Fri Sep 3 10:28:53 UTC 2021 update

This commit is contained in:
Costa Tsaousis 2021-08-29 06:32:45 +01:00
commit abb6cc7be2
1349 changed files with 8841533 additions and 0 deletions

106
.gitignore vendored Normal file
View File

@ -0,0 +1,106 @@
bogons.netset
.cache
.cache.old
dragon_http.netset
dragon_*.ipset
dragon_*.netset
dragon_sshpauth.netset
dragon_vncprobe.netset
dronebl_anonymizers.netset
dronebl_auto_botnets.netset
dronebl_autorooting_worms.netset
dronebl_compromised.netset
dronebl_ddos_drones.netset
dronebl_dns_mx_on_irc.netset
dronebl_*.ipset
dronebl_irc_drones.netset
dronebl_*.netset
dronebl_unknown.netset
dronebl_worms_bots.netset
errors/
fullbogons.netset
history/
ib_*.ipset
iblocklist_ads.netset
iblocklist_ads.*set
iblocklist_badpeers.ipset
iblocklist_badpeers.*set
iblocklist_bogons.netset
iblocklist_bogons.*set
iblocklist_dshield.netset
iblocklist_dshield.*set
iblocklist_edu.netset
iblocklist_edu.*set
iblocklist_exclusions.netset
iblocklist_exclusions.*set
iblocklist_fornonlancomputers.netset
iblocklist_fornonlancomputers.*set
iblocklist_forumspam.netset
iblocklist_forumspam.*set
iblocklist_hijacked.netset
iblocklist_hijacked.*set
iblocklist_iana_multicast.netset
iblocklist_iana_multicast.*set
iblocklist_iana_private.netset
iblocklist_iana_private.*set
iblocklist_iana_reserved.netset
iblocklist_iana_reserved.*set
iblocklist_level1.netset
iblocklist_level1.*set
iblocklist_level2.netset
iblocklist_level2.*set
iblocklist_level3.netset
iblocklist_level3.*set
iblocklist_org_microsoft.netset
iblocklist_org_microsoft.*set
iblocklist_proxies.ipset
iblocklist_proxies.*set
iblocklist_rangetest.netset
iblocklist_rangetest.*set
iblocklist_spider.netset
iblocklist_spider.*set
iblocklist_spyware.netset
iblocklist_spyware.*set
iblocklist_webexploit.ipset
iblocklist_webexploit.*set
ib_*.netset
iprange*
ipv4_range_to_cidr.awk
*.lastchecked
*.setinfo
sorbs_anonymizers.netset
sorbs_dul.netset
sorbs_escalations.netset
sorbs_*.ipset
sorbs_*.netset
sorbs_new_spam.netset
sorbs_noserver.netset
sorbs_recent_spam.netset
sorbs_smtp.netset
sorbs_web.netset
sorbs_zombie.netset
*.source
*.tmp
update-ipsets*
.warn_if_last_downloaded_before_this
blueliv*.ipset
blueliv*.netset
blueliv_crimeserver_online.ipset
blueliv_crimeserver_recent.ipset
blueliv_crimeserver_last.ipset
blueliv_crimeserver_last_1d.ipset
blueliv_crimeserver_last_2d.ipset
blueliv_crimeserver_last_7d.ipset
blueliv_crimeserver_last_30d.ipset
iblocklist_badpeers.netset
dataplane_sipquery.ipset
dataplane_sshpwauth.ipset
dataplane_sshclient.ipset
dataplane_sipregistration.ipset
dataplane_sipinvitation.ipset
dataplane_vncrfb.ipset
dataplane_dnsrd.ipset
dataplane_dnsrdany.ipset
dataplane_dnsversion.ipset
shunlist.ipset
ip2proxy_px1lite.netset

228
README-EDIT.md Normal file
View File

@ -0,0 +1,228 @@
> Due to the amount of data and the frequency of the updates on this repo,
> github has requested to limit the number of updates.
