.*set
iblocklist_dshield.netset
iblocklist_dshield.*set
iblocklist_edu.netset
iblocklist_edu.*set
iblocklist_exclusions.netset
iblocklist_exclusions.*set
iblocklist_fornonlancomputers.netset
iblocklist_fornonlancomputers.*set
iblocklist_forumspam.netset
iblocklist_forumspam.*set
iblocklist_hijacked.netset
iblocklist_hijacked.*set
iblocklist_iana_multicast.netset
iblocklist_iana_multicast.*set
iblocklist_iana_private.netset
iblocklist_iana_private.*set
iblocklist_iana_reserved.netset
iblocklist_iana_reserved.*set
iblocklist_level1.netset
iblocklist_level1.*set
iblocklist_level2.netset
iblocklist_level2.*set
iblocklist_level3.netset
iblocklist_level3.*set
iblocklist_org_microsoft.netset
iblocklist_org_microsoft.*set
iblocklist_proxies.ipset
iblocklist_proxies.*set
iblocklist_rangetest.netset
iblocklist_rangetest.*set
iblocklist_spider.netset
iblocklist_spider.*set
iblocklist_spyware.netset
iblocklist_spyware.*set
iblocklist_webexploit.ipset
iblocklist_webexploit.*set
ib_*.netset
iprange*
ipv4_range_to_cidr.awk
*.lastchecked
*.setinfo
sorbs_anonymizers.netset
sorbs_dul.netset
sorbs_escalations.netset
sorbs_*.ipset
sorbs_*.netset
sorbs_new_spam.netset
sorbs_noserver.netset
sorbs_recent_spam.netset
sorbs_smtp.netset
sorbs_web.netset
sorbs_zombie.netset
*.source
*.tmp
update-ipsets*
.warn_if_last_downloaded_before_this
blueliv*.ipset
blueliv*.netset
blueliv_crimeserver_online.ipset
blueliv_crimeserver_recent.ipset
blueliv_crimeserver_last.ipset
blueliv_crimeserver_last_1d.ipset
blueliv_crimeserver_last_2d.ipset
blueliv_crimeserver_last_7d.ipset
blueliv_crimeserver_last_30d.ipset
iblocklist_badpeers.netset
dataplane_sipquery.ipset
dataplane_sshpwauth.ipset
dataplane_sshclient.ipset

221
README-EDIT.md Normal file
View File

@ -0,0 +1,221 @@
### Contents
- [About this repo](#about-this-repo)
- [Using these ipsets](#using-these-ipsets)
- [Which ones to use?](#which-ones-to-use)
- [Why are open proxy lists included](#why-are-open-proxy-lists-included)
- [Using them in FireHOL](#using-them-in-firehol)
* [Adding the ipsets in your firehol.conf](#adding-the-ipsets-in-your-fireholconf)
* [Updating the ipsets while the firewall is running](#updating-the-ipsets-while-the-firewall-is-running)
- [Dynamic List of ipsets included](#list-of-ipsets-included)
- [Comparison of ipsets](#comparison-of-ipsets)
---
# About this repo
This repository includes a list of ipsets dynamically updated with
[FireHOL](https://github.com/firehol/firehol)'s `update-ipsets.sh`
[documented in this wiki](https://github.com/firehol/blocklist-ipsets/wiki).
This repo is self maintained. It it updated automatically from the script via a cron job.
This repo has a site: [http://iplists.firehol.org](http://iplists.firehol.org).
## Why do we need blocklists?
As time passes and the internet matures in our life, cyber crime is becoming increasingly sophisticated.
Although there are many tools (detection of malware, viruses, intrusion detection and prevension systems,
etc) to help us isolate the budguys, there are now a lot more than just such attacks.
What is more interesting is that the fraudsters or attackers in many cases are not going to do a direct
damage to you or your systems. They will use you and your systems to gain something else, possibly not
related or indirectly related to your business. Nowdays the attacks cannot be identified easily. They are
distributed and come to our systems from a vast amount of IPs around the world.
To get an idea, check for example the [XRumer](http://en.wikipedia.org/wiki/XRumer) software. This thing
mimics human behaviour to post ads, it creates email accounts, responds to emails it receives, bypasses
captchas, it goes gently to stay unoticed, etc.
To increase our effectiveness we need to complement our security solutions with our shared knowledge, our
shared experience in this fight.
Hopefully, there are many teams out there that do their best to identify the attacks and pinpoint the
attackers. These teams release blocklists. Blocklists of IPs (for use in firewalls), domains & URLs
(for use in proxies), etc.
What we are interested here is IPs.
Using IP blocklists at the internet side of your firewall is a key component of internet security. These
lists share key knowledge between us, allowing us to learn from each other and effectively isolate
fraudsters and attackers from our services.
I decided to upload these lists to a github repo because:
1. They are freely available on the internet. The intention of their creators is to help internet security.
Keep in mind though that a few of these lists may have special licences attached. Before using them, please check their source site for any information regarding proper use.
2. Github provides (via `git pull`) a unified way of updating all the lists together.
Pulling this repo regularly on your machines, you will update all the IP lists at once.
3. Github also provides a unified version control. Using it we can have a history of what each list has
done, which IPs or subnets were added and which were removed.
## DNSBLs
Check also another tool included in FireHOL v3+, called `dnsbl-ipset.sh`.
This tool is capable of creating an ipset based on your traffic by looking up information on DNSBLs and
scoring it according to your preferences.
More information [here](https://github.com/firehol/firehol/wiki/dnsbl-ipset.sh).
---
# Using these ipsets
Please be very careful what you choose to use and how you use it. If you blacklist traffic using these
lists you may end up blocking your users, your customers, even yourself (!) from accessing your services.
1. Go to to the site of each list and read how each list is maintained. You are going to trust these guys for doing their job right.
2. Most sites have either a donation system or commercial lists of higher quality. Try to support them.
3. I have included the TOR network in these lists (`bm_tor`, `dm_tor`, `et_tor`). The TOR network is not necessarily bad and you should not block it if you want to allow your users be anonymous. I have included it because for certain cases, allowing an anonymity network might be a risky thing (such as eCommerce).
4. Apply any blacklist at the internet side of your firewall. Be very carefull. The `bogons` and `fullbogons` lists contain private, unroutable IPs that should not be routed on the internet. If you apply such a blocklist on your DMZ or LAN side, you will be blocked out of your firewall.
5. Always have a whitelist too, containing the IP addresses or subnets you trust. Try to build the rules in such a way that if an IP is in the whitelist, it should not be blocked by these blocklists.
## Which ones to use
### Level 1 - Basic
These are the ones I trust. **Level 1** provides basic security against the most well known attackers, with the minimum of false positives.
1. **Abuse.ch** lists `feodo`, `palevo`, `sslbl`, `zeus`, `zeus_badips`
These folks are doing a great job tracking crimeware. Their blocklists are very focused.
Keep in mind `zeus` may include some false positives. You can use `zeus_badips` instead.
2. **DShield.org** list `dshield`
It contains the top 20 attacking class C (/24) subnets, over the last three days.
3. **Spamhaus.org** lists `spamhaus_drop`, `spamhaus_edrop`
DROP (Don't Route Or Peer) and EDROP are advisory "drop all traffic" lists, consisting of netblocks that are "hijacked" or leased by professional spam or cyber-crime operations (used for dissemination of malware, trojan downloaders, botnet controllers).
According to Spamhaus.org:
> When implemented at a network or ISP's 'core routers', DROP and EDROP will help protect the network's users from spamming, scanning, harvesting, DNS-hijacking and DDoS attacks originating on rogue netblocks.
>
> Spamhaus strongly encourages the use of DROP and EDROP by tier-1s and backbones.
Spamhaus is very responsive to adapt these lists when a network owner updates them that the issue has been solved (I had one such incident with one of my users).
4. **Team-Cymru.org** list `bogons` or `fullbogons`
These are lists of IPs that should not be routed on the internet. No one should be using them.
Be very careful to apply either of the two on the internet side of your network.
### Level 2 - Essentials
**Level 2** provide protection against current brute force attacks. This level may have a small percentage of false positives, mainly due to dynamic IPs being re-used by other users.
1. **OpenBL.org** lists `openbl*`
The team of OpenBL tracks brute force attacks on their hosts. They have a very short list for hosts, under their own control, collecting this information, to eliminate false positives.
They suggest to use the default blacklist which has a retention policy of 90 days (`openbl`), but they also provide lists with different retention policies (from 1 day to 1 year).
Their goal is to report abuse to the responsible provider so that the infection is disabled.
2. **Blocklist.de** lists `blocklist_de*`
Is a network of users reporting abuse mainly using `fail2ban`. They eliminate false positives using other lists available. Since they collect information from their users, their lists may be subject to poisoning, or false positives.
I asked them about poisoning. [Here](https://forum.blocklist.de/viewtopic.php?f=4&t=244&sid=847d00d26b0735add3518ff515242cad) you can find their answer. In short, they track it down so that they have an ignorable rate of false positives.
Also, they only include individual IPs (no subnets) which have attacked their users the last 48 hours and their list contains 20.000 to 40.000 IPs (which is small enough considering the size of the internet).
Like `openbl`, their goal is to report abuse back, so that the infection is disabled.
They also provide their blocklist per type of attack (mail, web, etc).
Of course there are more lists included. You can check them and decide if they fit for your needs.
## Why are open proxy lists included
Of course, I haven't included them for you to use the open proxies. The port the proxy is listening, or the type of proxy, are not included (although most of them use the standard proxy ports and do serve web requests).
If you check the comparisons for the open proxy lists (`ri_connect_proxies`, `ri_web_proxies`, `xroxy`, `proxz`, `proxyrss`, etc)
you will find that they overlap to a great degree with other blocklists, like `blocklist_de`, `stopforumspam`, etc.
> This means the attackers also use open proxies to execute attacks.
So, if you are under attack, blocking the open proxies may help isolate a large part of the attack.
I don't suggest to permanenly block IPs using the proxy lists. Their purpose of existance is questionable.
Their quality though may be acceptable, since lot of these sites advertise that they test open proxies before including them in their lists, so that there are no false positives, at least at the time they tested them.
---
## Using them in FireHOL
`update-ipsets.sh` itself does not alter your firewall. It can be used to update ipsets both on disk and in the kernel for any firewall solution you use.
The information below, shows you how to configure FireHOL to use the provides ipsets.
### Adding the ipsets in your firehol.conf
I use something like this:
```sh
# our wan interface
wan="dsl0"
# our whitelist
ipset4 create whitelist hash:net
ipset4 add whitelist A.B.C.D/E # A.B.C.D/E is whitelisted
# subnets - netsets
for x in fullbogons dshield spamhaus_drop spamhaus_edrop
do
ipset4 create ${x} hash:net
ipset4 addfile ${x} ipsets/${x}.netset
blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} \
except src ipset:whitelist
done
# individual IPs - ipsets
for x in feodo palevo sslbl zeus openbl blocklist_de
do
ipset4 create ${x} hash:ip
ipset4 addfile ${x} ipsets/${x}.ipset
blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} \
except src ipset:whitelist
done
... rest of firehol.conf ...
```
If you are concerned about iptables performance, change the `blacklist4` keyword `full` to `input`.
This will block only inbound NEW connections, i.e. only the first packet for every NEW inbound connection will be checked.
All other traffic passes through unchecked.
> Before adding these rules to your `firehol.conf` you should run `update-ipsets.sh` to enable them.
### Updating the ipsets while the firewall is running
Just use the `update-ipsets.sh` script from the firehol distribution.
This script will update each ipset and call firehol to update the ipset while the firewall is running.
> You can add `update-ipsets.sh` to cron, to run every 10 mins. `update-ipsets.sh` is smart enough to download
> a list only when it needs to.
---
# List of ipsets included

1364
README.md Normal file
View File

File diff suppressed because it is too large Load Diff

48352
alienvault_reputation.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

966
asprox_c2.ipset Normal file
View File

@ -0,0 +1,966 @@
#
# asprox_c2
#
# ipv4 hash:ip ipset
#
# [h3x.eu] (http://atrack.h3x.eu/) ASPROX Tracker - Asprox
# C&C Sites
#
# Maintainer : h3x.eu
# Maintainer URL : http://atrack.h3x.eu/
# List source URL : http://atrack.h3x.eu/c2
# Source File Date: Mon May 2 10:44:11 UTC 2016
#
# Category : malware
# Version : 2
#
# This File Date : Mon May 2 10:44:11 UTC 2016
# Update Frequency: 1 day
# Aggregation : none
# Entries : 936 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=asprox_c2
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.226.84.206
1.234.20.244
1.234.53.27
5.39.86.97
5.56.58.118
5.56.60.47
5.79.6.6
5.79.6.80
5.134.115.164
5.135.90.4
5.135.115.193
5.135.115.194
5.135.115.195
5.135.115.196
5.135.115.197
5.135.115.198
5.135.115.199
5.135.115.200
5.135.115.201
5.135.115.202
5.135.115.203
5.135.115.204
5.135.115.205
5.135.115.206
5.135.115.207
5.135.115.208
5.135.115.209
5.135.115.210
5.135.115.211
5.135.115.212
5.135.115.213
5.135.115.214
5.135.115.215
5.135.115.216
5.135.115.217
5.135.115.218
5.135.115.219
5.135.115.220
5.135.115.221
5.135.115.222
5.135.146.109
5.135.187.194
5.135.213.204
5.154.82.3
5.157.82.99
5.175.147.7
5.175.166.35
5.231.54.233
5.249.139.132
16.156.201.237
23.21.190.217
23.226.235.180
23.227.182.207
23.236.147.36
23.239.140.106
23.254.101.138
27.50.86.125
27.50.89.81
27.54.84.62
27.54.87.235
27.116.56.207
27.254.55.4
31.3.98.146
31.22.116.171
31.31.88.42
31.47.250.41
31.131.16.104
31.186.5.20
31.192.212.241
31.204.154.53
31.210.41.123
31.222.177.193
32.213.0.122
37.26.108.41
37.35.107.208
37.46.85.135
37.59.9.98
37.59.24.98
37.59.60.132
37.59.75.48
37.59.82.8
37.59.82.218
37.59.82.219
37.59.117.238
37.59.212.214
37.122.208.23
37.122.208.38
37.123.99.131
37.130.229.52
37.139.47.190
37.143.12.119
37.187.0.111
37.187.37.199
37.188.121.66
37.188.121.252
41.86.112.12
46.4.105.170
46.4.178.174
46.22.145.196
46.22.145.198
46.29.255.29
46.32.228.66
46.32.231.30
46.32.254.163
46.45.165.99
46.55.222.24
46.55.222.67
46.102.235.139
46.105.98.86
46.105.117.13
46.105.143.106
46.105.143.107
46.163.74.150
46.163.77.229
46.165.192.139
46.234.101.195
46.254.18.97
49.50.241.103
49.50.242.5
49.212.55.50
50.7.243.114
50.28.89.200
50.56.29.53
50.56.58.140
50.56.71.248
50.56.80.31
50.56.80.201
50.56.112.118
50.56.124.35
50.56.212.45
50.56.238.195
50.57.47.151
50.57.69.14
50.57.88.97
50.57.99.160
50.57.127.143
50.57.135.154
50.57.135.183
50.57.139.41
50.57.149.12
50.57.223.115
50.63.141.243
50.97.128.227
50.115.169.26
50.116.94.10
58.83.159.94
59.25.189.234
59.106.185.111
59.126.131.132
61.19.32.24
61.19.125.107
61.19.244.251
61.19.253.26
62.75.139.253
62.75.143.211
62.75.148.201
62.75.188.224
62.75.251.124
62.76.40.57
62.76.43.133
62.109.29.157
62.112.157.126
62.113.200.95
62.193.192.101
64.49.226.241
64.64.26.104
64.71.173.71
64.76.19.228
64.76.19.241
64.76.19.249
64.79.219.67
64.91.226.48
64.128.16.144
64.131.78.225
64.207.158.128
65.55.67.187
65.55.67.189
65.181.127.125
66.29.254.132
66.45.253.250
66.55.88.5
66.55.88.150
66.84.10.68
66.175.218.117
66.232.145.174
66.255.131.164
67.18.12.2
67.43.5.78
67.207.132.127
67.231.22.199
68.169.55.248
68.233.32.99
68.233.32.145
68.233.32.146
68.233.32.166
68.233.36.146
69.60.8.88
69.64.32.247
69.64.36.244
69.64.56.232
69.64.62.149
69.93.231.252
69.162.112.178
69.164.192.43
69.167.168.68
69.167.180.144
70.32.74.182
70.32.75.58
70.32.79.44
70.32.100.120
70.38.37.173
70.60.248.25
70.84.51.138
70.86.109.98
70.86.152.10
70.159.17.146
71.244.57.54
72.4.147.202
72.5.55.208
72.10.32.156
72.52.223.86
72.55.174.23
72.167.15.89
72.232.213.122
72.249.82.45
74.50.60.116
74.52.54.242
74.125.229.162
74.208.65.138
74.208.111.15
74.208.199.59
74.208.246.250
74.221.221.58
75.99.13.124
75.125.144.114
75.126.166.132
76.12.181.253
76.72.164.18
76.74.137.168
76.74.184.127
77.72.26.97
77.72.150.225
77.79.81.166
77.79.92.75
77.81.225.253
77.92.70.240
77.92.140.241
77.111.207.70
77.222.43.39
77.223.131.225
77.237.121.19
77.241.199.212
78.24.223.130
78.46.92.70
78.46.105.166
78.46.148.55
78.47.33.171
78.47.72.120
78.47.145.72
78.47.196.189
78.47.205.35
78.47.210.186
78.47.226.217
78.83.178.3
78.110.162.72
78.110.162.73
78.110.162.79
78.129.146.53
78.142.63.165
78.157.209.228
79.124.76.137
79.124.76.204
79.137.209.63
79.143.186.59
80.67.6.226
80.70.1.231
80.78.247.211
80.90.198.43
80.93.28.65
80.156.57.130
80.190.241.9
80.190.246.151
80.190.246.201
80.190.246.224
80.190.254.42
80.198.53.97
80.247.72.132
81.2.199.97
81.23.38.6
81.25.112.101
81.29.201.241
81.31.148.190
81.88.24.173
81.93.248.152
81.168.26.245
81.169.188.145
81.177.22.90
81.177.22.146
81.177.180.83
81.177.180.95
81.177.180.148
81.177.180.172
81.177.180.234
81.177.181.223
82.100.48.5
82.100.49.220
82.113.204.228
82.116.211.16
82.145.55.111
82.150.199.140
82.165.25.40
82.165.152.226
82.165.155.77
82.192.91.220
82.192.91.224
82.222.170.172
83.133.121.149
83.141.7.102
83.169.38.202
83.169.42.123
83.172.160.26
83.192.168.26
83.247.6.182
84.19.176.36
84.40.22.46
84.41.105.41
84.124.94.52
84.200.22.200
84.234.71.214
85.12.29.172
85.12.29.251
85.12.29.254
85.17.179.75
85.25.108.164
85.25.120.45
85.159.145.159
85.197.78.70
85.214.22.38
85.214.50.161
85.214.114.16
85.214.117.73
85.214.133.237
85.214.220.78
85.214.223.42
86.120.147.14
87.98.225.254
87.106.4.78
87.106.11.43
87.106.26.231
87.106.27.26
87.106.29.92
87.106.38.124
87.106.51.52
87.106.55.37
87.106.89.231
87.106.101.55
87.106.104.118
87.106.200.140
87.106.207.37
87.106.255.78
87.117.242.2
87.117.242.95
87.118.112.195
87.230.103.44
87.239.158.90
87.239.158.91
88.40.201.187
88.84.162.12
88.190.11.128
88.190.22.72
88.190.226.223
88.191.89.92
88.191.123.128
88.191.126.227
88.191.129.233
88.191.130.98
88.191.134.201
88.191.139.235
88.198.1.241
88.198.25.17
88.198.226.205
88.255.149.11
89.19.20.202
89.22.96.113
89.32.145.12
89.96.55.95
89.144.14.41
89.144.57.110
89.187.85.27
89.232.63.147
91.82.84.121
91.109.2.132
91.109.6.208
91.109.6.209
91.109.6.217
91.109.216.158
91.121.1.189
91.121.5.39
91.121.10.218
91.121.13.78
91.121.16.24
91.121.20.71
91.121.28.146
91.121.64.132
91.121.70.14
91.121.98.60
91.121.99.207
91.121.106.53
91.121.140.40
91.121.156.162
91.121.177.88
91.121.193.188
91.121.197.165
91.121.204.148
91.121.208.114
91.121.210.180
91.121.238.36
91.142.223.136
91.146.97.88
91.184.13.83
91.185.199.40
91.185.204.47
91.189.125.250
91.191.170.26
91.192.226.24
91.196.126.16
91.208.144.157
91.208.144.158
91.212.52.46
91.212.253.253
91.216.163.221
91.220.215.29
91.227.4.27
91.227.26.178
91.228.77.15
91.240.23.92
92.60.192.113
92.60.192.114
92.240.232.232
92.240.237.66
93.84.115.158
93.125.30.232
93.184.100.116
93.186.181.62
93.187.200.250
93.189.94.42
93.189.94.143
93.189.95.148
94.23.24.58
94.23.33.107
94.23.36.129
94.23.38.214
94.23.42.161
94.23.43.184
94.23.47.22
94.23.55.98
94.23.84.94
94.23.86.185
94.23.96.181
94.23.193.229
94.23.199.186
94.23.207.147
94.23.211.135
94.23.236.101
94.23.254.81
94.23.254.90
94.32.66.56
94.32.66.200
94.32.67.214
94.66.111.83
94.124.57.112
94.199.242.85
94.242.219.122
94.245.87.192
94.247.168.26
94.247.177.16
95.64.36.236
95.110.147.192
95.110.162.147
95.110.166.71
95.131.66.34
95.131.70.168
95.140.42.27
95.140.203.241
95.141.29.195
95.141.29.205
95.141.32.134
95.143.113.213
95.173.185.185
95.173.186.184
95.211.131.194
96.30.16.244
96.30.22.96
96.30.44.184
96.126.125.126
101.255.36.171
103.1.173.144
103.4.18.215
103.4.19.111
103.4.218.22
103.14.200.32
103.14.200.33
103.27.108.199
103.29.216.130
103.31.232.99
103.245.153.143
104.131.253.209
106.187.98.143
107.161.161.168
107.170.127.51
107.170.221.187
107.182.17.8
108.59.249.33
108.163.206.23
108.178.32.3
108.179.236.49
109.68.191.186
109.74.2.146
109.75.184.192
109.95.210.196
109.104.104.102
109.123.80.212
109.123.107.32
109.169.46.59
109.169.87.141
109.234.156.83
109.234.156.84
109.235.252.2
110.12.41.19
110.77.220.66
110.164.58.158
110.164.59.5
110.170.30.195
111.67.14.19
111.118.183.98
111.223.244.12
112.124.126.139
113.53.247.147
114.202.247.182
115.29.6.237
115.115.172.166
115.115.192.168
115.124.94.120
118.97.15.13
118.127.52.221
119.59.99.34
119.59.124.76
119.235.249.138
121.52.220.28
121.83.238.155
121.241.248.9
122.155.18.53
122.155.219.30
123.30.90.109
123.30.110.113
124.109.2.78
128.114.63.45
129.121.182.100
130.60.202.71
130.113.246.188
130.185.109.207
133.242.54.221
133.242.134.76
134.0.30.42
137.250.32.61
140.135.66.217
141.105.121.139
141.105.126.48
141.136.8.4
141.138.196.46
141.138.196.47
141.138.197.101
142.4.25.235
142.4.28.23
142.4.60.242
144.76.194.170
146.255.34.143
146.255.65.66
147.102.154.192
149.62.168.76
149.154.154.249
149.210.130.18
150.214.21.198
151.3.8.106
158.255.238.9
158.255.238.87
159.253.5.102
159.253.6.40
159.253.42.186
162.13.189.52
162.144.42.104
162.144.60.252
162.144.84.238
162.144.112.131
162.144.113.135
162.144.116.92
162.209.14.32
162.216.112.217
162.218.236.73
162.220.241.79
162.221.200.150
162.242.209.236
162.252.168.94
162.255.86.196
163.10.12.83
164.177.152.110
164.177.156.227
166.63.127.243
166.78.6.8
166.78.7.193
166.78.28.188
166.78.205.55
168.144.82.94
168.144.82.97
168.144.155.99
168.188.15.221
172.245.44.180
172.245.213.112
173.45.78.226
173.45.226.51
173.165.99.74
173.192.72.226
173.199.167.52
173.199.182.152
173.203.70.234
173.203.97.13
173.203.108.86
173.203.113.44
173.203.113.94
173.208.131.227
173.224.124.232
173.230.130.14
173.230.131.168
173.255.197.31
173.255.203.58
173.255.203.178
174.37.247.111
174.120.225.57
174.122.27.239
174.122.234.98
174.142.32.14
174.143.208.142
175.45.142.15
175.45.164.209
175.126.74.116
176.9.126.244
176.9.164.202
176.9.165.217
176.9.224.134
176.28.52.119
176.31.99.160
176.31.105.44
176.31.106.226
176.31.110.165
176.31.114.64
176.31.181.76
176.31.207.38
176.31.207.39
176.31.207.40
176.31.207.41
176.31.241.99
176.31.247.176
176.31.250.73
176.62.199.214
176.122.224.62
176.123.0.160
176.227.204.58
177.70.22.8
177.87.64.25
178.32.77.229
178.32.136.84
178.32.136.245
178.32.140.20
178.32.219.150
178.33.8.162
178.33.160.87
178.33.162.8
178.33.197.36
178.33.197.37
178.33.227.11
178.63.64.41
178.63.193.60
178.63.249.45
178.77.78.127
178.77.98.154
178.77.103.54
178.79.128.36
178.79.144.118
178.79.161.146
178.79.164.197
178.79.174.43
178.79.186.35
178.132.218.180
178.168.71.172
178.170.82.27
178.208.35.190
178.210.162.42
178.210.167.213
178.217.184.170
178.217.187.170
178.251.24.56
178.254.24.182
178.254.30.240
180.235.132.29
180.235.132.168
180.235.132.189
180.235.133.70
180.235.134.199
180.235.134.228
180.235.134.239
181.112.55.130
182.18.128.254
183.81.160.169
184.106.158.190
184.106.191.157
184.106.214.159
184.107.55.22
184.107.169.178
184.107.176.162
184.107.222.130
184.107.232.154
184.164.137.66
184.168.105.51
185.53.129.30
185.66.12.165
185.66.12.185
186.112.214.158
186.115.122.67
187.16.250.212
187.16.250.214
187.45.224.48
187.95.34.3
187.95.41.194
188.40.130.18
188.40.181.39
188.65.178.27
188.93.74.192
188.116.23.96
188.120.196.131
188.122.72.110
188.122.72.112
188.126.72.179
188.132.134.84
188.132.179.124
188.132.193.50
188.138.95.133
188.165.106.64
188.165.192.116
188.165.236.197
188.165.241.34
188.212.156.180
188.227.165.115
188.240.47.45
188.241.240.96
190.10.14.197
190.111.176.13
190.114.253.222
190.124.250.29
192.30.33.210
192.69.192.178
192.155.94.138
192.162.69.161
192.163.219.183
192.163.228.233
192.184.94.72
192.210.142.87
192.210.195.14
192.211.57.102
192.232.238.77
192.232.255.11
192.241.135.69
192.241.255.12
192.254.138.62
192.254.197.210
192.254.219.41
193.23.226.15
193.46.84.84
193.164.132.136
193.200.112.154
193.200.241.143
193.232.170.130
193.247.238.26
194.23.116.213
194.30.168.125
194.85.183.2
194.90.168.147
194.110.192.173
194.146.226.81
194.146.226.230
195.5.208.87
195.22.6.199
195.28.181.184
195.65.173.133
195.96.246.93
195.154.71.156
195.154.225.137
195.206.7.69
196.211.170.187
196.214.85.82
198.0.216.35
198.1.107.193
198.8.62.166
198.20.238.8
198.24.142.66
198.27.65.34
198.57.165.46
198.57.205.18
198.57.214.23
198.57.221.254
198.58.113.181
198.74.56.121
198.102.30.230
198.104.157.34
198.154.218.166
198.154.254.196
198.199.101.13
198.199.119.209
198.204.229.2
198.204.229.10
198.204.229.66
198.204.229.98
198.204.229.114
198.204.229.162
198.204.229.218
198.245.61.41
198.245.61.227
198.245.63.31
199.30.94.169
199.48.136.17
199.59.57.142
199.66.224.130
199.167.40.91
199.223.208.28
199.233.237.154
200.26.189.137
200.57.71.98
200.58.99.8
200.61.137.187
200.98.130.145
201.150.36.76
202.29.41.122
202.29.42.136
202.29.64.35
202.29.229.232
202.29.238.60
202.30.235.24
202.46.7.44
202.52.136.27
202.75.53.48
202.134.2.174
202.143.151.228
202.143.162.51
202.144.134.232
202.153.132.24
202.169.224.202
202.185.27.50
203.130.129.58
203.146.208.180
203.146.251.226
203.157.142.2
203.189.97.170
203.211.129.248
204.45.133.98
205.134.239.167
205.186.140.85
205.186.156.218
205.186.160.101
205.251.132.233
206.183.111.208
207.58.171.104
207.210.106.58
208.69.58.68
208.71.169.76
208.79.236.16
208.81.237.99
208.84.146.172
208.86.152.168
208.88.5.229
208.88.7.108
208.97.148.31
208.109.90.236
209.20.78.241
209.59.192.36
209.87.230.85
209.126.66.92
209.170.120.163
209.188.92.45
209.217.241.233
209.217.242.42
209.217.246.160
209.234.253.124
209.236.122.50
210.56.29.156
210.168.109.78
210.172.212.5
210.211.122.237
211.242.129.21
212.38.37.14
212.45.17.15
212.59.116.114
212.71.251.27
212.112.245.183
212.112.247.50
212.129.21.210
212.227.84.86
212.227.162.65
213.21.158.141
213.182.66.231
213.229.106.32
213.251.150.3
213.252.245.241
216.12.195.89
216.18.22.214
216.70.85.231
216.121.25.10
216.154.223.158
216.156.201.237
216.245.211.170
216.250.125.30
217.8.253.250
217.11.63.194
217.13.86.148
217.106.238.145
217.106.239.250
217.115.50.228
217.160.19.242
217.160.92.114
218.69.93.23
218.244.137.152
220.67.211.23
220.231.16.253
222.124.143.12
222.124.166.12
222.236.47.53
223.27.20.201
244.130.145.85

50
atlas_attacks.ipset Normal file
View File

@ -0,0 +1,50 @@
#
# atlas_attacks
#
# ipv4 hash:ip ipset
#
# [ATLAS Attacks] (https://atlas.arbor.net/summary/attacks) -
# ATLAS uses lightweight honeypot sensors to detect and
# fingerprint the attacks launched by malicious sources on
# the Internet. In most cases the attacker is trying to take
# control of the target via a published exploit for a known
# vulnerability. A variety of exploit tools exist and are
# usually written specifically for each attack vector.
# Exploit attempts and attacks are most often launched from
# bots (hosts under an attacker's control), which will
# automatically try to exploit any possible host on the
# Internet. Attack origins are usually not spoofed, although
# the source host may be compromised or infected with malware.
#
# Maintainer : Arbor Networks
# Maintainer URL : https://atlas.arbor.net/
# List source URL : https://atlas.arbor.net/summary/attacks.csv
# Source File Date: Sat Nov 19 08:06:14 UTC 2016
#
# Category : attacks
# Version : 169
#
# This File Date : Sun Nov 20 01:36:03 UTC 2016
# Update Frequency: 1 day
# Aggregation : none
# Entries : 10 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=atlas_attacks
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
24.172.251.54
40.74.124.185
66.135.104.194
71.248.167.22
77.59.214.138
78.129.171.154
79.129.35.192
166.78.18.210
189.170.187.49
204.42.253.2

55
atlas_attacks_2d.ipset Normal file
View File

@ -0,0 +1,55 @@
#
# atlas_attacks_2d
#
# ipv4 hash:ip ipset
#
# [ATLAS Attacks] (https://atlas.arbor.net/summary/attacks) -
# ATLAS uses lightweight honeypot sensors to detect and
# fingerprint the attacks launched by malicious sources on
# the Internet. In most cases the attacker is trying to take
# control of the target via a published exploit for a known
# vulnerability. A variety of exploit tools exist and are
# usually written specifically for each attack vector.
# Exploit attempts and attacks are most often launched from
# bots (hosts under an attacker's control), which will
# automatically try to exploit any possible host on the
# Internet. Attack origins are usually not spoofed, although
# the source host may be compromised or infected with malware.
#
# Maintainer : Arbor Networks
# Maintainer URL : https://atlas.arbor.net/
# List source URL : https://atlas.arbor.net/summary/attacks.csv
# Source File Date: Sat Nov 19 08:06:14 UTC 2016
#
# Category : attacks
# Version : 169
#
# This File Date : Sun Nov 20 01:36:03 UTC 2016
# Update Frequency: 1 day
# Aggregation : 2 days
# Entries : 15 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=atlas_attacks_2d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
24.172.251.54
40.74.124.185
60.10.253.62
66.135.104.194
71.248.167.22
77.59.214.138
77.69.2.70
78.129.171.154
79.129.35.192
106.184.2.29
166.78.18.210
169.229.3.91
185.94.111.1
189.170.187.49
204.42.253.2

125
atlas_attacks_30d.ipset Normal file
View File

@ -0,0 +1,125 @@
#
# atlas_attacks_30d
#
# ipv4 hash:ip ipset
#
# [ATLAS Attacks] (https://atlas.arbor.net/summary/attacks) -
# ATLAS uses lightweight honeypot sensors to detect and
# fingerprint the attacks launched by malicious sources on
# the Internet. In most cases the attacker is trying to take
# control of the target via a published exploit for a known
# vulnerability. A variety of exploit tools exist and are
# usually written specifically for each attack vector.
# Exploit attempts and attacks are most often launched from
# bots (hosts under an attacker's control), which will
# automatically try to exploit any possible host on the
# Internet. Attack origins are usually not spoofed, although
# the source host may be compromised or infected with malware.
#
# Maintainer : Arbor Networks
# Maintainer URL : https://atlas.arbor.net/
# List source URL : https://atlas.arbor.net/summary/attacks.csv
# Source File Date: Sat Nov 19 08:06:14 UTC 2016
#
# Category : attacks
# Version : 166
#
# This File Date : Sun Nov 20 01:36:03 UTC 2016
# Update Frequency: 1 day
# Aggregation : 30 days
# Entries : 85 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=atlas_attacks_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
23.234.51.33
24.172.251.54
31.135.162.138
37.182.204.230
40.74.124.185
40.127.105.239
42.112.27.127
45.76.134.144
45.76.212.194
45.115.39.125
50.57.49.179
50.57.101.191
58.69.23.130
60.6.38.2
60.10.253.62
66.135.104.194
66.254.170.2
69.15.146.94
69.55.17.108
71.248.167.22
77.59.214.138
77.69.2.70
78.129.171.134
78.129.171.154
79.129.35.192
81.102.248.127
82.165.166.123
85.159.233.111
91.187.98.242
91.211.0.6
91.230.121.149
92.63.82.206
93.99.7.123
93.174.93.25
93.174.93.144
93.174.93.205
94.112.255.151
94.177.164.99
98.109.214.2
103.231.138.245
106.184.2.29
109.228.47.236
109.228.50.126
118.233.4.230
119.201.56.221
128.232.110.29
134.19.176.138
134.147.203.115
137.226.113.7
138.68.148.168
139.162.13.205
139.162.32.13
149.255.36.168
154.16.199.43
158.69.48.123
166.78.18.210
169.229.3.91
175.207.12.74
185.36.81.253
185.71.218.244
185.94.111.1
185.106.122.243
185.128.40.162
187.158.96.33
187.158.97.242
189.11.158.42
189.45.199.194
189.170.187.49
195.211.5.30
196.22.252.62
197.149.193.3
198.154.224.104
202.162.213.106
203.125.7.39
204.42.253.2
204.42.253.130
208.52.191.126
209.126.136.2
209.141.127.18
212.92.127.177
220.181.159.73
222.101.184.211
222.107.170.1
222.186.56.48
223.25.96.74

77
atlas_attacks_7d.ipset Normal file
View File

@ -0,0 +1,77 @@
#
# atlas_attacks_7d
#
# ipv4 hash:ip ipset
#
# [ATLAS Attacks] (https://atlas.arbor.net/summary/attacks) -
# ATLAS uses lightweight honeypot sensors to detect and
# fingerprint the attacks launched by malicious sources on
# the Internet. In most cases the attacker is trying to take
# control of the target via a published exploit for a known
# vulnerability. A variety of exploit tools exist and are
# usually written specifically for each attack vector.
# Exploit attempts and attacks are most often launched from
# bots (hosts under an attacker's control), which will
# automatically try to exploit any possible host on the
# Internet. Attack origins are usually not spoofed, although
# the source host may be compromised or infected with malware.
#
# Maintainer : Arbor Networks
# Maintainer URL : https://atlas.arbor.net/
# List source URL : https://atlas.arbor.net/summary/attacks.csv
# Source File Date: Sat Nov 19 08:06:14 UTC 2016
#
# Category : attacks
# Version : 168
#
# This File Date : Sun Nov 20 01:36:03 UTC 2016
# Update Frequency: 1 day
# Aggregation : 7 days
# Entries : 37 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=atlas_attacks_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
23.234.51.33
24.172.251.54
40.74.124.185
45.76.134.144
45.115.39.125
60.6.38.2
60.10.253.62
66.135.104.194
71.248.167.22
77.59.214.138
77.69.2.70
78.129.171.154
79.129.35.192
85.159.233.111
91.187.98.242
93.174.93.144
94.177.164.99
106.184.2.29
128.232.110.29
134.147.203.115
137.226.113.7
139.162.13.205
139.162.32.13
166.78.18.210
169.229.3.91
185.94.111.1
185.128.40.162
187.158.96.33
187.158.97.242
189.11.158.42
189.45.199.194
189.170.187.49
202.162.213.106
204.42.253.2
204.42.253.130
209.126.136.2
222.186.56.48

56
atlas_botnets.ipset Normal file
View File

@ -0,0 +1,56 @@
#
# atlas_botnets
#
# ipv4 hash:ip ipset
#
# [ATLAS Botnets] (https://atlas.arbor.net/summary/botnets) -
# Botnets are collections of compromised hosts that attackers
# remotely control for their own nefarious purposes. Once
# installed and running, a malicious bot will attempt to
# connect to a remote server to receive instructions on what
# actions to take. The most common command and control (C&C)
# protocol used for this is Internet Relay Chat (IRC). While
# a legitimate protocol for online chat, IRC is often used by
# attackers due to the relative simplicity of the protocol
# along with the ready availability of bot software written
# to use it. After connecting, a bot-controlled host can be
# controlled by an attacker and commanded to conduct
# malicious actions such as sending spam, scanning the
# Internet for other potentially controllable hosts, or
# launching DoS attacks. ATLAS maintains a real-time database
# of malicious botnet command and control servers that is
# continuously updated. This information comes from malware
# analysis, botnet infiltration, and other sources of data.
#
# Maintainer : Arbor Networks
# Maintainer URL : https://atlas.arbor.net/
# List source URL : https://atlas.arbor.net/summary/botnets.csv
# Source File Date: Tue Apr 19 00:07:58 UTC 2016
#
# Category : attacks
# Version : 1
#
# This File Date : Tue Apr 19 21:03:25 UTC 2016
# Update Frequency: 1 day
# Aggregation : none
# Entries : 10 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=atlas_botnets
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
62.210.211.122
62.210.238.235
67.207.154.252
69.42.211.139
83.212.100.245
87.98.182.132
91.121.123.143
91.217.189.77
93.174.93.80
94.23.42.81