> The site [https://iplists.firehol.org](https://iplists.firehol.org) has direct links
> to all the files in this repo. **This repo is now updated once per day.**
---
### Contents
- [About this repo](#about-this-repo)
- [Using these ipsets](#using-these-ipsets)
- [Which ones to use?](#which-ones-to-use)
- [Why are open proxy lists included](#why-are-open-proxy-lists-included)
- [Using them in FireHOL](#using-them-in-firehol)
* [Adding the ipsets in your firehol.conf](#adding-the-ipsets-in-your-fireholconf)
* [Updating the ipsets while the firewall is running](#updating-the-ipsets-while-the-firewall-is-running)
- [Dynamic List of ipsets included](#list-of-ipsets-included)
- [Comparison of ipsets](#comparison-of-ipsets)
---
# About this repo
This repository includes a list of ipsets dynamically updated with
[FireHOL](https://github.com/firehol/firehol)'s `update-ipsets.sh`
[documented in this wiki](https://github.com/firehol/blocklist-ipsets/wiki).
This repo is self maintained. It it updated automatically from the script via a cron job.
This repo has a site: [http://iplists.firehol.org](http://iplists.firehol.org).
## Why do we need blocklists?
As time passes and the internet matures in our life, cybercrime is becoming increasingly sophisticated.
Although there are many tools (detection of malware, viruses, intrusion detection and prevention systems,
etc) to help us isolate the bad guys, there are now a lot more than just such attacks.
What is more interesting is that the fraudsters or attackers in many cases are not going to do a direct
damage to you or your systems. They will use you and your systems to gain something else, possibly not
related or indirectly related to your business. Nowadays the attacks cannot be identified easily. They are
distributed and come to our systems from a vast amount of IPs around the world.
To get an idea, check for example the [XRumer](http://en.wikipedia.org/wiki/XRumer) software. This thing
mimics human behavior to post ads, it creates email accounts, responds to emails it receives, bypasses
captchas, it goes gently to stay unnoticed, etc.
To increase our effectiveness we need to complement our security solutions with our shared knowledge, our
shared experience in this fight.
Hopefully, there are many teams out there that do their best to identify the attacks and pinpoint the
attackers. These teams release blocklists. Blocklists of IPs (for use in firewalls), domains & URLs
(for use in proxies), etc.
What we are interested here is IPs.
Using IP blocklists at the internet side of your firewall is a key component of internet security. These
lists share key knowledge between us, allowing us to learn from each other and effectively isolate
fraudsters and attackers from our services.
I decided to upload these lists to a github repo because:
1. They are freely available on the internet. The intention of their creators is to help internet security.
Keep in mind though that a few of these lists may have special licences attached. Before using them, please check their source site for any information regarding proper use.
2. Github provides (via `git pull`) a unified way of updating all the lists together.
Pulling this repo regularly on your machines, you will update all the IP lists at once.
3. Github also provides a unified version control. Using it we can have a history of what each list has
done, which IPs or subnets were added and which were removed.
## DNSBLs
Check also another tool included in FireHOL v3+, called `dnsbl-ipset.sh`.
This tool is capable of creating an ipset based on your traffic by looking up information on DNSBLs and
scoring it according to your preferences.
More information [here](https://github.com/firehol/firehol/wiki/dnsbl-ipset.sh).
---
# Using these ipsets
Please be very careful what you choose to use and how you use it. If you blacklist traffic using these
lists you may end up blocking your users, your customers, even yourself (!) from accessing your services.
1. Go to to the site of each list and read how each list is maintained. You are going to trust these guys for doing their job right.
2. Most sites have either a donation system or commercial lists of higher quality. Try to support them.
3. I have included the TOR network in these lists (`bm_tor`, `dm_tor`, `et_tor`). The TOR network is not necessarily bad and you should not block it if you want to allow your users be anonymous. I have included it because for certain cases, allowing an anonymity network might be a risky thing (such as eCommerce).
4. Apply any blacklist at the internet side of your firewall. Be very careful. The `bogons` and `fullbogons` lists contain private, unrouteable IPs that should not be routed on the internet. If you apply such a blocklist on your DMZ or LAN side, you will be blocked out of your firewall.
5. Always have a whitelist too, containing the IP addresses or subnets you trust. Try to build the rules in such a way that if an IP is in the whitelist, it should not be blocked by these blocklists.
## Which ones to use
### Level 1 - Basic
These are the ones I trust. **Level 1** provides basic security against the most well-known attackers, with the minimum of false positives.
1. **Abuse.ch** lists `feodo`, `palevo`, `sslbl`, `zeus`, `zeus_badips`
These folks are doing a great job tracking crime ware. Their blocklists are very focused.
Keep in mind `zeus` may include some false positives. You can use `zeus_badips` instead.