56
atlas_botnets_2d.ipset Normal file
View File

@ -0,0 +1,56 @@
#
# atlas_botnets_2d
#
# ipv4 hash:ip ipset
#
# [ATLAS Botnets] (https://atlas.arbor.net/summary/botnets) -
# Botnets are collections of compromised hosts that attackers
# remotely control for their own nefarious purposes. Once
# installed and running, a malicious bot will attempt to
# connect to a remote server to receive instructions on what
# actions to take. The most common command and control (C&C)
# protocol used for this is Internet Relay Chat (IRC). While
# a legitimate protocol for online chat, IRC is often used by
# attackers due to the relative simplicity of the protocol
# along with the ready availability of bot software written
# to use it. After connecting, a bot-controlled host can be
# controlled by an attacker and commanded to conduct
# malicious actions such as sending spam, scanning the
# Internet for other potentially controllable hosts, or
# launching DoS attacks. ATLAS maintains a real-time database
# of malicious botnet command and control servers that is
# continuously updated. This information comes from malware
# analysis, botnet infiltration, and other sources of data.
#
# Maintainer : Arbor Networks
# Maintainer URL : https://atlas.arbor.net/
# List source URL : https://atlas.arbor.net/summary/botnets.csv
# Source File Date: Tue Apr 19 00:07:58 UTC 2016
#
# Category : attacks
# Version : 1
#
# This File Date : Tue Apr 19 21:03:25 UTC 2016
# Update Frequency: 1 day
# Aggregation : 2 days
# Entries : 10 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=atlas_botnets_2d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
62.210.211.122
62.210.238.235
67.207.154.252
69.42.211.139
83.212.100.245
87.98.182.132
91.121.123.143
91.217.189.77
93.174.93.80
94.23.42.81

56
atlas_botnets_30d.ipset Normal file
View File

@ -0,0 +1,56 @@
#
# atlas_botnets_30d
#
# ipv4 hash:ip ipset
#
# [ATLAS Botnets] (https://atlas.arbor.net/summary/botnets) -
# Botnets are collections of compromised hosts that attackers
# remotely control for their own nefarious purposes. Once
# installed and running, a malicious bot will attempt to
# connect to a remote server to receive instructions on what
# actions to take. The most common command and control (C&C)
# protocol used for this is Internet Relay Chat (IRC). While
# a legitimate protocol for online chat, IRC is often used by
# attackers due to the relative simplicity of the protocol
# along with the ready availability of bot software written
# to use it. After connecting, a bot-controlled host can be
# controlled by an attacker and commanded to conduct
# malicious actions such as sending spam, scanning the
# Internet for other potentially controllable hosts, or
# launching DoS attacks. ATLAS maintains a real-time database
# of malicious botnet command and control servers that is
# continuously updated. This information comes from malware
# analysis, botnet infiltration, and other sources of data.
#
# Maintainer : Arbor Networks
# Maintainer URL : https://atlas.arbor.net/
# List source URL : https://atlas.arbor.net/summary/botnets.csv
# Source File Date: Tue Apr 19 00:07:58 UTC 2016
#
# Category : attacks
# Version : 1
#
# This File Date : Tue Apr 19 21:03:25 UTC 2016
# Update Frequency: 1 day
# Aggregation : 30 days
# Entries : 10 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=atlas_botnets_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
62.210.211.122
62.210.238.235
67.207.154.252
69.42.211.139
83.212.100.245
87.98.182.132
91.121.123.143
91.217.189.77
93.174.93.80
94.23.42.81

56
atlas_botnets_7d.ipset Normal file
View File

@ -0,0 +1,56 @@
#
# atlas_botnets_7d
#
# ipv4 hash:ip ipset
#
# [ATLAS Botnets] (https://atlas.arbor.net/summary/botnets) -
# Botnets are collections of compromised hosts that attackers
# remotely control for their own nefarious purposes. Once
# installed and running, a malicious bot will attempt to
# connect to a remote server to receive instructions on what
# actions to take. The most common command and control (C&C)
# protocol used for this is Internet Relay Chat (IRC). While
# a legitimate protocol for online chat, IRC is often used by
# attackers due to the relative simplicity of the protocol
# along with the ready availability of bot software written
# to use it. After connecting, a bot-controlled host can be
# controlled by an attacker and commanded to conduct
# malicious actions such as sending spam, scanning the
# Internet for other potentially controllable hosts, or
# launching DoS attacks. ATLAS maintains a real-time database
# of malicious botnet command and control servers that is
# continuously updated. This information comes from malware
# analysis, botnet infiltration, and other sources of data.
#
# Maintainer : Arbor Networks
# Maintainer URL : https://atlas.arbor.net/
# List source URL : https://atlas.arbor.net/summary/botnets.csv
# Source File Date: Tue Apr 19 00:07:58 UTC 2016
#
# Category : attacks
# Version : 1
#
# This File Date : Tue Apr 19 21:03:25 UTC 2016
# Update Frequency: 1 day
# Aggregation : 7 days
# Entries : 10 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=atlas_botnets_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
62.210.211.122
62.210.238.235
67.207.154.252
69.42.211.139
83.212.100.245
87.98.182.132
91.121.123.143
91.217.189.77
93.174.93.80
94.23.42.81

50
atlas_fastflux.ipset Normal file
View File

@ -0,0 +1,50 @@
#
# atlas_fastflux
#
# ipv4 hash:ip ipset
#
# [ATLAS Fastflux] (https://atlas.arbor.net/summary/fastflux)
# - Fast flux hosting is a technique where the nodes in a
# botnet are used as the endpoints in a website hosting
# scheme. The DNS records change frequently, often every few
# minutes, to point to new bots. The actual nodes themselves
# simply proxy the request back to the central hosting
# location. This gives the botnet a robust hosting
# infrastructure. Many different kinds of botnets use
# fastflux DNS techniques, for malware hosting, for illegal
# content hosting, for phishing site hosting, and other such
# activities. These hosts are likely to be infected with some
# form of malware.
#
# Maintainer : Arbor Networks
# Maintainer URL : https://atlas.arbor.net/
# List source URL : https://atlas.arbor.net/summary/fastflux.csv
# Source File Date: Sat Nov 19 08:20:58 UTC 2016
#
# Category : attacks
# Version : 205
#
# This File Date : Sun Nov 20 01:36:03 UTC 2016
# Update Frequency: 1 day
# Aggregation : none
# Entries : 10 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=atlas_fastflux
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
52.216.17.18
52.216.80.10
52.216.80.18
52.216.80.178
52.216.225.186
52.216.226.106
54.231.49.106
54.231.114.26
54.231.120.17
104.96.218.15

56
atlas_fastflux_2d.ipset Normal file
View File

@ -0,0 +1,56 @@
#
# atlas_fastflux_2d
#
# ipv4 hash:ip ipset
#
# [ATLAS Fastflux] (https://atlas.arbor.net/summary/fastflux)
# - Fast flux hosting is a technique where the nodes in a
# botnet are used as the endpoints in a website hosting
# scheme. The DNS records change frequently, often every few
# minutes, to point to new bots. The actual nodes themselves
# simply proxy the request back to the central hosting
# location. This gives the botnet a robust hosting
# infrastructure. Many different kinds of botnets use
# fastflux DNS techniques, for malware hosting, for illegal
# content hosting, for phishing site hosting, and other such
# activities. These hosts are likely to be infected with some
# form of malware.
#
# Maintainer : Arbor Networks
# Maintainer URL : https://atlas.arbor.net/
# List source URL : https://atlas.arbor.net/summary/fastflux.csv
# Source File Date: Sat Nov 19 08:20:58 UTC 2016
#
# Category : attacks
# Version : 204
#
# This File Date : Sun Nov 20 01:36:03 UTC 2016
# Update Frequency: 1 day
# Aggregation : 2 days
# Entries : 16 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=atlas_fastflux_2d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
23.64.63.59
23.194.67.97
52.216.0.202
52.216.17.18
52.216.80.10
52.216.80.18
52.216.80.178
52.216.225.186
52.216.226.106
54.231.11.114
54.231.49.106
54.231.88.1
54.231.114.26
54.231.120.17
104.96.218.15
104.106.249.50

91
atlas_fastflux_30d.ipset Normal file
View File

@ -0,0 +1,91 @@
#
# atlas_fastflux_30d
#
# ipv4 hash:ip ipset
#
# [ATLAS Fastflux] (https://atlas.arbor.net/summary/fastflux)
# - Fast flux hosting is a technique where the nodes in a
# botnet are used as the endpoints in a website hosting
# scheme. The DNS records change frequently, often every few
# minutes, to point to new bots. The actual nodes themselves
# simply proxy the request back to the central hosting
# location. This gives the botnet a robust hosting
# infrastructure. Many different kinds of botnets use
# fastflux DNS techniques, for malware hosting, for illegal
# content hosting, for phishing site hosting, and other such
# activities. These hosts are likely to be infected with some
# form of malware.
#
# Maintainer : Arbor Networks
# Maintainer URL : https://atlas.arbor.net/
# List source URL : https://atlas.arbor.net/summary/fastflux.csv
# Source File Date: Sat Nov 19 08:20:58 UTC 2016
#
# Category : attacks
# Version : 144
#
# This File Date : Sun Nov 20 01:36:04 UTC 2016
# Update Frequency: 1 day
# Aggregation : 30 days
# Entries : 51 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=atlas_fastflux_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
23.1.126.142
23.5.103.195
23.7.121.130
23.38.185.55
23.44.51.48
23.46.249.160
23.52.85.181
23.64.63.59
23.194.67.97
52.216.0.186
52.216.0.202
52.216.1.42
52.216.1.130
52.216.2.2
52.216.2.34
52.216.2.50
52.216.17.18
52.216.64.186
52.216.66.50
52.216.66.58
52.216.80.10
52.216.80.18
52.216.80.178
52.216.192.26
52.216.225.2
52.216.225.186
52.216.226.106
54.231.11.114
54.231.33.201
54.231.33.209
54.231.49.106
54.231.73.57
54.231.82.73
54.231.88.1
54.231.88.9
54.231.114.26
54.231.114.233
54.231.120.17
69.192.221.161
104.72.34.75
104.84.127.11
104.95.23.99
104.95.61.235
104.96.218.15
104.102.61.194
104.106.249.50
104.117.41.133
104.118.204.134
172.230.100.98
184.31.199.36
184.86.71.66

62
atlas_fastflux_7d.ipset Normal file
View File

@ -0,0 +1,62 @@
#
# atlas_fastflux_7d
#
# ipv4 hash:ip ipset
#
# [ATLAS Fastflux] (https://atlas.arbor.net/summary/fastflux)
# - Fast flux hosting is a technique where the nodes in a
# botnet are used as the endpoints in a website hosting
# scheme. The DNS records change frequently, often every few
# minutes, to point to new bots. The actual nodes themselves
# simply proxy the request back to the central hosting
# location. This gives the botnet a robust hosting
# infrastructure. Many different kinds of botnets use
# fastflux DNS techniques, for malware hosting, for illegal
# content hosting, for phishing site hosting, and other such
# activities. These hosts are likely to be infected with some
# form of malware.
#
# Maintainer : Arbor Networks
# Maintainer URL : https://atlas.arbor.net/
# List source URL : https://atlas.arbor.net/summary/fastflux.csv
# Source File Date: Sat Nov 19 08:20:58 UTC 2016
#
# Category : attacks
# Version : 195
#
# This File Date : Sun Nov 20 01:36:03 UTC 2016
# Update Frequency: 1 day
# Aggregation : 7 days
# Entries : 22 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=atlas_fastflux_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
23.64.63.59
23.194.67.97
52.216.0.186
52.216.0.202
52.216.1.42
52.216.17.18
52.216.80.10
52.216.80.18
52.216.80.178
52.216.225.2
52.216.225.186
52.216.226.106
54.231.11.114
54.231.49.106
54.231.73.57
54.231.88.1
54.231.114.26
54.231.114.233
54.231.120.17
104.72.34.75
104.96.218.15
104.106.249.50

54
atlas_phishing.ipset Normal file
View File

@ -0,0 +1,54 @@
#
# atlas_phishing
#
# ipv4 hash:ip ipset
#
# [ATLAS Phishing] (https://atlas.arbor.net/summary/fastflux)
# - Phishing servers host content that is designed to
# socially engineer unsuspecting users into surrendering
# private information used for identity theft. These servers
# are installed on compromised web servers or botnets, at
# times. Phishing Web sites mimic legitimate Web sites, often
# of a financial institution, in order to steal logins,
# passwords, and personal information. Attackers trick users
# into using the fake Web site by sending the intended victim
# an e-mail claiming to be a legitimate institution
# requesting the information for valid reasons, such as
# account verification. They may then use the stolen
# credentials to withdraw large amounts of money from the
# victim's account or commit other fraudulent acts. Most
# targeted brands are usually in the financial sector,
# including banks and online commerce sites.
#
# Maintainer : Arbor Networks
# Maintainer URL : https://atlas.arbor.net/
# List source URL : https://atlas.arbor.net/summary/phishing.csv
# Source File Date: Sat Nov 19 08:15:40 UTC 2016
#
# Category : attacks
# Version : 152
#
# This File Date : Sun Nov 20 01:00:03 UTC 2016
# Update Frequency: 1 day
# Aggregation : none
# Entries : 10 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=atlas_phishing
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
24.148.96.13
45.64.135.238
54.72.9.51
111.92.189.87
119.10.36.185
121.41.226.196
142.0.139.11
166.62.10.137
184.168.188.1
218.28.30.35

56
atlas_phishing_2d.ipset Normal file
View File

@ -0,0 +1,56 @@
#
# atlas_phishing_2d
#
# ipv4 hash:ip ipset
#
# [ATLAS Phishing] (https://atlas.arbor.net/summary/fastflux)
# - Phishing servers host content that is designed to
# socially engineer unsuspecting users into surrendering
# private information used for identity theft. These servers
# are installed on compromised web servers or botnets, at
# times. Phishing Web sites mimic legitimate Web sites, often
# of a financial institution, in order to steal logins,
# passwords, and personal information. Attackers trick users
# into using the fake Web site by sending the intended victim
# an e-mail claiming to be a legitimate institution
# requesting the information for valid reasons, such as
# account verification. They may then use the stolen
# credentials to withdraw large amounts of money from the
# victim's account or commit other fraudulent acts. Most
# targeted brands are usually in the financial sector,
# including banks and online commerce sites.
#
# Maintainer : Arbor Networks
# Maintainer URL : https://atlas.arbor.net/
# List source URL : https://atlas.arbor.net/summary/phishing.csv
# Source File Date: Sat Nov 19 08:15:40 UTC 2016
#
# Category : attacks
# Version : 155
#
# This File Date : Sun Nov 20 01:00:03 UTC 2016
# Update Frequency: 1 day
# Aggregation : 2 days
# Entries : 12 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=atlas_phishing_2d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
24.148.96.13
31.170.160.61
45.64.135.238
54.72.9.51
111.92.189.87
119.10.36.185
121.41.226.196
142.0.139.11
162.144.159.171
166.62.10.137
184.168.188.1
218.28.30.35

60
atlas_phishing_30d.ipset Normal file
View File

@ -0,0 +1,60 @@
#
# atlas_phishing_30d
#
# ipv4 hash:ip ipset
#
# [ATLAS Phishing] (https://atlas.arbor.net/summary/fastflux)
# - Phishing servers host content that is designed to
# socially engineer unsuspecting users into surrendering
# private information used for identity theft. These servers
# are installed on compromised web servers or botnets, at
# times. Phishing Web sites mimic legitimate Web sites, often
# of a financial institution, in order to steal logins,
# passwords, and personal information. Attackers trick users
# into using the fake Web site by sending the intended victim
# an e-mail claiming to be a legitimate institution
# requesting the information for valid reasons, such as
# account verification. They may then use the stolen
# credentials to withdraw large amounts of money from the
# victim's account or commit other fraudulent acts. Most
# targeted brands are usually in the financial sector,
# including banks and online commerce sites.
#
# Maintainer : Arbor Networks
# Maintainer URL : https://atlas.arbor.net/
# List source URL : https://atlas.arbor.net/summary/phishing.csv
# Source File Date: Sat Nov 19 08:15:40 UTC 2016
#
# Category : attacks
# Version : 143
#
# This File Date : Sun Nov 20 01:00:03 UTC 2016
# Update Frequency: 1 day
# Aggregation : 30 days
# Entries : 16 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=atlas_phishing_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
24.148.96.13
31.170.160.61
45.64.135.238
54.72.9.51
65.60.44.234
91.102.64.151
111.92.189.87
112.175.88.145
119.10.36.185
121.41.226.196
142.0.139.11
162.144.159.171
166.62.10.137
184.168.188.1
190.210.197.89
218.28.30.35

56
atlas_phishing_7d.ipset Normal file
View File

@ -0,0 +1,56 @@
#
# atlas_phishing_7d
#
# ipv4 hash:ip ipset
#
# [ATLAS Phishing] (https://atlas.arbor.net/summary/fastflux)
# - Phishing servers host content that is designed to
# socially engineer unsuspecting users into surrendering
# private information used for identity theft. These servers
# are installed on compromised web servers or botnets, at
# times. Phishing Web sites mimic legitimate Web sites, often
# of a financial institution, in order to steal logins,
# passwords, and personal information. Attackers trick users
# into using the fake Web site by sending the intended victim
# an e-mail claiming to be a legitimate institution
# requesting the information for valid reasons, such as
# account verification. They may then use the stolen
# credentials to withdraw large amounts of money from the
# victim's account or commit other fraudulent acts. Most
# targeted brands are usually in the financial sector,
# including banks and online commerce sites.
#
# Maintainer : Arbor Networks
# Maintainer URL : https://atlas.arbor.net/
# List source URL : https://atlas.arbor.net/summary/phishing.csv
# Source File Date: Wed Nov 16 00:38:09 UTC 2016
#
# Category : attacks
# Version : 147
#
# This File Date : Thu Nov 17 01:16:03 UTC 2016
# Update Frequency: 1 day
# Aggregation : 7 days
# Entries : 12 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=atlas_phishing_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
24.148.96.13
31.170.160.61
45.64.135.238
54.72.9.51
111.92.189.87
119.10.36.185
121.41.226.196
142.0.139.11
162.144.159.171
166.62.10.137
184.168.188.1
218.28.30.35

53
atlas_scans.ipset Normal file
View File

@ -0,0 +1,53 @@
#
# atlas_scans
#
# ipv4 hash:ip ipset
#
# [ATLAS Scans] (https://atlas.arbor.net/summary/scans) -
# Host scanning is a process whereby automated network sweeps
# are initiated in search of hosts running a particular
# service. This may be indicative of either legitimate host
# scanners (including network management systems and
# authorized vulnerability scanners) or an attacker (or
# automated malicious code, such as a worm) trying to
# enumerate potential hosts for subsequent compromise. Scans
# are often the prelude to an attack, and services scanned by
# attackers usually indicate known vulnerabilities for those
# services. Types of port scans include connect() scans, SYN
# scans, stealth scans, bounce scans, XMAS and Null scans.
# All reveal to the attacker which services on what hosts are
# listening for connections. Scans may be launched from
# compromised hosts, and their sources may be forged.
#
# Maintainer : Arbor Networks
# Maintainer URL : https://atlas.arbor.net/
# List source URL : https://atlas.arbor.net/summary/scans.csv
# Source File Date: Sat Nov 19 08:18:18 UTC 2016
#
# Category : attacks
# Version : 191
#
# This File Date : Sun Nov 20 01:28:02 UTC 2016
# Update Frequency: 1 day
# Aggregation : none
# Entries : 10 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=atlas_scans
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
24.172.251.54
40.74.124.185
82.165.156.139
89.163.145.168
93.158.200.86
172.246.138.2
207.244.91.219
209.126.117.215
209.126.117.240
212.47.242.37

59
atlas_scans_2d.ipset Normal file
View File

@ -0,0 +1,59 @@
#
# atlas_scans_2d
#
# ipv4 hash:ip ipset
#
# [ATLAS Scans] (https://atlas.arbor.net/summary/scans) -
# Host scanning is a process whereby automated network sweeps
# are initiated in search of hosts running a particular
# service. This may be indicative of either legitimate host
# scanners (including network management systems and
# authorized vulnerability scanners) or an attacker (or
# automated malicious code, such as a worm) trying to
# enumerate potential hosts for subsequent compromise. Scans
# are often the prelude to an attack, and services scanned by
# attackers usually indicate known vulnerabilities for those
# services. Types of port scans include connect() scans, SYN
# scans, stealth scans, bounce scans, XMAS and Null scans.
# All reveal to the attacker which services on what hosts are
# listening for connections. Scans may be launched from
# compromised hosts, and their sources may be forged.
#
# Maintainer : Arbor Networks
# Maintainer URL : https://atlas.arbor.net/
# List source URL : https://atlas.arbor.net/summary/scans.csv
# Source File Date: Sat Nov 19 08:18:18 UTC 2016
#
# Category : attacks
# Version : 191
#
# This File Date : Sun Nov 20 01:28:02 UTC 2016
# Update Frequency: 1 day
# Aggregation : 2 days
# Entries : 16 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=atlas_scans_2d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
24.172.251.54
40.74.124.185
82.165.156.139
89.163.145.168
93.158.200.86
93.158.200.103
108.59.12.96
162.210.193.243
163.172.88.143
172.246.138.2
178.162.215.74
192.96.201.104
207.244.91.219
209.126.117.215
209.126.117.240
212.47.242.37

153
atlas_scans_30d.ipset Normal file
View File

@ -0,0 +1,153 @@
#
# atlas_scans_30d
#
# ipv4 hash:ip ipset
#
# [ATLAS Scans] (https://atlas.arbor.net/summary/scans) -
# Host scanning is a process whereby automated network sweeps
# are initiated in search of hosts running a particular
# service. This may be indicative of either legitimate host
# scanners (including network management systems and
# authorized vulnerability scanners) or an attacker (or
# automated malicious code, such as a worm) trying to
# enumerate potential hosts for subsequent compromise. Scans
# are often the prelude to an attack, and services scanned by
# attackers usually indicate known vulnerabilities for those
# services. Types of port scans include connect() scans, SYN
# scans, stealth scans, bounce scans, XMAS and Null scans.
# All reveal to the attacker which services on what hosts are
# listening for connections. Scans may be launched from
# compromised hosts, and their sources may be forged.
#
# Maintainer : Arbor Networks
# Maintainer URL : https://atlas.arbor.net/
# List source URL : https://atlas.arbor.net/summary/scans.csv
# Source File Date: Sat Nov 19 08:18:18 UTC 2016
#
# Category : attacks
# Version : 189
#
# This File Date : Sun Nov 20 01:28:02 UTC 2016
# Update Frequency: 1 day
# Aggregation : 30 days
# Entries : 111 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=atlas_scans_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.189.191.228
14.139.59.198
24.172.251.54
40.74.124.185
40.127.105.239
45.115.39.125
46.165.251.203
46.172.91.2
50.57.101.191
50.79.150.113
51.15.38.209
51.254.48.125
58.69.23.130
58.222.46.211
60.6.38.2
66.135.104.194
69.55.17.108
69.64.57.132
69.64.61.103
74.208.153.241
77.59.214.138
78.31.67.28
78.129.237.112
80.82.65.120
81.102.248.127
81.177.32.12
82.165.156.139
85.25.43.38
85.93.93.89
89.163.145.168
89.163.210.111
89.163.242.15
89.207.133.166
91.220.101.27
93.62.4.197
93.99.7.123
93.115.28.95
93.115.29.159
93.158.200.82
93.158.200.86
93.158.200.92
93.158.200.103
93.158.200.126
94.112.255.151
95.131.186.32
95.131.186.47
95.131.186.52
101.78.180.216
106.122.250.43
108.59.12.96
108.177.134.114
109.228.47.236
109.228.50.126
111.178.234.48
113.5.81.69
118.200.45.84
134.19.176.138
141.138.130.12
162.210.193.243
163.172.68.183
163.172.77.164
163.172.88.143
163.172.88.157
163.172.145.227
163.172.181.3
172.246.138.2
175.207.12.74
178.162.215.70
178.162.215.74
185.19.217.78
185.40.4.92
186.2.167.14
188.214.128.24
191.96.249.53
191.96.249.54
192.96.201.104
192.99.8.33
192.99.38.116
193.111.141.199
195.72.134.75
195.72.134.97
195.72.134.143
195.72.135.55
195.72.135.59
195.72.135.65
195.154.34.247
195.154.214.162
197.149.193.3
198.27.67.76
198.27.67.213
198.27.70.39
198.27.70.180
198.27.81.161
198.154.224.104
203.125.7.39
207.244.91.219
209.58.144.141
209.126.117.215
209.126.117.240
209.126.122.13
209.126.122.15
209.126.122.31
209.126.122.32/31
209.141.127.18
212.47.242.37
213.202.233.46
213.202.233.114
219.144.70.159
222.101.184.211
223.25.96.74

75
atlas_scans_7d.ipset Normal file
View File

@ -0,0 +1,75 @@
#
# atlas_scans_7d
#
# ipv4 hash:ip ipset
#
# [ATLAS Scans] (https://atlas.arbor.net/summary/scans) -
# Host scanning is a process whereby automated network sweeps
# are initiated in search of hosts running a particular
# service. This may be indicative of either legitimate host
# scanners (including network management systems and
# authorized vulnerability scanners) or an attacker (or
# automated malicious code, such as a worm) trying to
# enumerate potential hosts for subsequent compromise. Scans
# are often the prelude to an attack, and services scanned by
# attackers usually indicate known vulnerabilities for those
# services. Types of port scans include connect() scans, SYN
# scans, stealth scans, bounce scans, XMAS and Null scans.
# All reveal to the attacker which services on what hosts are
# listening for connections. Scans may be launched from
# compromised hosts, and their sources may be forged.
#
# Maintainer : Arbor Networks
# Maintainer URL : https://atlas.arbor.net/
# List source URL : https://atlas.arbor.net/summary/scans.csv
# Source File Date: Sat Nov 19 08:18:18 UTC 2016
#
# Category : attacks
# Version : 191
#
# This File Date : Sun Nov 20 01:28:02 UTC 2016
# Update Frequency: 1 day
# Aggregation : 7 days
# Entries : 32 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=atlas_scans_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
24.172.251.54
40.74.124.185
45.115.39.125
46.172.91.2
51.15.38.209
60.6.38.2
69.64.61.103
77.59.214.138
82.165.156.139
89.163.145.168
93.158.200.82
93.158.200.86
93.158.200.92
93.158.200.103
108.59.12.96
108.177.134.114
162.210.193.243
163.172.88.143
163.172.88.157
172.246.138.2
178.162.215.70
178.162.215.74
192.96.201.104
198.27.67.76
198.27.70.180
207.244.91.219
209.126.117.215
209.126.117.240
209.126.122.15
209.126.122.31
212.47.242.37
213.202.233.114

31
bambenek_banjori.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_banjori
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of banjori C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/banjori-iplist.txt
# Source File Date: Fri Nov 11 01:04:10 UTC 2016
#
# Category : malware
# Version : 1576
#
# This File Date : Fri Nov 11 01:12:27 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_banjori
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

32
bambenek_bebloh.ipset Normal file
View File

@ -0,0 +1,32 @@
#
# bambenek_bebloh
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of bebloh C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/bebloh-iplist.txt
# Source File Date: Sun Nov 20 06:02:31 UTC 2016
#
# Category : malware
# Version : 1380
#
# This File Date : Sun Nov 20 06:04:19 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_bebloh
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
213.247.47.190

277
bambenek_c2.ipset Normal file
View File

@ -0,0 +1,277 @@
#
# bambenek_c2
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) master feed of
# known, active and non-sinkholed C&Cs IP addresses
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/c2-ipmasterlist.txt
# Source File Date: Sun Nov 20 06:16:56 UTC 2016
#
# Category : malware
# Version : 9132
#
# This File Date : Sun Nov 20 06:20:11 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 246 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_c2
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.22.149.135
8.5.1.33
8.5.1.38
8.5.1.39
8.5.1.43
8.5.1.48
23.21.179.138
23.21.224.150
31.170.178.179
31.186.169.41
40.255.0.62
46.28.2.13
46.28.105.107
46.30.211.32
46.30.213.205
46.30.215.7
46.30.215.57
46.105.239.199
46.183.165.143
46.249.43.105
47.89.58.141
50.31.225.93
52.4.209.250
52.9.172.230
52.28.249.128
52.49.48.68
52.55.128.40
54.72.130.67
54.210.47.225
62.129.200.14
62.149.128.72
62.149.128.74
62.149.128.151
62.149.128.154
62.149.128.157
62.149.128.160
62.149.128.163
62.149.128.166
62.153.122.122
62.182.58.84
62.197.128.123
62.212.87.22
64.21.149.167
64.98.145.30
64.99.80.121
65.254.248.217
66.18.15.23
66.29.58.119
66.96.147.110
66.96.149.32
66.228.59.130
67.59.157.51
67.196.64.226
69.41.162.77
69.172.201.217
69.195.129.75
70.32.1.32
72.5.65.112
72.52.4.90
74.220.199.6
75.5.255.185
77.55.97.141
77.232.68.19
79.170.40.236
80.85.86.6
80.237.132.180
81.2.194.62
81.2.194.128
81.2.194.176
81.95.96.29
81.169.145.66
81.169.145.68
81.169.145.84
81.169.145.86
81.169.145.88
81.169.145.92
81.169.145.94
81.169.145.105
81.169.145.161
81.169.145.162
81.177.139.153
82.98.135.43
82.100.220.50
82.135.122.10
83.137.194.25
83.162.30.185
83.217.25.203
84.51.37.244
84.234.64.242
85.13.129.76
85.13.132.239
85.124.51.115
85.128.128.99
85.214.112.103
85.236.47.218
86.109.162.65
87.98.230.60
88.198.56.106
89.31.143.16
89.223.109.60
91.33.216.43
91.121.154.229
91.196.124.119
91.199.77.50
91.212.28.29
91.250.81.151
92.43.203.171
93.94.226.28
93.190.48.3
94.152.8.56
94.152.8.57
95.97.52.198
95.110.231.107
95.183.52.144
95.211.102.20
95.211.160.216
97.74.12.15
98.124.199.9
98.124.199.39
98.124.243.32
98.124.243.33
98.124.243.36
98.124.243.37
98.124.243.39
98.124.243.41
98.124.243.42
98.124.243.44
98.124.243.47
98.124.243.49
98.139.135.129
104.27.180.238
104.27.181.238
104.160.182.132
104.160.182.135
106.186.19.180
107.167.19.75
107.167.19.76
107.167.19.77
107.167.19.78
107.170.170.216
107.180.46.187
109.123.209.212
109.235.63.103
109.235.74.158
115.239.252.29
116.255.248.152
119.9.74.163
130.185.109.77
134.119.224.38
136.0.178.8
141.105.126.87
143.215.15.199
146.148.34.125
149.126.70.232
149.216.106.61
151.248.117.40
157.7.107.143
158.58.170.148
162.209.27.107
162.210.101.150
162.213.251.251
162.255.119.102
162.255.119.249
165.160.13.20
165.160.15.20
173.230.158.166
176.74.176.187
178.32.208.147
178.33.49.166
183.90.232.5
183.90.242.4
183.110.225.165
184.168.221.1
184.168.221.18
184.168.221.28
184.168.221.30
184.168.221.31
184.168.221.104
185.28.193.192
185.49.69.153
185.51.65.84
185.53.179.6
188.40.28.163
191.5.59.19
192.64.119.245
192.64.119.248
192.64.119.254
192.64.147.231
192.116.242.29
192.169.57.154
192.184.12.62
192.238.177.69
194.9.94.85
194.9.94.86
194.9.94.235
194.58.56.166
194.58.56.169
194.150.113.18
194.242.61.31
195.8.208.58
195.110.124.188
195.154.8.242
198.54.114.164
199.116.248.204
200.205.194.222
203.151.233.116
204.11.56.48
205.133.37.124
205.164.14.72
206.188.192.70
207.10.232.16
207.10.232.21
208.73.211.70
208.91.197.66
208.91.199.233
208.109.181.233
209.99.40.220
209.99.40.222
209.99.40.223
209.99.40.224
209.99.40.226
209.140.30.61
209.160.65.66
210.172.183.32
211.43.203.53
212.85.106.71
212.227.20.93
213.74.196.226
213.186.33.5
213.247.47.190
216.19.176.141
216.21.239.197
216.222.194.151
217.17.85.91
217.19.237.54
217.70.142.74
217.70.184.38
217.76.156.252
217.160.122.61
217.160.223.213
217.160.231.72
217.160.231.163
217.160.231.201
217.160.233.84
219.117.192.17
222.234.2.109

31
bambenek_cl.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_cl
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of cl C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/cl-iplist.txt
# Source File Date: Mon Jan 25 18:05:02 UTC 2016
#
# Category : malware
# Version : 192
#
# This File Date : Mon Jan 25 18:12:39 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_cl
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

31
bambenek_cryptowall.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_cryptowall
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of cryptowall C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/cryptowall-iplist.txt
# Source File Date: Thu Dec 3 12:25:05 UTC 2015
#
# Category : malware
# Version : 81
#
# This File Date : Thu Dec 3 16:55:22 UTC 2015
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_cryptowall
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

31
bambenek_dircrypt.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_dircrypt
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of dircrypt C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/dircrypt-iplist.txt
# Source File Date: Fri Nov 4 16:08:27 UTC 2016
#
# Category : malware
# Version : 280
#
# This File Date : Fri Nov 4 16:12:19 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_dircrypt
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

31
bambenek_dyre.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_dyre
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of dyre C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/dyre-iplist.txt
# Source File Date: Mon Aug 22 03:02:42 UTC 2016
#
# Category : malware
# Version : 320
#
# This File Date : Mon Aug 22 03:08:31 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_dyre
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

31
bambenek_geodo.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_geodo
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of geodo C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/geodo-iplist.txt
# Source File Date: Wed Mar 2 03:07:19 UTC 2016
#
# Category : malware
# Version : 194
#
# This File Date : Wed Mar 2 03:12:17 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_geodo
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

31
bambenek_hesperbot.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_hesperbot
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of hesperbot C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/hesperbot-iplist.txt
# Source File Date: Thu Oct 20 23:03:34 UTC 2016
#
# Category : malware
# Version : 316
#
# This File Date : Thu Oct 20 23:08:24 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_hesperbot
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

35
bambenek_matsnu.ipset Normal file
View File

@ -0,0 +1,35 @@
#
# bambenek_matsnu
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of matsnu C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/matsnu-iplist.txt
# Source File Date: Sun Nov 20 00:00:46 UTC 2016
#
# Category : malware
# Version : 816
#
# This File Date : Sun Nov 20 00:04:26 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 4 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_matsnu
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
23.21.179.138
23.21.224.150
162.209.27.107
162.210.101.150

33
bambenek_necurs.ipset Normal file
View File

@ -0,0 +1,33 @@
#
# bambenek_necurs
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of necurs C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/necurs-iplist.txt
# Source File Date: Sun Nov 20 05:07:01 UTC 2016
#
# Category : malware
# Version : 1372
#
# This File Date : Sun Nov 20 05:12:27 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 2 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_necurs
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
200.205.194.222
205.133.37.124

31
bambenek_p2pgoz.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_p2pgoz
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of p2pgoz C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/p2pgoz-iplist.txt
# Source File Date: Mon Jan 25 18:00:34 UTC 2016
#
# Category : malware
# Version : 192
#
# This File Date : Mon Jan 25 18:04:12 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_p2pgoz
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

31
bambenek_pushdo.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_pushdo
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of pushdo C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/pushdo-iplist.txt
# Source File Date: Sun Oct 2 05:07:54 UTC 2016
#
# Category : malware
# Version : 235
#
# This File Date : Sun Oct 2 05:36:32 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_pushdo
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

42
bambenek_pykspa.ipset Normal file
View File

@ -0,0 +1,42 @@
#
# bambenek_pykspa
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of pykspa C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/pykspa-iplist.txt
# Source File Date: Sun Nov 20 02:08:18 UTC 2016
#
# Category : malware
# Version : 2023
#
# This File Date : Sun Nov 20 02:16:46 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 11 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_pykspa
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
8.5.1.38
8.5.1.43
40.255.0.62
81.169.145.66
86.109.162.65
98.124.243.32
98.124.243.33
98.124.243.42
98.124.243.47
162.255.119.249
191.5.59.19

31
bambenek_qakbot.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_qakbot
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of qakbot C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/qakbot-iplist.txt
# Source File Date: Sat Nov 12 04:01:37 UTC 2016
#
# Category : malware
# Version : 238
#
# This File Date : Sat Nov 12 04:04:23 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_qakbot
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

43
bambenek_ramnit.ipset Normal file
View File

@ -0,0 +1,43 @@
#
# bambenek_ramnit
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of ramnit C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/ramnit-iplist.txt
# Source File Date: Sun Nov 20 02:04:03 UTC 2016
#
# Category : malware
# Version : 2286
#
# This File Date : Sun Nov 20 02:08:13 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 12 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_ramnit
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
52.9.172.230
54.72.130.67
69.195.129.75
89.223.109.60
151.248.117.40
173.230.158.166
185.49.69.153
209.99.40.220
209.99.40.222
209.99.40.223
209.99.40.224
209.99.40.226

31
bambenek_ranbyus.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_ranbyus
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of ranbyus C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/ranbyus-iplist.txt
# Source File Date: Fri May 13 11:07:26 UTC 2016
#
# Category : malware
# Version : 198
#
# This File Date : Fri May 13 11:12:19 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_ranbyus
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

145
bambenek_simda.ipset Normal file
View File

@ -0,0 +1,145 @@
#
# bambenek_simda
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of simda C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/simda-iplist.txt
# Source File Date: Sun Nov 20 06:07:49 UTC 2016
#
# Category : malware
# Version : 7931
#
# This File Date : Sun Nov 20 06:16:44 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 114 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_simda
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
31.186.169.41
46.28.2.13
46.28.105.107
46.30.211.32
46.30.213.205
46.30.215.7
46.30.215.57
46.105.239.199
46.249.43.105
52.49.48.68
54.210.47.225
62.129.200.14
62.149.128.72
62.149.128.74
62.149.128.151
62.149.128.154
62.149.128.157
62.149.128.160
62.149.128.163
62.149.128.166
62.153.122.122
62.197.128.123
62.212.87.22
66.96.149.32
72.5.65.112
77.55.97.141
77.232.68.19
79.170.40.236
80.85.86.6
80.237.132.180
81.2.194.62
81.2.194.128
81.2.194.176
81.95.96.29
81.169.145.68
81.169.145.84
81.169.145.88
81.169.145.92
81.169.145.94
81.169.145.105
81.169.145.161
81.169.145.162
81.177.139.153
82.98.135.43
82.100.220.50
83.162.30.185
84.234.64.242
85.13.129.76
85.13.132.239
85.124.51.115
85.128.128.99
85.214.112.103
85.236.47.218
87.98.230.60
88.198.56.106
89.31.143.16
91.33.216.43
91.121.154.229
91.196.124.119
91.199.77.50
91.212.28.29
91.250.81.151
92.43.203.171
93.94.226.28
93.190.48.3
94.152.8.56
94.152.8.57
95.110.231.107
95.211.102.20
95.211.160.216
98.124.199.9
109.123.209.212
109.235.63.103
109.235.74.158
141.105.126.87
146.148.34.125
149.126.70.232
149.216.106.61
165.160.13.20
165.160.15.20
178.32.208.147
178.33.49.166
183.90.242.4
183.110.225.165
184.168.221.28
185.51.65.84
188.40.28.163
192.64.147.231
194.9.94.85
194.9.94.86
194.9.94.235
194.150.113.18
194.242.61.31
195.8.208.58
195.110.124.188
195.154.8.242
199.116.248.204
203.151.233.116
208.91.199.233
209.99.40.226
209.140.30.61
210.172.183.32
211.43.203.53
212.85.106.71
213.186.33.5
217.17.85.91
217.19.237.54
217.70.142.74
217.70.184.38
217.76.156.252
217.160.122.61
217.160.223.213
217.160.231.163
217.160.233.84