2. **DShield.org** list `dshield`
It contains the top 20 attacking class C (/24) subnets, over the last three days.
3. **Spamhaus.org** lists `spamhaus_drop`, `spamhaus_edrop`
DROP (Don't Route Or Peer) and EDROP are advisory "drop all traffic" lists, consisting of netblocks that are "hijacked" or leased by professional spam or cyber-crime operations (used for dissemination of malware, trojan downloaders, botnet controllers).
According to Spamhaus.org:
> When implemented at a network or ISP's 'core routers', DROP and EDROP will help protect the network's users from spamming, scanning, harvesting, DNS-hijacking and DDoS attacks originating on rogue netblocks.
>
> Spamhaus strongly encourages the use of DROP and EDROP by tier-1s and backbones.
Spamhaus is very responsive to adapt these lists when a network owner updates them that the issue has been solved (I had one such incident with one of my users).
4. **Team-Cymru.org** list `bogons` or `fullbogons`
These are lists of IPs that should not be routed on the internet. No one should be using them.
Be very careful to apply either of the two on the internet side of your network.
### Level 2 - Essentials
**Level 2** provide protection against current brute force attacks. This level may have a small percentage of false positives, mainly due to dynamic IPs being re-used by other users.
1. **OpenBL.org** lists `openbl*`
The team of OpenBL tracks brute force attacks on their hosts. They have a very short list for hosts, under their own control, collecting this information, to eliminate false positives.
They suggest to use the default blacklist which has a retention policy of 90 days (`openbl`), but they also provide lists with different retention policies (from 1 day to 1 year).
Their goal is to report abuse to the responsible provider so that the infection is disabled.
2. **Blocklist.de** lists `blocklist_de*`
Is a network of users reporting abuse mainly using `fail2ban`. They eliminate false positives using other lists available. Since they collect information from their users, their lists may be subject to poisoning, or false positives.
I asked them about poisoning. [Here](https://forum.blocklist.de/viewtopic.php?f=4&t=244&sid=847d00d26b0735add3518ff515242cad) you can find their answer. In short, they track it down so that they have an ignorable rate of false positives.
Also, they only include individual IPs (no subnets) which have attacked their users the last 48 hours and their list contains 20.000 to 40.000 IPs (which is small enough considering the size of the internet).
Like `openbl`, their goal is to report abuse back, so that the infection is disabled.
They also provide their blocklist per type of attack (mail, web, etc).
Of course, there are more lists included. You can check them and decide if they fit for your needs.
## Why are open proxy lists included
Of course, I haven't included them for you to use the open proxies. The port the proxy is listening, or the type of proxy, are not included (although most of them use the standard proxy ports and do serve web requests).
If you check the comparisons for the open proxy lists (`ri_connect_proxies`, `ri_web_proxies`, `xroxy`, `proxz`, `proxyrss`, etc)
you will find that they overlap to a great degree with other blocklists, like `blocklist_de`, `stopforumspam`, etc.
> This means the attackers also use open proxies to execute attacks.
So, if you are under attack, blocking the open proxies may help isolate a large part of the attack.
I don't suggest to permanently block IPs using the proxy lists. Their purpose of existence is questionable.
Their quality though may be acceptable, since lot of these sites advertise that they test open proxies before including them in their lists, so that there are no false positives, at least at the time they tested them.
---
## Using them in FireHOL
`update-ipsets.sh` itself does not alter your firewall. It can be used to update ipsets both on disk and in the kernel for any firewall solution you use.
The information below, shows you how to configure FireHOL to use the provides ipsets.
### Adding the ipsets in your firehol.conf
I use something like this:
```sh
# our wan interface
wan="dsl0"
# our whitelist
ipset4 create whitelist hash:net
ipset4 add whitelist A.B.C.D/E # A.B.C.D/E is whitelisted
# subnets - netsets
for x in fullbogons dshield spamhaus_drop spamhaus_edrop
do
ipset4 create ${x} hash:net
ipset4 addfile ${x} ipsets/${x}.netset
blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} \
except src ipset:whitelist
done
# individual IPs - ipsets
for x in feodo palevo sslbl zeus openbl blocklist_de
do
ipset4 create ${x} hash:ip
ipset4 addfile ${x} ipsets/${x}.ipset
blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} \
except src ipset:whitelist
done
... rest of firehol.conf ...