89
bambenek_suppobox.ipset Normal file
View File

@ -0,0 +1,89 @@
#
# bambenek_suppobox
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of suppobox C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/suppobox-iplist.txt
# Source File Date: Sun Nov 20 05:09:06 UTC 2016
#
# Category : malware
# Version : 3814
#
# This File Date : Sun Nov 20 05:12:28 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 58 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_suppobox
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.22.149.135
8.5.1.39
8.5.1.48
50.31.225.93
64.98.145.30
64.99.80.121
65.254.248.217
66.18.15.23
66.96.147.110
66.228.59.130
67.196.64.226
69.172.201.217
70.32.1.32
74.220.199.6
81.169.145.86
82.135.122.10
84.51.37.244
89.31.143.16
95.97.52.198
98.124.199.39
98.124.243.32
98.124.243.36
98.124.243.37
98.124.243.39
98.124.243.41
98.124.243.44
98.124.243.49
98.139.135.129
106.186.19.180
107.180.46.187
116.255.248.152
130.185.109.77
134.119.224.38
157.7.107.143
162.255.119.102
176.74.176.187
183.90.232.5
184.168.221.1
184.168.221.18
184.168.221.30
184.168.221.31
184.168.221.104
192.64.119.254
192.116.242.29
192.169.57.154
192.184.12.62
198.54.114.164
206.188.192.70
208.73.211.70
208.109.181.233
209.99.40.222
209.99.40.223
216.19.176.141
216.21.239.197
216.222.194.151
217.160.231.72
217.160.231.201
222.234.2.109

31
bambenek_symmi.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_symmi
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of symmi C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/symmi-iplist.txt
# Source File Date: Thu Nov 17 03:08:31 UTC 2016
#
# Category : malware
# Version : 196
#
# This File Date : Thu Nov 17 03:16:42 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_symmi
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

49
bambenek_tinba.ipset Normal file
View File

@ -0,0 +1,49 @@
#
# bambenek_tinba
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of tinba C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/tinba-iplist.txt
# Source File Date: Sun Nov 20 06:01:15 UTC 2016
#
# Category : malware
# Version : 8374
#
# This File Date : Sun Nov 20 06:04:20 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 18 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_tinba
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
8.5.1.33
8.5.1.48
46.183.165.143
52.4.209.250
54.72.130.67
69.172.201.217
72.5.65.112
72.52.4.90
83.217.25.203
89.223.109.60
95.183.52.144
98.124.243.32
158.58.170.148
194.58.56.166
194.58.56.169
205.164.14.72
209.99.40.220
209.99.40.226

32
bambenek_volatile.ipset Normal file
View File

@ -0,0 +1,32 @@
#
# bambenek_volatile
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of volatile C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/volatile-iplist.txt
# Source File Date: Mon Nov 7 17:08:49 UTC 2016
#
# Category : malware
# Version : 213
#
# This File Date : Mon Nov 7 17:12:30 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_volatile
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
162.213.251.251

2595
bbcan177_ms1.netset Normal file
View File

File diff suppressed because it is too large Load Diff

1175
bbcan177_ms3.netset Normal file
View File

File diff suppressed because it is too large Load Diff

3778
bds_atif.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

2605
bi_any_2_1d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

11589
bi_any_2_30d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

7875
bi_any_2_7d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

32
bi_bruteforce_2_30d.ipset Normal file
View File

@ -0,0 +1,32 @@
#
# bi_bruteforce_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# bruteforce with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/bruteforce/2?age=30d
# Source File Date: Fri Oct 28 15:48:19 UTC 2016
#
# Category : attacks
# Version : 30
#
# This File Date : Fri Oct 28 15:48:19 UTC 2016
# Update Frequency: 1 day
# Aggregation : none
# Entries : 2 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_bruteforce_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
106.186.113.132
222.35.18.100

516
bi_ftp_2_30d.ipset Normal file
View File

@ -0,0 +1,516 @@
#
# bi_ftp_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# ftp with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/ftp/2?age=30d
# Source File Date: Sat Nov 19 21:12:43 UTC 2016
#
# Category : attacks
# Version : 378
#
# This File Date : Sat Nov 19 21:12:43 UTC 2016
# Update Frequency: 1 day
# Aggregation : none
# Entries : 486 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_ftp_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
2.132.201.207
5.18.83.161
5.18.176.130
5.18.177.125
5.18.230.78
5.44.168.141
5.56.127.75
5.57.65.19
5.58.132.74
5.128.11.220
5.128.17.2
5.128.131.207
5.129.28.39
5.153.172.9
5.164.176.130
5.167.59.28
5.227.7.111
31.28.120.219
31.41.228.71
31.47.136.116
31.131.65.47
31.148.91.83
31.148.218.59
31.148.218.90
31.148.218.91
31.172.128.39
31.173.164.97
31.181.78.191
31.183.228.62
31.202.241.7
31.211.10.46
31.211.34.225
31.211.47.131
31.211.69.79
31.211.105.29
36.8.222.106
37.9.169.6
37.15.2.6
37.29.7.45
37.29.15.82
37.29.74.33
37.53.131.23
37.140.1.112
37.186.100.67
37.190.84.97
37.192.97.159
37.193.70.180
37.193.252.33
37.194.18.42
37.229.39.190
37.229.131.179
37.230.228.210
37.232.160.132
46.8.38.118
46.18.32.101
46.39.5.30
46.39.5.55
46.39.35.131
46.72.199.83
46.146.199.204
46.150.71.219
46.150.97.83
46.151.253.168
46.161.165.232
46.161.181.144
46.166.206.104
46.174.64.105
46.175.160.53
46.187.30.146
46.200.39.199
46.201.224.215
46.211.197.180
46.219.213.187
46.219.247.129
46.229.188.185
46.241.74.68
50.20.50.210
58.135.87.16
60.13.132.38
60.13.214.247
60.161.145.243
61.92.29.138
61.142.131.119
61.160.215.72
61.164.91.182
62.72.185.36
62.210.136.217
62.210.206.180
65.96.114.219
66.240.192.138
66.240.236.119
70.25.74.151
71.6.135.131
71.6.165.200
71.6.167.142
71.60.78.220
73.50.210.243
77.76.169.9
77.108.219.25
77.121.251.153
77.122.99.92
77.123.38.121
77.151.19.81
77.153.150.235
77.202.240.42
77.222.133.194
77.232.26.37
77.236.79.233
77.240.172.72
78.25.69.154
78.26.162.27
78.26.162.71
78.31.183.211
78.56.202.198
78.61.54.58
78.137.61.56
78.139.205.111
78.139.227.21
78.154.164.202
78.189.84.146
78.194.57.19
78.203.235.233
78.204.44.98
78.216.26.10
78.218.206.41
78.219.83.93
78.220.89.24
78.224.243.34
78.226.18.205
78.228.50.27
78.240.181.88
78.244.38.48
79.80.11.214
79.129.19.253
79.135.135.213
79.136.158.53
79.136.163.29
79.143.40.122
80.14.107.204
80.77.163.218
80.249.86.8
80.249.233.172
80.250.213.62
81.4.205.112
81.104.17.251
81.163.97.181
81.211.103.106
81.220.148.93
82.151.111.196
82.151.111.197
82.193.99.39
82.207.58.230
82.209.209.234
82.235.244.62
82.239.187.88
82.241.197.105
82.245.83.94
83.154.247.199
83.234.49.217
84.205.227.60
85.65.113.36
85.139.241.219
85.201.104.35
86.27.143.239
86.237.139.116
86.252.218.29
86.253.51.141
87.198.176.242
87.251.183.226
88.102.99.154
88.103.14.227
88.126.93.187
88.160.165.73
88.164.244.56
88.167.182.61
88.168.35.184
88.170.7.25
88.177.78.123
88.186.169.211
88.188.84.177
88.204.52.186
88.204.54.60
88.204.117.145
88.206.116.165
89.2.87.216
89.23.18.10
89.90.74.138
89.153.248.89
89.158.141.195
89.169.112.239
89.173.119.106
89.185.29.214
89.201.12.104
89.249.234.7
89.249.249.169
89.251.151.54
90.57.103.54
90.73.102.108
90.109.133.203
90.110.199.231
90.113.73.207
90.188.186.114
90.189.222.29
91.68.66.183
91.78.40.134
91.198.39.109
91.200.232.167
91.204.176.3
91.204.176.15
91.204.176.17
91.204.176.19
91.204.176.21
91.212.248.224
91.222.49.3
91.223.152.3
91.226.121.12
91.233.135.105
91.234.26.105
91.240.96.44
92.60.179.198
92.115.23.106
92.141.158.183
92.170.170.172
92.249.98.254
92.249.108.138
92.253.176.96
93.21.255.10
93.26.149.152
93.72.237.224
93.95.157.195
93.123.246.116
93.171.172.220
93.171.242.124
93.185.192.74
93.185.192.93
94.19.87.19
94.79.33.18
94.140.234.14
94.158.95.10
94.178.239.26
94.230.240.45
94.230.240.46
94.230.240.55
94.230.240.60
94.244.36.151
94.244.60.187
94.244.151.219
95.28.238.13
95.59.240.144
95.67.98.44
95.69.133.21
95.69.228.45
95.84.130.98
95.84.253.167
95.143.212.8
95.154.168.66
95.167.81.227
95.167.81.247
95.167.81.255
95.170.116.67
95.174.193.39
95.174.211.150
95.181.110.77
101.200.188.185
101.200.204.17
101.200.204.168
109.19.151.125
109.20.231.16
109.27.52.9
109.28.210.116
109.68.173.48
109.86.123.86
109.87.52.11
109.87.87.199
109.87.102.147
109.87.179.229
109.87.187.27
109.124.37.5
109.124.43.148
109.172.53.186
109.173.5.146
109.173.48.187
109.190.29.67
109.194.27.202
109.195.33.201
109.205.249.225
109.206.53.227
109.206.58.105
109.206.157.45
109.252.71.63
109.252.109.219
109.254.31.129
109.254.49.108
109.254.49.130
109.254.56.23
111.121.192.90
111.122.172.221
111.123.225.114
112.74.219.184
113.105.152.182
113.108.189.40
113.108.189.47
114.215.110.20
115.28.136.89
115.28.140.170
115.29.108.86
118.97.108.204
120.24.154.140
120.25.205.181
120.25.226.171
120.25.237.170
120.25.237.209
120.25.252.249
120.26.221.37
120.27.158.78
120.55.160.165
120.76.163.234
120.76.209.33
120.204.67.99
121.26.209.40
121.26.251.26
121.43.104.78
122.227.243.82
123.56.129.74
123.56.181.190
123.56.224.116
123.57.16.72
123.57.20.180
123.57.141.93
123.57.153.215
123.57.249.178
123.184.19.221
123.202.140.78
124.67.255.90
124.205.171.50
125.64.94.200
128.71.6.160
134.0.100.247
134.249.130.125
134.249.181.149
139.196.8.79
139.196.48.106
139.196.181.68
139.196.182.169
141.105.25.226
141.212.122.80
141.212.122.81
145.255.1.18
145.255.21.120
151.80.237.216
158.181.183.212
159.180.227.170
159.224.33.162
159.224.64.236
159.224.70.23
159.224.91.165
159.224.216.115
163.19.6.27
171.33.252.197
176.8.164.154
176.36.195.193
176.37.210.43
176.106.72.233
176.107.250.8
176.107.250.9
176.108.69.57
176.111.183.229
176.112.4.238
176.118.49.125
176.118.52.3
176.122.122.117
176.124.146.236
176.140.222.106
176.140.233.219
176.182.126.219
176.194.60.237
176.195.61.154
176.215.154.162
176.222.241.158
177.84.56.194
177.102.236.6
178.54.237.105
178.76.67.68
178.76.219.56
178.76.242.137
178.93.149.137
178.93.149.216
178.93.157.10
178.136.134.192
178.136.218.254
178.137.148.136
178.140.224.48
178.150.138.46
178.151.170.88
178.155.112.37
178.158.217.249
178.163.86.92
178.211.44.34
178.219.88.0
178.219.244.138
178.219.244.192
179.4.166.202
179.155.151.200
179.218.83.197
180.97.221.119
180.250.178.174
181.112.40.243
182.253.195.139
182.253.195.140
183.129.160.229
185.11.29.188
185.36.174.100
185.102.188.245
185.124.230.217
185.130.6.5
186.137.69.64
187.52.48.175
187.53.223.108
187.67.219.29
188.32.195.41
188.64.128.30
188.113.12.169
188.134.8.73
188.141.115.200
188.163.26.235
188.163.73.24
188.163.79.28
188.163.104.94
188.191.161.39
188.191.162.28
188.227.78.144
188.231.247.113
188.239.22.2
188.244.155.6
188.254.73.250
188.254.73.253
189.1.162.20
192.162.147.17
193.169.123.55
193.194.127.211
193.201.98.161
193.203.103.133
193.250.5.188
193.251.78.76
194.50.254.168
194.60.77.222
194.126.180.181
194.186.229.42
194.226.8.15
194.247.17.232
195.5.29.77
195.95.139.226
195.112.240.2
195.149.108.48
195.184.208.1
195.184.218.5
198.20.70.114
202.46.14.178
208.100.26.231
208.100.26.232
209.169.162.242
212.79.110.135
212.92.252.11
212.107.232.41
212.112.126.36
212.112.126.152
212.112.126.168
212.194.149.132
212.232.3.115
213.108.183.61
213.110.201.229
213.142.219.142
213.180.115.81
213.184.234.86
217.19.208.109
217.19.208.110
217.30.194.234
218.38.136.86
218.77.80.131
218.161.120.176
219.138.225.150
222.42.146.225
222.72.133.180
222.72.133.182
222.88.213.72
222.124.168.146

489
bi_http_2_30d.ipset Normal file
View File

@ -0,0 +1,489 @@
#
# bi_http_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# http with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/http/2?age=30d
# Source File Date: Sat Nov 19 21:12:43 UTC 2016
#
# Category : attacks
# Version : 366
#
# This File Date : Sat Nov 19 21:12:43 UTC 2016
# Update Frequency: 1 day
# Aggregation : none
# Entries : 459 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_http_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.192.128.23
5.45.77.6
5.133.180.199
5.135.108.190
5.153.233.130
5.153.238.103
5.189.163.145
5.196.72.199
5.196.76.176
5.199.130.188
8.43.32.2
14.63.160.219
23.228.101.162
23.254.153.202
23.254.153.203
31.25.89.55
31.41.41.11
31.184.195.114
35.0.127.52
37.57.0.201
37.59.4.193
37.59.46.141
37.59.253.230
37.72.185.119
37.187.25.49
37.187.114.171
37.247.109.21
41.226.27.133
42.96.176.64
42.96.176.165
42.96.190.11
42.96.197.95
45.40.132.103
45.40.133.185
50.6.77.76
50.62.9.155
50.62.161.75
50.62.177.176
50.62.177.223
50.62.208.36
50.62.208.40
50.62.208.42
50.62.208.52
50.62.208.68
50.62.208.71
50.62.208.72
50.62.208.83
50.62.208.87
50.62.208.106
50.62.208.124
50.62.208.132
50.62.208.133
50.62.208.146
50.62.208.192
50.62.208.207
50.93.200.221
50.93.202.229
51.254.143.113
51.254.212.37
52.40.112.62
52.54.21.147
52.91.16.186
52.207.212.248
54.175.1.15
54.201.71.42
54.218.95.31
59.124.6.114
61.160.224.128
61.186.245.211
62.109.19.98
62.149.143.64
62.149.143.72
62.149.143.74
62.149.143.75
62.149.143.78
62.210.36.139
62.210.105.116
62.210.148.91
62.210.152.90
62.210.162.37
62.210.162.209
62.210.185.3
62.210.201.58
64.16.214.100
64.71.143.210
66.147.242.155
66.240.192.138
66.240.219.146
66.240.236.119
69.12.77.220
69.30.223.170
69.30.223.172
69.197.169.202
71.6.135.131
71.6.146.185
71.6.158.166
71.6.165.200
71.6.167.142
72.32.10.144
72.34.34.33
72.46.133.242
72.167.190.33
72.167.190.35
72.167.190.37
72.167.190.44
72.167.190.168
72.167.190.179
72.167.190.184
74.208.158.208
74.220.215.201
75.98.166.130
75.119.210.220
77.92.141.186
77.109.139.87
77.247.181.162
77.247.181.163
77.247.181.165
79.0.159.35
79.136.125.88
79.172.193.32
80.82.215.199
80.91.49.52
80.255.192.237
81.169.144.135
81.177.165.101
81.177.174.10
82.221.105.6
82.221.105.7
83.222.214.165
84.240.9.6
85.25.103.50
85.25.103.119
88.149.156.110
88.159.17.78
88.198.14.171
88.201.213.238
89.31.57.5
89.46.104.173
89.46.104.177
89.46.104.185
89.46.104.189
89.46.105.242
89.46.105.244
89.46.105.251
89.146.199.132
89.248.172.16
89.248.174.4
91.121.155.12
91.196.50.33
91.200.12.7
91.200.12.8
91.200.12.33
91.200.12.42
91.200.12.47
91.200.12.58
91.200.12.65
91.200.12.78
91.200.12.91
91.200.12.93
91.200.12.114
91.200.12.132
91.200.12.155
91.208.99.2
92.60.114.159
92.63.87.10
92.63.87.61
92.63.87.97
92.63.87.118
93.115.95.201
93.115.95.206
93.157.99.179
93.174.93.218
93.174.95.106
94.23.9.215
94.23.24.84
94.23.214.93
94.26.140.150
94.102.48.193
94.102.49.193
94.142.242.84
94.242.246.24
95.110.194.252
95.128.43.164
95.142.159.168
95.213.177.123
95.213.177.124
95.213.177.125
95.213.177.126
96.44.172.26
97.74.234.61
103.3.46.45
103.6.29.2
104.128.144.131
104.193.88.243
104.193.88.244
104.193.88.245
104.194.26.204
104.219.251.2
104.233.87.36
104.238.117.86
106.75.61.212
107.152.102.170
107.181.174.84
109.74.151.149
109.163.235.228
109.201.154.170
114.108.150.159
114.215.154.125
115.28.17.58
115.28.28.62
115.28.44.252
115.28.76.22
115.28.145.231
115.28.154.44
115.28.212.181
115.28.240.215
119.97.146.76
120.27.31.148
120.27.35.11
120.27.37.74
120.27.100.100
120.76.114.201
120.76.132.64
120.76.146.29
121.42.52.27
122.155.167.124
123.59.59.52
130.185.84.180
130.185.155.10
130.185.155.74
134.249.52.13
136.243.173.205
137.226.113.7
138.201.151.94
139.129.14.230
139.129.40.112
139.162.13.205
140.117.150.103
141.212.122.16
141.212.122.64
141.212.122.80
141.212.122.81
141.212.122.90
141.212.122.96
141.212.122.98
141.212.122.128
141.212.122.129
141.212.122.130
141.212.122.160
141.212.122.161
142.54.186.26
146.0.74.195
147.186.48.65
149.202.72.240
151.80.18.236
151.80.22.111
151.80.24.9
151.236.51.75
155.133.82.112
157.7.188.97
158.69.192.169
158.69.194.232
158.69.240.164
159.253.0.74
160.202.163.124
160.202.163.125
162.144.66.10
162.144.151.73
162.247.72.202
163.172.200.111
165.231.2.160
166.62.80.225
166.62.81.48
166.62.101.21
166.62.118.154
169.229.3.91
171.25.193.77
171.25.193.131
173.208.177.59
173.254.216.67
173.254.216.68
174.136.12.174
175.123.98.240
176.9.70.189
178.17.127.210
178.20.55.16
178.33.48.193
178.33.189.175
178.137.85.67
178.137.87.242
178.137.93.24
178.137.164.171
178.210.89.89
178.210.90.90
178.217.187.39
180.76.15.6
180.76.15.8
180.76.15.157
180.97.106.37
180.97.106.161
180.97.106.162
180.150.227.197
181.48.157.156
182.50.142.89
182.255.0.60
183.129.160.229
184.106.10.128
184.168.152.52
184.168.192.130
184.168.192.133
184.168.192.140
184.168.192.163
185.2.131.210
185.5.222.171
185.10.71.107
185.22.185.223
185.25.148.240
185.25.150.156
185.26.122.13
185.49.14.190
185.59.17.112
185.80.68.46
185.92.72.33
185.104.120.4
185.106.92.135
185.129.148.203
185.130.5.214
185.141.24.110
186.202.153.141
188.39.46.35
188.116.33.51
188.120.246.106
188.138.9.49
188.143.233.136
188.143.234.244
188.163.75.7
188.163.78.47
188.165.214.193
188.165.229.190
189.89.125.52
190.121.21.211
191.96.249.80
192.42.116.16
192.95.3.132
192.95.12.59
192.99.100.176
192.99.144.140
192.99.200.65
192.99.238.190
192.163.238.218
192.169.216.58
192.185.4.101
193.111.136.162
193.111.139.216
193.201.227.139
193.201.227.158
193.202.110.189
194.69.248.115
194.102.233.9
194.150.168.95
195.22.126.220
195.38.166.152
195.62.53.168
195.67.74.166
195.74.38.93
195.74.38.149
195.154.112.72
195.154.188.9
195.154.189.212
195.154.194.111
195.154.199.128
195.154.226.186
195.154.230.160
195.154.230.187
195.154.232.138
195.154.235.96
195.154.235.105
195.154.235.171
195.154.236.110
195.154.236.233
195.154.237.92
195.154.237.108
195.154.240.146
195.154.240.170
195.154.240.176
195.154.240.184
195.154.240.246
195.154.241.35
195.154.241.43
195.154.241.71
195.154.241.119
195.154.241.120
195.154.241.153
195.154.241.166
195.154.243.31
195.154.250.118
195.154.250.180
195.154.250.216
195.154.250.248
195.154.251.11
195.154.251.17
195.154.251.120
196.196.2.171
197.231.221.211
198.1.71.253
198.20.69.74
198.20.69.98
198.20.70.114
198.20.87.98
198.20.99.130
198.245.49.225
199.15.233.162
199.15.233.174
199.33.125.108
199.87.154.255
202.157.188.250
203.35.67.20
203.162.121.54
204.12.255.130
204.197.255.118
206.253.224.14
207.5.120.21
207.20.232.240
207.46.228.208
207.112.12.28
208.77.209.226
208.109.125.32
208.109.207.230
209.17.114.78
209.222.8.196
210.140.163.133
212.21.66.6
212.47.246.21
212.59.30.110
212.63.209.201
212.83.40.239
212.113.144.11
212.227.119.183
213.61.149.100
213.111.197.180
213.128.81.66
213.159.38.90
213.189.55.149
213.251.182.102
213.251.182.103
213.251.182.105
213.251.182.106
213.251.182.107
213.251.182.110
213.251.182.111
213.251.182.113
213.251.182.114
213.251.182.115
217.199.165.230
218.92.147.82
219.101.38.13
220.202.123.178
222.35.18.100
222.186.21.35

1730
bi_mail_2_30d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

29
bi_proxy_2_30d.ipset Normal file
View File

@ -0,0 +1,29 @@
#
# bi_proxy_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# proxy with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/proxy/2?age=30d
# Source File Date: Fri Oct 9 03:27:58 UTC 2015
#
# Category : attacks
#
# This File Date : Fri Oct 9 03:27:58 UTC 2015
# Update Frequency: 1 day
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_proxy_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

29
bi_sql_2_30d.ipset Normal file
View File

@ -0,0 +1,29 @@
#
# bi_sql_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# sql with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/sql/2?age=30d
# Source File Date: Wed Aug 26 15:36:32 UTC 2015
#
# Category : attacks
#
# This File Date : Thu Aug 27 10:09:48 UTC 2015
# Update Frequency: 1 day
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_sql_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

8941
bi_ssh_2_30d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

116
bi_voip_2_30d.ipset Normal file
View File

@ -0,0 +1,116 @@
#
# bi_voip_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# voip with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/voip/2?age=30d
# Source File Date: Sat Nov 19 21:56:30 UTC 2016
#
# Category : attacks
# Version : 370
#
# This File Date : Sat Nov 19 21:56:30 UTC 2016
# Update Frequency: 1 day
# Aggregation : none
# Entries : 86 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_voip_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
23.239.65.66
23.239.84.84
23.239.87.18
23.239.87.67
37.61.217.178
46.20.46.8
50.30.37.58
64.139.60.171
69.64.57.18
69.195.152.170
74.208.153.130
85.93.93.88
89.163.144.88
89.163.144.193
89.163.148.55
89.163.148.141
89.163.148.231
89.163.204.20
89.163.242.185
91.236.74.186
91.236.75.97
91.236.75.120
91.236.75.157
93.90.188.171
93.186.197.132
94.23.62.187
118.69.198.80
142.0.38.113
146.0.43.19
167.114.131.155
172.93.99.250
173.208.239.82
185.40.4.63
185.40.4.70
185.40.4.78
185.40.4.96
187.32.75.132
188.161.112.6
188.161.112.70
188.161.112.77
188.161.112.79
188.161.112.82
188.161.112.86
188.161.112.87
188.161.112.89
188.161.112.99
188.161.112.100
188.161.112.101
188.161.112.111
188.161.112.113
188.161.112.114
188.161.112.118
188.161.112.119
188.161.112.123
188.161.112.125
195.154.50.47
195.154.172.203
195.154.214.162
199.48.164.242
207.166.135.73
209.126.97.238
209.126.116.176
209.126.117.216
209.126.120.50
209.126.122.15
209.126.122.16
209.126.122.32
209.126.122.33
209.126.122.87
212.83.128.97
212.83.137.201
212.83.146.50
212.83.148.20
212.83.150.73
212.129.2.188
212.129.11.74
212.129.52.78
213.202.233.46
213.202.233.49
213.202.233.72
213.202.233.91
213.202.233.188
213.202.233.189
213.202.233.192
213.202.233.199
218.64.77.8

206
bitcoin_blockchain_info.ipset Normal file
View File

@ -0,0 +1,206 @@
#
# bitcoin_blockchain_info
#
# ipv4 hash:ip ipset
#
# [Blockchain.info]
# (https://blockchain.info/en/connected-nodes) Bitcoin nodes
# connected to Blockchain.info.
#
# Maintainer : Blockchain.info
# Maintainer URL : https://blockchain.info/en/connected-nodes
# List source URL : https://blockchain.info/en/connected-nodes
# Source File Date: Sun Nov 20 05:56:30 UTC 2016
#
# Category : organizations
# Version : 23789
#
# This File Date : Sun Nov 20 05:56:30 UTC 2016
# Update Frequency: 10 mins
# Aggregation : none
# Entries : 175 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bitcoin_blockchain_info
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
0.9.99.99
5.39.93.85
5.95.80.47
5.102.226.119
5.135.153.199
5.135.182.69
5.135.186.15
5.189.53.123
5.189.167.10
18.248.7.50
23.92.17.46
23.94.247.207
23.95.117.72
27.0.235.33
31.172.85.47
35.160.244.153
35.161.158.175
37.1.207.72
37.59.131.237
37.135.212.47
37.247.116.52
38.132.60.17
40.114.81.178
40.126.253.180
45.30.30.203
45.32.6.246
45.62.208.65
45.76.3.39
46.4.33.87
46.4.69.182
46.4.101.137
46.148.16.202
46.165.220.71
46.229.165.138
46.229.165.142
46.229.238.187
47.89.51.25
47.90.54.25
47.90.89.90
50.35.14.95
50.116.59.118
52.16.252.109
52.38.34.47
52.71.232.100
52.197.222.95
52.198.222.227
60.240.106.142
62.107.200.30
62.138.1.95
62.143.28.67
62.210.253.10
63.137.40.207
64.140.125.98
65.60.154.126
66.194.38.253
67.205.131.188
67.205.139.55
67.205.175.177
68.48.94.39
75.77.157.146
75.165.7.189
77.81.191.182
80.56.36.186
80.100.203.151
80.109.200.11
80.216.108.108
82.118.242.3
82.134.66.146
82.200.204.41
83.143.130.19
83.149.125.77
84.200.84.195
85.25.195.161
86.170.80.99
86.175.59.93
87.239.250.158
88.99.23.83
88.198.53.194
90.191.230.132
91.121.25.211
91.212.182.90
92.211.216.34
93.93.135.12
93.104.211.184
93.190.149.3
95.211.194.178
99.252.185.182
104.131.192.94
104.199.124.103
104.223.226.165
107.6.174.164
107.151.144.103
108.24.1.104
108.26.148.98
108.172.155.68
109.148.188.179
109.236.92.189
109.255.80.58
110.10.129.33
116.125.120.26
116.126.142.195
123.56.127.135
128.30.92.69
130.185.109.17
131.113.41.121
131.114.72.104
134.213.214.233
136.62.18.221
138.68.25.66
138.68.57.233
138.197.200.81
138.201.152.22
139.196.137.202
139.224.129.158
142.4.213.138
142.227.120.102
148.251.3.170
148.251.82.174
149.202.76.216
149.202.128.97
149.202.182.234
149.202.194.114
150.162.34.100
155.133.43.249
159.203.7.235
162.254.148.162
162.255.116.25
163.172.81.165
163.172.218.37
167.114.174.180
169.239.129.125
173.11.90.100
175.126.62.11
175.137.43.147
176.9.152.42
176.36.37.62
176.58.96.62
176.99.4.144
178.8.34.44
178.63.18.3
178.63.47.71
178.254.37.97
180.151.85.195
185.21.216.148
185.86.79.87
185.121.173.223
185.141.24.139
188.40.51.68
188.165.209.148
189.45.203.166
192.241.158.203
192.254.76.218
193.10.64.85
193.239.80.155
194.24.182.27
194.63.140.208
194.109.20.68
195.91.176.86
198.27.80.191
198.57.171.39
202.171.212.16
204.15.11.4
208.94.245.18
209.11.180.182
210.50.229.138
212.175.19.108
213.5.36.58
213.136.75.142
216.151.13.77
216.158.225.70
217.23.15.77
218.38.19.7
220.233.178.100
220.245.57.191
221.121.221.2

224
bitcoin_blockchain_info_1d.ipset Normal file
View File

@ -0,0 +1,224 @@
#
# bitcoin_blockchain_info_1d
#
# ipv4 hash:ip ipset
#
# [Blockchain.info]
# (https://blockchain.info/en/connected-nodes) Bitcoin nodes
# connected to Blockchain.info.
#
# Maintainer : Blockchain.info
# Maintainer URL : https://blockchain.info/en/connected-nodes
# List source URL : https://blockchain.info/en/connected-nodes
# Source File Date: Sun Nov 20 04:56:32 UTC 2016
#
# Category : organizations
# Version : 18409
#
# This File Date : Sun Nov 20 04:56:32 UTC 2016
# Update Frequency: 10 mins
# Aggregation : 1 day
# Entries : 193 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bitcoin_blockchain_info_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
0.9.99.99
2.26.46.221
5.39.93.85
5.95.80.47
5.102.226.119
5.135.153.199
5.135.182.69
5.135.186.15
5.189.53.123
5.189.167.10
18.248.7.50
23.92.17.46
23.94.247.207
23.95.117.72
27.0.235.33
31.172.85.47
35.160.244.153
35.161.158.175
37.1.207.72
37.59.131.237
37.135.212.47
37.247.116.52
38.132.60.17
40.114.81.178
40.126.253.180
45.30.30.203
45.32.6.246
45.62.208.65
45.76.3.39
46.4.33.87
46.4.69.182
46.4.101.137
46.148.16.202
46.165.220.71
46.229.165.138
46.229.165.142
46.229.238.187
47.89.51.25
47.90.54.25
47.90.89.90
50.35.14.95
50.116.59.118
52.16.252.109
52.38.34.47
52.45.23.237
52.71.232.100
52.197.222.95
52.198.222.227
54.212.241.38
60.240.106.142
62.107.200.30
62.138.1.95
62.143.28.67
62.210.253.10
63.137.40.207
64.140.125.98
65.60.154.126
66.194.38.253
67.205.131.188
67.205.139.55
67.205.175.177
68.48.94.39
75.77.157.146
75.165.7.189
77.81.191.182
80.56.36.186
80.100.203.151
80.109.200.11
80.216.108.108
81.7.10.32
81.155.251.247
82.118.242.3
82.134.66.146
82.200.204.41
83.143.130.19
83.149.125.77
84.111.23.225
84.200.84.195
85.25.195.161
86.170.80.99
86.175.59.93
87.239.250.158
88.99.23.83
88.198.53.194
88.202.202.221
89.163.224.94
90.191.230.132
91.121.25.211
91.212.182.90
92.211.216.34
93.93.135.12
93.104.211.184
93.190.149.3
95.211.194.178
99.252.185.182
100.15.114.3
104.131.192.94
104.199.124.103
104.223.226.165
107.6.174.164
107.151.144.103
108.24.1.104
108.26.148.98
108.172.155.68
109.108.17.180
109.148.188.179
109.236.92.189
109.255.80.58
110.10.129.33
116.125.120.26
116.126.142.195
123.56.127.135
128.30.92.69
130.185.109.17
131.72.136.238
131.113.41.121
131.114.72.104
134.213.214.233
136.62.18.221
137.226.34.46
138.68.25.66
138.68.57.233
138.68.79.27
138.197.200.81
138.201.152.22
139.59.155.65
139.59.209.199
139.196.137.202
139.224.129.158
142.4.213.138
142.227.120.102
148.251.3.170
148.251.82.174
149.56.19.79
149.202.76.216
149.202.128.97
149.202.182.234
149.202.194.114
150.162.34.100
155.133.43.249
159.203.7.235
162.254.148.162
162.255.116.25
163.172.81.165
163.172.218.37
167.114.174.180
169.239.129.125
173.11.90.100
175.126.62.11
175.137.43.147
176.9.152.42
176.36.37.62
176.58.96.62
176.99.4.144
178.8.34.44
178.63.18.3
178.63.47.71
178.254.37.97
180.151.85.195
185.21.216.148
185.86.79.87
185.121.173.223
185.141.24.139
188.40.51.68
188.165.209.148
189.45.203.166
192.241.158.203
192.254.76.218
193.10.64.85
193.239.80.155
194.24.182.27
194.63.140.208
194.109.20.68
195.91.176.86
198.27.80.191
198.57.171.39
202.171.212.16
204.15.11.4
207.172.191.43
208.94.245.18
209.11.180.182
210.50.229.138
212.175.19.108
213.5.36.58
213.136.75.142
213.144.156.27
216.151.13.77
216.158.225.70
217.23.15.77
218.38.19.7
220.233.178.100
220.245.57.191
221.121.221.2

4448
bitcoin_blockchain_info_30d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

1819
bitcoin_blockchain_info_7d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

4260
bitcoin_nodes.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

5370
bitcoin_nodes_1d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

21268
bitcoin_nodes_30d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

9036
bitcoin_nodes_7d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

25440
blocklist_de.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

9515
blocklist_de_apache.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

1854
blocklist_de_bots.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

290
blocklist_de_bruteforce.ipset Normal file
View File

@ -0,0 +1,290 @@
#
# blocklist_de_bruteforce
#
# ipv4 hash:ip ipset
#
# [Blocklist.de] (https://www.blocklist.de/) All IPs which
# attacks Joomlas, Wordpress and other Web-Logins with
# Brute-Force Logins.
#
# Maintainer : Blocklist.de
# Maintainer URL : https://www.blocklist.de/
# List source URL : http://lists.blocklist.de/lists/bruteforcelogin.txt
# Source File Date: Sun Nov 20 06:22:11 UTC 2016
#
# Category : attacks
# Version : 22868
#
# This File Date : Sun Nov 20 06:24:05 UTC 2016
# Update Frequency: 15 mins
# Aggregation : none
# Entries : 259 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=blocklist_de_bruteforce
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
2.134.246.197
5.34.244.36
5.53.21.49
5.135.179.227
31.7.63.198
31.25.89.55
31.31.196.27
31.184.194.91
31.193.2.210
31.210.44.122
37.9.170.173
37.18.103.4
37.57.42.201
37.59.55.8
37.187.42.181
37.187.44.93
37.230.100.146
38.113.115.111
38.123.253.180
42.96.177.34
43.224.249.139
43.252.229.93
45.59.162.69
45.59.162.97
45.64.113.156
46.148.16.114
46.148.17.90
46.172.91.180
46.172.91.184
46.174.64.105
46.183.221.136
50.28.63.121
50.62.166.89
50.62.208.132
51.255.15.247
51.255.84.18
52.9.85.171
52.15.123.82
52.24.12.226
54.84.222.170
54.254.209.118
61.31.89.198
61.195.97.18
62.75.145.142
62.210.162.31
62.210.201.58
64.20.37.67
65.51.149.67
66.85.144.242
67.225.216.141
67.227.178.247
69.54.32.80
72.29.127.50
77.244.145.250
79.141.166.15
79.177.219.142
80.82.64.127
80.82.70.141
81.17.22.186
81.177.174.58
81.213.92.4
82.102.11.123
82.118.24.207
83.111.209.196
83.223.124.24
85.17.250.196
85.214.200.25
86.49.191.165
88.149.156.110
88.198.46.46
88.253.218.42
89.19.27.75
89.248.160.204
91.108.73.59
91.121.45.184
91.121.155.12
91.134.248.253
91.200.12.33
91.200.12.42
91.200.12.47
91.200.12.76
91.200.12.81
91.200.12.91
91.200.12.93
91.200.12.132
91.210.145.3
91.210.146.152
92.222.7.217
92.222.21.28
93.76.229.208
93.190.179.241
94.23.2.109
94.177.246.133
94.229.164.48
95.110.188.195
96.126.110.96
97.74.238.54
98.232.51.240
103.195.239.137
103.229.127.42
104.148.15.15
104.154.50.31
104.160.2.188
104.160.5.123
104.198.253.0
106.75.61.212
107.161.188.74
108.162.212.58
108.162.222.177
108.175.3.248
109.86.115.198
109.123.108.28
109.236.81.237
111.204.81.20
112.78.206.32
112.175.184.13
113.160.142.47
115.28.212.181
115.64.49.32
119.59.107.214
120.24.190.242
120.27.31.148
120.27.37.74
120.27.100.100
120.27.114.224
120.76.176.146
121.83.250.38
122.155.167.124
124.124.197.72
134.249.141.24
140.117.150.103
141.101.81.80
142.54.189.164
146.88.26.88
149.202.37.250
149.202.161.158
149.202.239.100
158.69.192.169
158.69.194.232
158.199.246.1
160.202.163.124
162.13.103.14
162.144.75.189
162.212.172.214
162.212.174.47
162.212.175.150
162.219.248.151
162.254.116.14
163.172.115.17
163.172.129.10
163.172.143.0
163.172.160.205
163.172.161.136
166.62.126.163
167.114.215.14
168.144.155.109
172.98.77.111
173.208.177.59
173.208.240.66
173.245.53.197
177.153.1.57
178.33.151.52
178.162.211.213
178.210.174.19
179.106.40.194
180.97.215.97
180.210.201.15
182.50.142.89
184.170.152.101
185.11.240.175
185.22.186.152
185.51.65.231
185.93.182.148
185.119.174.138
185.129.249.218
185.169.229.55
186.64.122.216
186.202.120.6
186.202.120.146
186.202.161.80
188.40.30.104
188.165.224.207
190.183.58.215
191.96.249.80
192.99.2.101
192.99.62.51
192.99.200.65
192.169.136.97
192.169.245.171
192.217.105.101
193.169.56.242
195.74.38.149
195.154.112.72
195.154.189.208
195.154.191.64
195.154.194.192
195.154.199.56
195.154.199.66
195.154.199.101
195.154.199.140
195.154.199.145
195.154.199.154
195.154.230.160
195.154.232.138
195.154.235.96
195.154.235.105
195.154.236.233
195.154.237.108
195.154.240.170
195.154.240.176
195.154.240.246
195.154.241.119
195.154.241.120
195.154.241.153
195.154.241.166
195.154.250.118
195.154.250.180
195.154.250.216
195.154.250.248
195.154.251.120
198.12.152.96
198.12.153.222
198.20.236.153
198.27.66.170
198.52.180.146
198.52.180.230
198.57.161.211
198.100.47.168
198.245.63.130
199.15.233.162
199.15.233.176
199.96.129.110
200.58.116.78
202.9.109.181
202.69.36.212
202.112.49.247
202.218.6.14
203.122.59.236
203.138.185.208
205.154.44.207
205.186.157.192
207.7.94.54
207.58.169.235
207.210.200.107
209.87.149.42
209.91.177.11
209.141.57.87
210.209.123.231
212.47.231.34
212.129.44.203
213.144.187.85
213.251.182.105
213.251.182.110
213.251.182.111
213.251.182.115
216.189.150.174
217.71.228.116
217.199.223.23
223.130.6.136