```
If you are concerned about iptables performance, change the `blacklist4` keyword `full` to `input`.
This will block only inbound NEW connections, i.e. only the first packet for every NEW inbound connection will be checked.
All other traffic passes through unchecked.
> Before adding these rules to your `firehol.conf` you should run `update-ipsets.sh` to enable them.
### Updating the ipsets while the firewall is running
Just use the `update-ipsets.sh` script from the firehol distribution.
This script will update each ipset and call firehol to update the ipset while the firewall is running.
> You can add `update-ipsets.sh` to cron, to run every 10 mins. `update-ipsets.sh` is smart enough to download
> a list only when it needs to.
---
# List of ipsets included

626
README.md Normal file
View File

@ -0,0 +1,626 @@
> Due to the amount of data and the frequency of the updates on this repo,
> github has requested to limit the number of updates.
> The site [https://iplists.firehol.org](https://iplists.firehol.org) has direct links
> to all the files in this repo. **This repo is now updated once per day.**
---
### Contents
- [About this repo](#about-this-repo)
- [Using these ipsets](#using-these-ipsets)
- [Which ones to use?](#which-ones-to-use)
- [Why are open proxy lists included](#why-are-open-proxy-lists-included)
- [Using them in FireHOL](#using-them-in-firehol)
* [Adding the ipsets in your firehol.conf](#adding-the-ipsets-in-your-fireholconf)
* [Updating the ipsets while the firewall is running](#updating-the-ipsets-while-the-firewall-is-running)
- [Dynamic List of ipsets included](#list-of-ipsets-included)
- [Comparison of ipsets](#comparison-of-ipsets)
---
# About this repo
This repository includes a list of ipsets dynamically updated with
[FireHOL](https://github.com/firehol/firehol)'s `update-ipsets.sh`
[documented in this wiki](https://github.com/firehol/blocklist-ipsets/wiki).
This repo is self maintained. It it updated automatically from the script via a cron job.
This repo has a site: [http://iplists.firehol.org](http://iplists.firehol.org).
## Why do we need blocklists?
As time passes and the internet matures in our life, cybercrime is becoming increasingly sophisticated.
Although there are many tools (detection of malware, viruses, intrusion detection and prevention systems,
etc) to help us isolate the bad guys, there are now a lot more than just such attacks.
What is more interesting is that the fraudsters or attackers in many cases are not going to do a direct
damage to you or your systems. They will use you and your systems to gain something else, possibly not
related or indirectly related to your business. Nowadays the attacks cannot be identified easily. They are
distributed and come to our systems from a vast amount of IPs around the world.
To get an idea, check for example the [XRumer](http://en.wikipedia.org/wiki/XRumer) software. This thing
mimics human behavior to post ads, it creates email accounts, responds to emails it receives, bypasses
captchas, it goes gently to stay unnoticed, etc.
To increase our effectiveness we need to complement our security solutions with our shared knowledge, our
shared experience in this fight.
Hopefully, there are many teams out there that do their best to identify the attacks and pinpoint the
attackers. These teams release blocklists. Blocklists of IPs (for use in firewalls), domains & URLs
(for use in proxies), etc.
What we are interested here is IPs.
Using IP blocklists at the internet side of your firewall is a key component of internet security. These
lists share key knowledge between us, allowing us to learn from each other and effectively isolate
fraudsters and attackers from our services.
I decided to upload these lists to a github repo because:
1. They are freely available on the internet. The intention of their creators is to help internet security.
Keep in mind though that a few of these lists may have special licences attached. Before using them, please check their source site for any information regarding proper use.
2. Github provides (via `git pull`) a unified way of updating all the lists together.
Pulling this repo regularly on your machines, you will update all the IP lists at once.
3. Github also provides a unified version control. Using it we can have a history of what each list has
done, which IPs or subnets were added and which were removed.
## DNSBLs
Check also another tool included in FireHOL v3+, called `dnsbl-ipset.sh`.
This tool is capable of creating an ipset based on your traffic by looking up information on DNSBLs and
scoring it according to your preferences.
More information [here](https://github.com/firehol/firehol/wiki/dnsbl-ipset.sh).
---
# Using these ipsets
Please be very careful what you choose to use and how you use it. If you blacklist traffic using these
lists you may end up blocking your users, your customers, even yourself (!) from accessing your services.
1. Go to to the site of each list and read how each list is maintained. You are going to trust these guys for doing their job right.