4150
blocklist_de_ftp.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

1547
blocklist_de_imap.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

15222
blocklist_de_mail.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

173
blocklist_de_sip.ipset Normal file
View File

@ -0,0 +1,173 @@
#
# blocklist_de_sip
#
# ipv4 hash:ip ipset
#
# [Blocklist.de] (https://www.blocklist.de/) All IP addresses
# that tried to login in a SIP, VOIP or Asterisk Server and
# are included in the IPs list from infiltrated.net
#
# Maintainer : Blocklist.de
# Maintainer URL : https://www.blocklist.de/
# List source URL : http://lists.blocklist.de/lists/sip.txt
# Source File Date: Sun Nov 20 05:20:10 UTC 2016
#
# Category : attacks
# Version : 15094
#
# This File Date : Sun Nov 20 05:24:03 UTC 2016
# Update Frequency: 15 mins
# Aggregation : none
# Entries : 142 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=blocklist_de_sip
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.189.161.247
14.183.73.68
23.227.196.110
23.229.84.18
23.239.65.68
23.239.66.37
23.239.84.211
23.239.84.250
23.239.85.222
23.239.87.18
23.239.87.69
23.239.88.226
37.8.48.157
37.8.59.103
37.8.73.37
37.8.90.219
37.61.211.210
41.250.196.80
54.146.148.54
58.211.218.74
59.152.231.243
61.189.184.76
61.191.41.6
61.191.41.7
61.191.41.53
62.75.207.17
62.75.207.76
62.138.14.31
62.138.14.34
62.141.45.45
62.210.8.199
62.210.162.97
62.210.189.43
62.219.6.134
64.31.20.154
64.31.56.184
64.129.188.18
65.38.171.196
65.111.165.235
66.135.215.174
67.55.110.36
69.64.61.75
69.163.37.208
74.208.185.212
75.134.18.249
77.95.227.229
78.31.67.135
78.31.67.203
79.143.83.250
82.141.136.153
82.205.2.96
82.205.7.239
82.205.123.5
82.205.123.189
83.149.44.142
85.10.252.184
85.17.212.28
85.31.209.109
87.236.197.21
89.163.140.131
89.163.146.61
91.189.179.14
91.236.75.120
93.115.28.101
94.247.178.106
95.25.6.145
95.25.6.198
95.25.10.5
96.44.189.172
106.75.28.14
108.29.44.222
110.10.178.80
114.215.206.152
115.168.71.84
115.231.103.219
116.31.116.36
120.132.134.249
123.56.199.161
125.95.18.146
141.105.64.243
141.105.64.244
142.0.41.171
142.0.41.172
149.56.20.202
149.56.250.122
155.94.64.234
158.69.126.161
158.69.243.194
158.69.244.127
158.69.246.17
163.172.206.88
172.93.99.250
173.164.93.151
173.212.200.171
173.224.123.253
174.137.170.180
174.137.170.190
184.172.12.112
185.19.223.187
185.40.4.12
185.40.4.47
185.40.4.62
185.40.4.63
188.72.241.126
192.99.8.113
192.99.19.26
192.151.153.218
192.187.120.154
192.187.124.250
192.241.99.186
195.154.43.79
195.154.172.180
195.154.181.178
195.154.182.48
199.48.164.165
202.103.52.143
202.103.52.147
204.12.202.114
204.12.211.10
204.12.215.50
204.188.221.157
208.77.101.138
208.115.203.51
208.115.236.172
208.115.236.186
209.126.97.238
209.126.113.172
209.126.117.223
209.126.122.15
209.126.122.33
209.126.122.47
209.222.99.210
213.136.82.70
213.165.68.55
213.202.233.26
213.202.233.45
213.202.233.192
216.172.98.211
217.28.216.250
217.150.245.224
219.146.8.78
220.178.16.98

3243
blocklist_de_ssh.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

177
blocklist_de_strongips.ipset Normal file
View File

@ -0,0 +1,177 @@
#
# blocklist_de_strongips
#
# ipv4 hash:ip ipset
#
# [Blocklist.de] (https://www.blocklist.de/) All IPs which
# are older then 2 month and have more then 5.000 attacks.
#
# Maintainer : Blocklist.de
# Maintainer URL : https://www.blocklist.de/
# List source URL : http://lists.blocklist.de/lists/strongips.txt
# Source File Date: Sun Nov 20 05:05:20 UTC 2016
#
# Category : attacks
# Version : 5860
#
# This File Date : Sun Nov 20 05:16:05 UTC 2016
# Update Frequency: 15 mins
# Aggregation : none
# Entries : 147 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=blocklist_de_strongips
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
31.184.236.10
31.184.236.11
46.161.9.12
46.161.9.31
46.161.9.32
62.122.182.106
79.140.166.45
80.252.153.69
80.252.154.233
89.28.24.190
89.169.219.31
89.218.186.82
89.248.160.204
91.200.12.1
91.200.12.2
91.200.12.6
91.200.12.7
91.200.12.37
91.200.12.42
91.200.12.47
91.200.12.52
91.200.12.74
91.200.12.80
91.200.12.81
91.200.12.90
91.200.12.91
91.200.12.103
91.200.12.119
91.200.12.133
91.200.12.136
91.200.12.137
91.200.12.146
91.200.12.149
91.200.12.168
91.200.12.169
91.200.13.11
91.200.13.16
91.207.7.14
91.213.126.147
91.213.126.159
91.213.126.183
91.213.126.185
91.213.126.193
91.213.126.218
91.224.160.106
91.224.160.108
91.224.160.131
91.224.160.184
91.224.161.69
93.170.122.30
97.77.104.22
116.31.116.5
116.31.116.6
116.31.116.8
116.31.116.9
116.31.116.10
116.31.116.11
116.31.116.16
116.31.116.17
116.31.116.18
116.31.116.20
116.31.116.24
116.31.116.25
116.31.116.26
116.31.116.27
116.31.116.30
116.31.116.33
116.31.116.36
116.31.116.38
116.31.116.39
116.31.116.40
116.31.116.41
116.31.116.43
116.31.116.44
116.31.116.45
116.31.116.47
116.31.116.48
116.31.116.50
116.31.116.52
117.135.131.60
121.18.238.98
121.18.238.104
121.18.238.109
121.18.238.114
121.73.98.209
146.185.223.55
146.185.223.77
146.185.223.197
179.127.175.210
182.140.142.160
185.110.132.202
188.143.232.10
188.143.232.11
188.143.232.13
188.143.232.14
188.143.232.15
188.143.232.16
188.143.232.19
188.143.232.21
188.143.232.22
188.143.232.24
188.143.232.26
188.143.232.27
188.143.232.32
188.143.232.34
188.143.232.35
188.143.232.37
188.143.232.40
188.143.232.41
188.143.232.43
188.143.232.62
188.143.232.70
188.143.232.72
188.143.232.123
188.143.234.155
190.109.164.81
191.239.161.236
194.79.63.238
194.247.190.248
195.22.126.189
195.154.232.220
198.6.19.15
199.15.233.162
199.15.233.174
210.245.88.170
213.159.38.90
217.70.28.155
218.65.30.92
221.194.44.219
221.194.47.208
221.194.47.224
221.194.47.229
221.194.47.249
221.214.208.226
221.229.172.7
221.229.172.66
221.229.172.73
221.229.172.74
221.229.172.75
221.229.172.97
221.229.172.103
221.229.172.104
221.229.172.108
221.229.172.110
221.229.172.114
221.229.172.119
222.186.56.42

11652
blocklist_net_ua.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

6936
bm_tor.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

95
botscout.ipset Normal file
View File

@ -0,0 +1,95 @@
#
# botscout
#
# ipv4 hash:ip ipset
#
# [BotScout] (http://botscout.com/) helps prevent automated
# web scripts, known as bots, from registering on forums,
# polluting databases, spreading spam, and abusing forms on
# web sites. They do this by tracking the names, IPs, and
# email addresses that bots use and logging them as unique
# signatures for future reference. They also provide a simple
# yet powerful API that you can use to test forms when
# they're submitted on your site. This list is composed of
# the most recently-caught bots.
#
# Maintainer : BotScout.com
# Maintainer URL : http://botscout.com/
# List source URL : http://botscout.com/last_caught_cache.htm
# Source File Date: Sun Nov 20 06:01:16 UTC 2016
#
# Category : abuse
# Version : 16548
#
# This File Date : Sun Nov 20 06:01:16 UTC 2016
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 58 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=botscout
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.39.93.96
5.101.222.90
5.135.164.181
5.189.155.66
5.230.154.146
23.254.211.232
36.57.150.134
37.21.142.132
39.70.143.6
46.249.14.226
47.88.195.233
50.30.206.219
52.206.229.84
62.210.37.82
79.110.25.151
81.31.186.33
82.114.92.33
84.51.88.139
89.34.237.101
89.234.157.254
91.200.12.7
91.200.12.103
91.200.12.106
91.200.12.141
91.200.12.143
94.41.149.142
94.50.2.11
94.254.131.110
95.132.223.42
104.160.11.71
104.247.121.227
107.150.64.190
109.86.72.210
115.29.161.167
117.169.6.29
120.40.130.70
142.54.183.123
146.185.200.21
146.185.200.80
146.185.201.14
146.185.201.105
149.56.229.16
155.133.64.123
163.172.64.241
163.172.65.53
178.159.37.17
179.43.174.162
188.17.157.238
188.208.219.92
197.5.128.1
198.8.80.68
199.15.233.174
204.124.83.134
207.46.13.5
207.46.13.38
209.222.77.220
212.7.220.13
212.92.127.244

1073
botscout_1d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

12513
botscout_30d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

4264
botscout_7d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

367
botvrij_dst.ipset Normal file
View File

@ -0,0 +1,367 @@
#
# botvrij_dst
#
# ipv4 hash:ip ipset
#
# [botvrij.eu] (http://www.botvrij.eu/) Indicators of
# Compromise (IOCS) about malicious destination IPs, gathered
# via open source information feeds (blog pages and PDF
# documents) and then consolidated into different datasets.
# To ensure the quality of the data all entries older than
# approx. 6 months are removed.
#
# Maintainer : botvrij.eu
# Maintainer URL : http://www.botvrij.eu/
# List source URL : http://www.botvrij.eu/data/ioclist.ip-dst.raw
# Source File Date: Wed Nov 16 21:25:49 UTC 2016
#
# Category : attacks
# Version : 20
#
# This File Date : Thu Nov 17 19:40:04 UTC 2016
# Update Frequency: 1 day
# Aggregation : none
# Entries : 333 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=botvrij_dst
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.9.86.131
5.45.86.148
5.45.86.171
5.45.179.173
5.45.179.185
5.45.192.117
5.61.34.63
5.61.37.239
5.61.38.30
5.61.38.31
5.61.38.32
5.61.38.33
5.61.38.34
5.104.106.38
5.135.159.110
5.175.233.86
5.199.129.129
18.181.5.37
23.22.38.222
23.89.200.128
23.89.201.173
23.227.196.99
23.249.164.109
23.254.166.222
31.131.17.128
37.1.207.80
37.48.77.214
37.48.77.215
37.58.60.195
37.187.18.109
37.230.119.37
38.109.190.55
38.229.70.51
38.229.70.61
38.229.79.2
43.249.37.173
45.32.183.118
45.43.192.172
45.63.23.135
45.63.96.216
46.4.0.156
46.23.70.195
46.28.207.19
46.38.48.225
46.101.9.51
46.101.220.161
46.165.225.66
46.165.229.7
46.165.229.8
46.165.229.9
46.165.248.236
46.165.248.237
46.165.248.238
46.165.248.239
46.165.248.240
46.165.248.241
46.165.248.243
46.166.163.243
46.166.163.244
46.166.163.246
46.252.25.249
49.213.18.15
50.117.47.66
50.117.47.67
51.254.95.99
51.254.95.100
51.254.138.246
51.254.215.13
51.254.215.129
51.255.41.91
51.255.198.77
51.255.235.246
54.175.208.187
59.55.142.171
61.250.92.79
62.113.216.173
62.138.2.184
62.210.82.44
62.210.92.11
62.210.108.23
62.210.124.124
62.210.138.3
62.210.198.108
62.210.206.25
63.141.242.35
64.237.51.46
66.232.124.175
67.227.198.183
71.63.154.49
72.233.55.10
74.102.93.231
74.125.39.18
77.66.12.185
78.47.134.204
78.85.219.41
78.192.241.75
79.120.10.98
79.170.44.106
80.83.118.240
80.83.118.245
80.90.56.144
80.100.250.244
80.198.105.184
81.7.16.31
81.19.145.97
81.28.197.126
81.173.240.81
82.163.78.188
82.192.91.11
82.223.21.74
83.85.252.55
83.162.202.182
83.183.76.156
83.218.134.237
85.93.0.33
85.93.0.72
85.186.125.217
85.214.151.72
86.55.7.54
86.59.21.38
87.98.153.34
87.98.162.251
87.118.114.134
87.236.210.109
87.236.210.116
88.198.192.156
88.198.222.163
89.32.40.220
89.163.209.233
89.163.235.163
91.121.23.100
91.121.195.169
91.207.60.68
91.228.146.11
91.228.146.12
91.228.146.13
91.229.79.181
91.229.79.182
91.229.79.183
91.229.79.184
91.229.79.185
91.229.79.186
91.229.79.187
91.229.79.188
91.229.79.189
91.229.79.190
92.215.45.94
92.222.204.96
93.115.95.132
94.140.120.133
94.242.58.51
94.242.219.203
94.242.223.19
94.242.223.20
94.242.223.24
94.242.223.28
94.242.231.244
95.65.95.61
95.85.12.179
95.141.34.242
95.141.34.245
95.141.34.246
95.141.83.146
95.183.52.215
95.211.3.135
95.211.22.199
95.211.58.238
95.211.205.142
95.211.205.161
95.211.205.163
95.211.205.164
95.211.205.165
95.211.205.166
95.211.216.9
95.215.44.136
95.215.45.64
95.215.45.69
95.215.45.90
95.215.45.98
95.215.45.228
95.215.46.2
95.215.46.32
95.215.46.76
98.129.249.174
103.39.78.131
103.229.124.1
104.156.240.212
104.232.35.136
104.233.89.76
104.238.185.187
104.250.153.57
107.181.246.211
107.181.250.221
107.191.61.105
108.61.57.43
109.104.12.92
109.120.180.245
109.126.13.110
112.213.117.52
116.251.210.77
116.251.216.72
116.251.216.165
116.251.216.227
116.251.219.142
117.17.10.10
128.177.144.59
130.185.133.10
130.193.15.186
134.19.177.109
134.119.36.135
136.243.187.165
136.243.209.52
136.243.214.137
141.0.21.242
144.2.118.84
144.168.45.128
145.220.0.15
146.71.104.123
148.251.68.100
148.251.100.168
148.251.190.229
149.202.49.87
151.80.8.10
151.236.14.53
151.236.14.149
154.35.32.5
158.58.170.27
162.212.105.78
162.243.119.52
163.172.7.30
163.172.27.62
163.172.35.115
163.172.35.247
163.172.133.36
163.172.135.172
167.114.237.140
172.28.202.31
176.9.50.119
176.31.220.160
176.158.132.12
178.32.44.157
178.62.93.36
178.62.199.226
178.63.140.246
178.162.210.242
178.162.210.243
178.162.210.244
178.162.210.245
178.162.210.246
178.162.210.247
178.162.210.248
178.162.236.40
178.209.51.164
178.209.52.72
178.254.2.89
178.254.13.126
178.254.40.5
179.43.133.34
184.22.81.68
185.29.9.28
185.32.160.22
185.60.146.221
185.68.16.35
185.82.21.188
185.86.107.131
185.86.149.60
185.86.149.115
185.100.84.175
185.117.75.219
185.130.5.201
185.130.5.202
185.130.104.131
186.106.120.113
188.0.236.7
188.40.51.232
188.40.109.146
188.138.68.191
188.138.69.136
188.165.0.171
188.165.26.13
188.166.35.67
188.166.37.108
188.166.133.133
188.226.200.216
190.82.81.132
191.101.31.6
192.42.113.102
192.42.116.161
192.87.28.82
192.99.14.211
192.157.229.164
192.169.82.86
193.11.114.43
193.11.164.243
194.146.180.58
194.150.168.74
195.154.42.18
195.154.43.52
195.154.73.212
195.154.91.139
195.154.164.243
195.154.251.25
198.23.210.156
198.27.119.92
198.98.103.7
207.182.98.21
208.80.154.39
208.167.254.234
209.51.131.190
209.222.8.196
210.245.85.83
212.47.229.138
212.47.237.95
212.47.239.83
212.51.128.44
212.51.156.173
212.51.159.86
212.112.245.170
212.129.7.146
212.129.13.110
212.129.42.9
213.136.81.89
213.163.70.234
213.239.216.222
216.155.131.74
216.170.116.120
217.12.210.207
217.12.210.214
217.79.178.60
217.79.179.177
217.103.164.150
217.160.126.50
220.130.157.99

34
botvrij_src.ipset Normal file
View File

@ -0,0 +1,34 @@
#
# botvrij_src
#
# ipv4 hash:ip ipset
#
# [botvrij.eu] (http://www.botvrij.eu/) Indicators of
# Compromise (IOCS) about malicious source IPs, gathered via
# open source information feeds (blog pages and PDF
# documents) and then consolidated into different datasets.
# To ensure the quality of the data all entries older than
# approx. 6 months are removed.
#
# Maintainer : botvrij.eu
# Maintainer URL : http://www.botvrij.eu/
# List source URL : http://www.botvrij.eu/data/ioclist.ip-src.raw
# Source File Date: Wed Apr 13 20:47:49 UTC 2016
#
# Category : attacks
# Version : 1
#
# This File Date : Tue Apr 19 21:03:41 UTC 2016
# Update Frequency: 1 day
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=botvrij_src
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

1442
bruteforceblocker.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

5356
chaosreigns_iprep0.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

5356
chaosreigns_iprep100.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

5356
chaosreigns_iprep50.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

12337
ciarmy.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

3871
cidr_report_bogons.netset Normal file
View File

File diff suppressed because it is too large Load Diff

4549
cleanmx_phishing.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

12221
cleanmx_viruses.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

2961
cleantalk.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

7467
cleantalk_1d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

68023
cleantalk_30d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

20472
cleantalk_7d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

960
cleantalk_new.ipset Normal file
View File

@ -0,0 +1,960 @@
#
# cleantalk_new
#
# ipv4 hash:ip ipset
#
# [CleanTalk] (https://cleantalk.org/) Recent HTTP Spammers
#
# Maintainer : CleanTalk
# Maintainer URL : https://cleantalk.org/
# List source URL : https://cleantalk.org/blacklists/submited_today
# Source File Date: Sun Nov 20 06:16:46 UTC 2016
#
# Category : abuse
# Version : 28914
#
# This File Date : Sun Nov 20 06:16:46 UTC 2016
# Update Frequency: 15 mins
# Aggregation : none
# Entries : 931 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=cleantalk_new
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.1.165.229
1.4.155.14
1.4.181.120
1.10.218.141
1.20.90.115
1.20.90.149
1.20.173.193
1.54.214.157
1.55.40.70
1.62.117.208
1.163.224.81
1.163.244.142
1.173.157.66
1.205.231.126
1.225.183.37
2.132.80.108
2.187.46.238
5.3.215.228
5.9.138.13
5.34.95.154
5.36.24.142
5.60.243.165
5.78.185.27
5.100.73.165
5.102.195.107
5.135.147.246
5.136.218.93
5.141.91.5
5.141.193.214
5.141.203.250
5.141.232.6
5.151.168.40
5.151.179.80
5.151.221.248
5.164.199.56
5.164.199.237
5.164.207.167
5.164.254.147
5.166.200.101
5.166.239.123
5.220.251.14
5.239.47.1
14.28.61.238
14.28.62.153
14.106.229.213
14.162.1.7
14.162.188.115
14.162.255.0
14.167.39.189
14.169.2.211
14.170.87.69
14.174.37.236
14.181.246.15
14.184.237.126
14.185.90.79
14.187.92.54
23.88.102.171
23.88.134.90
23.92.116.154
23.95.184.161
23.236.210.186
23.245.152.108
23.245.153.120
24.21.149.134
24.202.153.33
27.2.126.244
27.2.127.171
27.18.145.4
27.48.81.104
27.145.136.231
31.23.84.93
31.170.169.177
31.173.85.63
31.180.79.253
31.184.194.91
31.200.233.38
31.223.133.162
36.57.150.134
36.66.38.186
36.70.26.93
36.71.147.68
36.71.193.121
36.71.232.30
36.72.169.77
36.72.253.119
36.73.31.165
36.73.162.126
36.73.165.0
36.74.21.236
36.74.210.215
36.75.42.123
36.75.131.221
36.76.149.233
36.77.130.239
36.79.95.14
36.80.161.92
36.80.196.196
36.81.32.36
36.81.187.53
36.82.181.94
36.82.184.51
36.85.108.253
36.85.224.202
36.224.108.143
37.21.142.132
37.45.130.232
37.45.226.29
37.47.15.90
37.52.196.72
37.113.161.161
37.115.138.49
37.146.122.63
37.146.127.199
37.190.87.219
37.212.210.154
37.214.136.171
37.215.53.214
37.215.116.244
37.218.179.196
37.238.118.9
39.33.180.119
39.36.103.161
39.36.216.79
39.44.134.165
39.49.177.60
39.69.192.116
39.72.114.166
39.88.121.229
39.88.154.173
39.148.156.69
41.34.143.220
41.46.250.108
41.47.83.57
41.96.60.162
41.96.182.5
41.101.255.165
41.105.141.58
41.109.53.214
41.140.163.34
41.199.8.201
41.199.156.65
41.210.7.143
41.225.159.114
41.225.213.235
41.233.204.151
41.251.93.192
42.112.158.167
42.113.69.48
42.113.152.227
42.113.207.243
42.114.18.160
42.117.69.162
42.119.5.226
42.119.25.94
42.119.35.93
42.201.223.39
43.241.144.3
45.32.1.114
45.57.218.115
45.59.152.121
45.241.149.149
45.244.33.120
46.0.84.3
46.0.106.192
46.2.41.185
46.59.15.167
46.61.75.19
46.61.79.227
46.70.116.169
46.98.83.86
46.98.169.140
46.99.46.45
46.99.69.146
46.99.103.173
46.101.109.30
46.143.166.3
46.146.0.126
46.148.112.86
46.148.120.15
46.148.120.42
46.148.120.183
46.176.7.51
46.188.125.231
46.191.170.194
46.191.214.174
46.224.32.115
47.90.61.190
49.48.244.85
49.48.244.242
49.48.247.56
49.49.122.243
49.49.240.200
49.69.156.18
49.73.114.132
49.82.115.28
49.140.219.236
49.158.3.91
49.205.77.0
49.213.57.160
49.228.227.179
49.228.240.126
49.228.244.91
50.18.219.204
50.92.179.92
51.36.15.39
51.39.78.120
51.39.243.21
51.175.211.158
51.235.11.223
52.77.30.246
58.8.172.228
58.8.173.63
58.11.88.100
58.18.202.88
58.23.9.66
58.186.197.64
58.187.86.172
58.187.172.228
58.187.193.204
58.209.98.146
59.41.236.28
59.51.38.136
59.54.215.123
59.58.145.68
59.91.193.217
60.19.5.188
61.162.99.228
61.231.188.24
62.96.213.133
62.106.115.193
62.183.124.219
62.183.125.81
62.183.125.118
62.201.210.246
62.221.87.241
63.225.203.10
64.56.25.185
64.137.191.188
64.137.254.143
67.71.10.193
67.197.252.250
68.5.95.149
68.11.173.245
68.104.217.11
68.189.56.188
68.193.154.105
69.61.127.77
70.30.217.71
70.121.71.166
70.176.242.127
71.15.21.27
71.231.191.192
73.95.68.234
73.110.42.30
73.110.45.194
73.114.32.125
76.71.28.192
76.170.169.108
77.51.155.215
77.53.37.247
77.79.129.157
77.79.189.91
77.125.66.161
77.126.48.218
77.126.68.166
77.127.65.129
77.177.201.203
77.181.57.249
77.189.61.1
77.234.73.60
78.9.143.151
78.85.73.51
78.85.73.95
78.88.30.253
78.115.49.116
78.141.65.75
78.151.168.183
78.163.169.18
78.172.158.82
78.178.127.72
79.103.53.85
79.103.64.124
79.106.209.89
79.117.34.234
79.131.8.147
79.136.225.61
80.12.37.112
80.156.57.124
80.156.57.137
80.242.101.163
81.100.22.173
81.156.38.214
81.177.126.220
82.79.114.192
82.165.73.111
83.25.157.34
83.27.78.10
83.29.9.226
83.149.37.61
83.203.52.251
83.209.25.14
83.209.168.195
83.237.7.202
84.13.123.118
84.15.187.230
84.133.46.85
84.147.64.11
84.238.58.243
85.24.217.61
85.72.155.1
85.92.250.195
85.140.7.70
85.190.230.19
85.190.230.167
86.100.220.12
86.106.25.75
86.108.54.71
86.108.116.98
86.126.38.30
87.92.119.249
87.109.213.238
87.180.230.117
87.246.154.237
88.3.228.172
88.6.134.223
88.81.50.180
88.112.224.204
88.240.14.220
89.32.70.43
89.106.198.125
89.235.244.192
90.154.70.76
91.21.227.252
91.152.104.92
91.246.67.201
92.53.0.114
92.220.98.66
92.244.236.84
93.80.16.168
93.84.28.21
93.84.253.30
93.85.146.228
93.85.163.50
93.86.36.253
93.87.220.198
93.125.88.199
93.125.90.100
93.142.8.65
93.142.235.243
93.143.183.56
94.25.171.172
94.25.173.107
94.41.149.142
94.50.2.11
94.175.120.188
94.178.83.199
94.228.231.150
94.241.219.34
94.249.4.244
95.26.54.236
95.29.64.214
95.72.114.150
95.73.106.130
95.73.146.138
95.73.230.166
95.79.90.50
95.79.95.234
95.79.121.86
95.79.170.11
95.79.212.112
95.104.223.247
95.107.27.141
95.137.210.25
95.156.191.122
95.174.121.45
95.186.100.216
96.9.248.134
96.63.208.129
96.234.43.134
96.245.67.183
99.92.228.220
100.11.145.167
101.18.189.127
101.31.231.1
101.51.138.164
101.67.123.226
101.109.64.252
101.109.81.183
101.109.103.200
101.109.105.240
101.109.110.27
101.109.129.31
101.109.129.169
101.109.184.79
101.109.192.9
101.204.8.152
103.2.234.22
103.15.217.39
103.63.158.29
103.240.97.6
104.129.8.134
104.129.11.132
104.129.11.244
104.129.12.211
104.129.63.119
104.140.208.199
104.144.53.83
104.144.225.233
104.168.95.86
104.203.19.171
104.223.23.40
104.227.21.234
104.227.58.52
104.227.185.31
104.227.185.97
104.238.32.20
104.238.153.87
104.238.181.6
105.102.70.155
105.102.141.238
105.105.10.112
105.107.33.55
105.110.86.6
105.156.119.28
105.157.233.90
105.228.235.236
106.32.162.249
106.51.232.176
106.185.42.107
107.150.73.101
107.152.151.2
107.152.243.83
107.172.238.166
107.172.241.101
107.172.241.110
107.173.4.226
107.173.173.38
107.174.140.252
107.174.142.75
107.175.38.173
107.175.39.143
107.175.79.229
107.183.39.137
107.203.176.140
107.210.214.242
109.67.51.59
109.92.189.91
109.98.160.235
109.120.5.189
109.129.198.232
109.163.152.42
109.165.4.37
109.169.71.121
109.175.59.42
109.175.106.43
110.72.237.235
110.74.200.207
110.77.228.54
110.84.156.166
110.90.81.161
110.137.146.139
110.155.117.82
110.168.7.40
110.244.222.107
110.249.235.104
111.0.228.35
111.85.58.8
111.85.60.159
111.85.61.230
111.196.171.3
111.248.131.123
111.249.162.24
111.252.193.63
111.252.218.78
111.253.74.235
111.254.179.126
111.254.190.16
112.20.32.12
112.28.174.139
112.83.171.57
112.134.81.46
112.195.192.192
112.196.156.142
112.196.180.177
112.197.35.53
112.197.82.180
112.203.191.9
112.210.166.42
112.215.154.48
112.215.172.4
112.228.218.219
112.230.38.228
112.230.100.160
112.238.25.36
112.240.145.181
112.241.25.228
112.243.106.142
112.244.200.197
112.248.101.25
112.249.63.222
112.251.112.122
113.20.118.139
113.22.9.97
113.53.56.146
113.53.58.120
113.53.120.186
113.66.40.159
113.119.151.1
113.162.196.115
113.166.87.220
113.167.158.227
113.170.242.232
113.171.141.129
113.172.103.67
113.174.214.52
113.174.248.177
113.175.224.168
113.177.62.67
113.179.9.9
113.179.68.100
113.184.116.215
113.186.54.9
113.225.218.206
113.230.38.3
113.230.98.15
113.237.156.225
113.238.243.70
113.254.242.232
114.32.32.234
114.40.179.105
114.40.180.247
114.40.181.146
114.47.227.196
114.121.233.106
114.139.219.206
114.143.43.132
114.231.66.33
114.234.235.42
114.241.33.38
115.59.116.67
115.72.128.177
115.79.152.232
115.87.242.121
115.178.216.58
115.198.220.44
115.214.236.239
116.58.249.248
116.99.174.96
116.100.216.30
116.101.1.101
116.108.30.226
116.108.60.213
116.109.27.115
116.109.69.65
116.109.186.127
116.253.181.67
117.2.242.40
117.25.121.143
117.144.180.6
117.198.59.42
117.207.244.192
117.215.168.213
117.248.89.28
117.248.91.136
117.253.99.218
118.77.69.105
118.101.111.74
118.136.7.131
118.171.80.10
118.171.94.104
118.173.106.118
118.173.108.115
118.173.109.83
118.174.228.253
118.175.133.221
118.175.221.128
118.175.233.40
118.175.233.194
118.178.136.187
119.39.98.201
119.42.122.217
119.62.229.41
119.76.5.112
119.76.124.171
119.76.129.161
119.86.28.123
119.164.101.24
119.180.73.201
119.186.3.221
119.186.179.188
119.249.252.39
120.25.79.11
121.34.254.16
121.101.93.248
121.196.193.141
121.205.226.213
121.237.107.89
122.53.242.105
122.170.179.12
122.174.43.143
122.177.203.75
123.16.161.221
123.17.100.179
123.22.242.141
123.114.101.218
123.172.119.133
123.172.119.194
123.201.175.11
124.82.59.137
124.94.164.239
124.121.139.60
124.122.130.125
124.135.33.181
124.166.85.120
124.167.168.181
124.197.122.250
124.228.190.197
124.228.214.183
125.26.86.77
125.26.237.31
125.27.20.25
125.27.22.159
125.27.82.158
125.27.84.226
125.27.107.253
125.44.159.86
125.92.232.10
125.93.149.83
125.107.66.21
125.107.68.5
125.111.147.110
125.161.34.236
125.164.134.63
128.68.23.245
128.199.67.65
128.204.57.73
129.21.40.139
130.237.37.74
131.0.121.5
131.191.114.227
132.148.81.65
133.242.54.221
136.169.156.82
138.0.239.72
138.36.242.64
138.68.97.168
138.68.160.99
138.117.71.146
138.128.11.66
139.162.210.133
139.192.137.42
139.195.58.128
139.195.221.50
142.54.189.218
144.76.84.47
148.0.144.192
148.0.152.181
148.0.181.122
149.36.1.16
149.36.1.167
149.36.1.203
151.42.56.181
151.242.9.194
151.249.140.134
154.110.67.54
154.241.124.91
156.196.204.14
156.202.75.3
156.204.199.253
156.208.138.119
156.212.149.103
156.212.162.109
156.212.194.103
156.213.204.188
156.218.73.236
158.181.40.218
158.181.43.113
159.0.130.39
159.203.119.133
159.205.222.3
165.231.83.48
165.255.75.216
166.88.123.24
170.84.8.174
171.4.237.169
171.5.249.179
171.96.190.225
171.97.75.26
171.97.75.38
171.97.156.116
171.126.187.54
171.233.117.82
171.246.6.187
171.247.124.165
171.248.111.78
172.18.66.5
172.82.169.218
172.103.106.209
172.103.111.191
172.245.195.230
172.246.253.160
173.19.40.124
173.44.55.204
173.208.196.186
174.2.90.21
175.19.43.246
175.23.5.151
175.23.7.109
175.138.105.178
175.140.174.77
175.142.42.251
175.143.156.52
175.145.181.112
175.154.236.186
176.62.123.5
176.109.177.131
176.109.234.37
176.109.246.201
176.119.115.236
176.195.151.252
176.210.3.254
176.213.188.212
176.215.61.80
176.216.14.182
177.185.192.110
177.207.11.38
178.18.104.37
178.44.244.90
178.94.230.195
178.95.148.35
178.120.160.223
178.120.192.146
178.121.78.202
178.121.108.199
178.121.209.111
178.125.45.162
178.125.71.32
178.125.78.128
178.125.245.225
178.137.81.234
178.155.5.46
178.167.7.242
178.175.43.134
178.175.169.9
178.175.169.13
178.183.132.198
178.187.16.153
178.187.64.205
178.215.177.146
178.220.130.251
178.220.153.248
178.254.211.167
179.7.103.204
179.7.142.44
179.181.140.250
180.108.253.169
180.111.249.212
180.164.31.222
180.180.10.5
180.180.10.66
180.180.11.112
180.180.14.47
180.180.151.59
180.180.208.123
180.183.64.130
180.183.119.103
180.191.130.104
180.242.20.149
180.245.112.111
180.245.180.67
180.246.72.16
180.248.68.218
180.252.101.116
180.253.35.15
180.253.99.140
180.253.245.33
180.254.140.38
180.254.206.227
181.44.48.119
182.52.155.243
182.53.200.125
182.53.246.4
182.91.91.9
182.114.64.195
182.117.84.184
182.117.122.5
182.126.69.236
182.139.185.249
182.183.156.231
182.186.103.208
182.187.71.64
182.201.69.136
183.31.31.244
183.81.9.196
183.89.41.216
183.89.44.170
183.89.54.47
183.144.30.104
183.145.2.133
183.145.9.245
183.145.81.24
183.190.14.82
184.75.240.252
185.5.60.194
185.23.48.125
185.35.64.64
185.36.69.238
185.41.171.161
185.53.131.220
185.81.158.137
185.127.218.157
185.139.236.59
185.169.232.55
185.169.232.66
185.169.232.120
185.169.232.125
185.169.232.239
186.27.212.112
186.124.204.147
186.220.154.62
187.132.101.153
187.210.121.214
187.255.99.126
188.53.162.192
188.53.162.219
188.68.214.134
188.68.221.129
188.72.108.156
188.163.75.50
188.168.244.42
188.170.200.219
188.186.63.13
189.49.177.253
189.55.204.99
189.115.82.7
189.233.197.144
190.166.157.17
191.101.115.136
191.101.115.155
191.101.115.171
191.101.115.192
191.101.123.163
191.101.123.225
191.103.118.249
191.188.112.92
192.80.190.216
192.126.154.40
192.126.154.53
192.126.154.249
192.126.167.25
192.126.167.192
192.157.227.237
192.186.139.246
192.187.100.138
192.198.124.222
192.210.165.78
193.201.225.188
194.135.163.16
195.5.26.110
196.196.90.47
197.0.239.229
197.1.153.80
197.3.214.90
197.15.249.167
197.27.44.53
197.27.122.243
197.32.139.200
197.34.157.140
197.49.59.247
197.119.30.87
197.157.0.22
197.226.143.139
197.229.224.148
197.246.38.251
198.12.90.177
198.12.152.136
198.46.214.71
198.147.27.239
199.195.171.72
200.90.92.124
200.96.235.215
200.115.247.12
201.8.129.177
201.47.181.12
201.208.228.149
202.29.214.90
202.62.18.82
202.80.219.139
202.142.90.52
202.166.79.131
202.179.25.99
209.107.196.169
209.216.220.52
212.35.174.34
212.129.44.184
216.106.72.112
216.212.252.87
217.17.231.66
217.91.64.78
217.103.110.38
217.231.54.2
218.9.123.246
219.92.107.219
219.129.192.76
219.136.71.42
220.137.137.159
220.142.188.217
220.142.200.200
220.142.205.215
220.187.152.137
221.182.248.204
221.193.17.58
221.204.101.165
221.206.183.19
221.207.135.53
221.208.135.176
221.212.65.230
222.135.65.130
222.141.232.232
222.154.30.207
222.161.52.2
222.187.186.143
222.253.235.235
223.24.59.73
223.67.149.6
223.72.138.12
223.114.192.150
223.150.220.185
223.158.11.147
223.204.250.187
223.206.111.166

Some files were not shown because too many files have changed in this diff Show More