2. Most sites have either a donation system or commercial lists of higher quality. Try to support them.
3. I have included the TOR network in these lists (`bm_tor`, `dm_tor`, `et_tor`). The TOR network is not necessarily bad and you should not block it if you want to allow your users be anonymous. I have included it because for certain cases, allowing an anonymity network might be a risky thing (such as eCommerce).
4. Apply any blacklist at the internet side of your firewall. Be very careful. The `bogons` and `fullbogons` lists contain private, unrouteable IPs that should not be routed on the internet. If you apply such a blocklist on your DMZ or LAN side, you will be blocked out of your firewall.
5. Always have a whitelist too, containing the IP addresses or subnets you trust. Try to build the rules in such a way that if an IP is in the whitelist, it should not be blocked by these blocklists.
## Which ones to use
### Level 1 - Basic
These are the ones I trust. **Level 1** provides basic security against the most well-known attackers, with the minimum of false positives.
1. **Abuse.ch** lists `feodo`, `palevo`, `sslbl`, `zeus`, `zeus_badips`
These folks are doing a great job tracking crime ware. Their blocklists are very focused.
Keep in mind `zeus` may include some false positives. You can use `zeus_badips` instead.
2. **DShield.org** list `dshield`
It contains the top 20 attacking class C (/24) subnets, over the last three days.
3. **Spamhaus.org** lists `spamhaus_drop`, `spamhaus_edrop`
DROP (Don't Route Or Peer) and EDROP are advisory "drop all traffic" lists, consisting of netblocks that are "hijacked" or leased by professional spam or cyber-crime operations (used for dissemination of malware, trojan downloaders, botnet controllers).
According to Spamhaus.org:
> When implemented at a network or ISP's 'core routers', DROP and EDROP will help protect the network's users from spamming, scanning, harvesting, DNS-hijacking and DDoS attacks originating on rogue netblocks.
>
> Spamhaus strongly encourages the use of DROP and EDROP by tier-1s and backbones.
Spamhaus is very responsive to adapt these lists when a network owner updates them that the issue has been solved (I had one such incident with one of my users).
4. **Team-Cymru.org** list `bogons` or `fullbogons`
These are lists of IPs that should not be routed on the internet. No one should be using them.
Be very careful to apply either of the two on the internet side of your network.
### Level 2 - Essentials
**Level 2** provide protection against current brute force attacks. This level may have a small percentage of false positives, mainly due to dynamic IPs being re-used by other users.
1. **OpenBL.org** lists `openbl*`
The team of OpenBL tracks brute force attacks on their hosts. They have a very short list for hosts, under their own control, collecting this information, to eliminate false positives.
They suggest to use the default blacklist which has a retention policy of 90 days (`openbl`), but they also provide lists with different retention policies (from 1 day to 1 year).
Their goal is to report abuse to the responsible provider so that the infection is disabled.
2. **Blocklist.de** lists `blocklist_de*`
Is a network of users reporting abuse mainly using `fail2ban`. They eliminate false positives using other lists available. Since they collect information from their users, their lists may be subject to poisoning, or false positives.
I asked them about poisoning. [Here](https://forum.blocklist.de/viewtopic.php?f=4&t=244&sid=847d00d26b0735add3518ff515242cad) you can find their answer. In short, they track it down so that they have an ignorable rate of false positives.
Also, they only include individual IPs (no subnets) which have attacked their users the last 48 hours and their list contains 20.000 to 40.000 IPs (which is small enough considering the size of the internet).
Like `openbl`, their goal is to report abuse back, so that the infection is disabled.
They also provide their blocklist per type of attack (mail, web, etc).
Of course, there are more lists included. You can check them and decide if they fit for your needs.
## Why are open proxy lists included
Of course, I haven't included them for you to use the open proxies. The port the proxy is listening, or the type of proxy, are not included (although most of them use the standard proxy ports and do serve web requests).
If you check the comparisons for the open proxy lists (`ri_connect_proxies`, `ri_web_proxies`, `xroxy`, `proxz`, `proxyrss`, etc)
you will find that they overlap to a great degree with other blocklists, like `blocklist_de`, `stopforumspam`, etc.
> This means the attackers also use open proxies to execute attacks.
So, if you are under attack, blocking the open proxies may help isolate a large part of the attack.
I don't suggest to permanently block IPs using the proxy lists. Their purpose of existence is questionable.
Their quality though may be acceptable, since lot of these sites advertise that they test open proxies before including them in their lists, so that there are no false positives, at least at the time they tested them.
---
## Using them in FireHOL
`update-ipsets.sh` itself does not alter your firewall. It can be used to update ipsets both on disk and in the kernel for any firewall solution you use.
The information below, shows you how to configure FireHOL to use the provides ipsets.
### Adding the ipsets in your firehol.conf
I use something like this:
```sh
# our wan interface
wan="dsl0"
# our whitelist
ipset4 create whitelist hash:net
ipset4 add whitelist A.B.C.D/E # A.B.C.D/E is whitelisted
# subnets - netsets
for x in fullbogons dshield spamhaus_drop spamhaus_edrop
do
ipset4 create ${x} hash:net
ipset4 addfile ${x} ipsets/${x}.netset
blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} \
except src ipset:whitelist
done
# individual IPs - ipsets
for x in feodo palevo sslbl zeus openbl blocklist_de
do
ipset4 create ${x} hash:ip
ipset4 addfile ${x} ipsets/${x}.ipset
blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} \
except src ipset:whitelist
done
... rest of firehol.conf ...
```
If you are concerned about iptables performance, change the `blacklist4` keyword `full` to `input`.
This will block only inbound NEW connections, i.e. only the first packet for every NEW inbound connection will be checked.
All other traffic passes through unchecked.
> Before adding these rules to your `firehol.conf` you should run `update-ipsets.sh` to enable them.
### Updating the ipsets while the firewall is running
Just use the `update-ipsets.sh` script from the firehol distribution.
This script will update each ipset and call firehol to update the ipset while the firewall is running.
> You can add `update-ipsets.sh` to cron, to run every 10 mins. `update-ipsets.sh` is smart enough to download
> a list only when it needs to.
---
# List of ipsets included
The following list was automatically generated on Fri Sep 3 10:28:53 UTC 2021.
The update frequency is the maximum allowed by internal configuration. A list will never be downloaded sooner than the update frequency stated. A list may also not be downloaded, after this frequency expired, if it has not been modified on the server (as reported by HTTP `IF_MODIFIED_SINCE` method).
name|info|type|entries|update|
:--:|:--:|:--:|:-----:|:----:|
[alienvault_reputation](http://iplists.firehol.org/?ipset=alienvault_reputation)|[AlienVault.com](https://www.alienvault.com/) IP reputation database|ipv4 hash:ip|580 unique IPs|updated every 6 hours from [this link](https://reputation.alienvault.com/reputation.generic)
[asprox_c2](http://iplists.firehol.org/?ipset=asprox_c2)|[h3x.eu](http://atrack.h3x.eu/) ASPROX Tracker - Asprox C&C Sites|ipv4 hash:ip|0 unique IPs|updated every 1 day from [this link](http://atrack.h3x.eu/c2)
[bambenek_banjori](http://iplists.firehol.org/?ipset=bambenek_banjori)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of banjori C&Cs with 90 minute lookback|ipv4 hash:ip|136 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/banjori-iplist.txt)
[bambenek_bebloh](http://iplists.firehol.org/?ipset=bambenek_bebloh)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of bebloh C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/bebloh-iplist.txt)
[bambenek_c2](http://iplists.firehol.org/?ipset=bambenek_c2)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) master feed of known, active and non-sinkholed C&Cs IP addresses|ipv4 hash:ip|486 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/c2-ipmasterlist.txt)
[bambenek_cl](http://iplists.firehol.org/?ipset=bambenek_cl)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of cl C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/cl-iplist.txt)
[bambenek_cryptowall](http://iplists.firehol.org/?ipset=bambenek_cryptowall)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of cryptowall C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/cryptowall-iplist.txt)
[bambenek_dircrypt](http://iplists.firehol.org/?ipset=bambenek_dircrypt)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of dircrypt C&Cs with 90 minute lookback|ipv4 hash:ip|2 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/dircrypt-iplist.txt)
[bambenek_dyre](http://iplists.firehol.org/?ipset=bambenek_dyre)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of dyre C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/dyre-iplist.txt)
[bambenek_geodo](http://iplists.firehol.org/?ipset=bambenek_geodo)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of geodo C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/geodo-iplist.txt)
[bambenek_hesperbot](http://iplists.firehol.org/?ipset=bambenek_hesperbot)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of hesperbot C&Cs with 90 minute lookback|ipv4 hash:ip|2 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/hesperbot-iplist.txt)
[bambenek_matsnu](http://iplists.firehol.org/?ipset=bambenek_matsnu)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of matsnu C&Cs with 90 minute lookback|ipv4 hash:ip|1 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/matsnu-iplist.txt)
[bambenek_necurs](http://iplists.firehol.org/?ipset=bambenek_necurs)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of necurs C&Cs with 90 minute lookback|ipv4 hash:ip|13 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/necurs-iplist.txt)
[bambenek_p2pgoz](http://iplists.firehol.org/?ipset=bambenek_p2pgoz)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of p2pgoz C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/p2pgoz-iplist.txt)
[bambenek_pushdo](http://iplists.firehol.org/?ipset=bambenek_pushdo)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of pushdo C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/pushdo-iplist.txt)
[bambenek_pykspa](http://iplists.firehol.org/?ipset=bambenek_pykspa)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of pykspa C&Cs with 90 minute lookback|ipv4 hash:ip|5 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/pykspa-iplist.txt)
[bambenek_qakbot](http://iplists.firehol.org/?ipset=bambenek_qakbot)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of qakbot C&Cs with 90 minute lookback|ipv4 hash:ip|2 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/qakbot-iplist.txt)
[bambenek_ramnit](http://iplists.firehol.org/?ipset=bambenek_ramnit)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of ramnit C&Cs with 90 minute lookback|ipv4 hash:ip|98 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/ramnit-iplist.txt)
[bambenek_ranbyus](http://iplists.firehol.org/?ipset=bambenek_ranbyus)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of ranbyus C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/ranbyus-iplist.txt)
[bambenek_simda](http://iplists.firehol.org/?ipset=bambenek_simda)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of simda C&Cs with 90 minute lookback|ipv4 hash:ip|131 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/simda-iplist.txt)
[bambenek_suppobox](http://iplists.firehol.org/?ipset=bambenek_suppobox)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of suppobox C&Cs with 90 minute lookback|ipv4 hash:ip|108 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/suppobox-iplist.txt)
[bambenek_symmi](http://iplists.firehol.org/?ipset=bambenek_symmi)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of symmi C&Cs with 90 minute lookback|ipv4 hash:ip|1 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/symmi-iplist.txt)
[bambenek_tinba](http://iplists.firehol.org/?ipset=bambenek_tinba)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of tinba C&Cs with 90 minute lookback|ipv4 hash:ip|4 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/tinba-iplist.txt)
[bambenek_volatile](http://iplists.firehol.org/?ipset=bambenek_volatile)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of volatile C&Cs with 90 minute lookback|ipv4 hash:ip|1 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/volatile-iplist.txt)
[bbcan177_ms1](http://iplists.firehol.org/?ipset=bbcan177_ms1)|pfBlockerNG Malicious Threats|ipv4 hash:net|2688 subnets, 5269973 unique IPs|updated every 1 day from [this link](https://gist.githubusercontent.com/BBcan177/bf29d47ea04391cb3eb0/raw)
[bbcan177_ms3](http://iplists.firehol.org/?ipset=bbcan177_ms3)|pfBlockerNG Malicious Threats|ipv4 hash:net|1146 subnets, 30151694 unique IPs|updated every 1 day from [this link](https://gist.githubusercontent.com/BBcan177/d7105c242f17f4498f81/raw)
[bds_atif](http://iplists.firehol.org/?ipset=bds_atif)|Artillery Threat Intelligence Feed and Banlist Feed|ipv4 hash:ip|2436 unique IPs|updated every 1 day from [this link](https://www.binarydefense.com/banlist.txt)
[bitcoin_blockchain_info_1d](http://iplists.firehol.org/?ipset=bitcoin_blockchain_info_1d)|[Blockchain.info](https://blockchain.info/en/connected-nodes) Bitcoin nodes connected to Blockchain.info.|ipv4 hash:ip|988 unique IPs|updated every 10 mins from [this link](https://blockchain.info/en/connected-nodes)
[bitcoin_blockchain_info_30d](http://iplists.firehol.org/?ipset=bitcoin_blockchain_info_30d)|[Blockchain.info](https://blockchain.info/en/connected-nodes) Bitcoin nodes connected to Blockchain.info.|ipv4 hash:ip|8196 unique IPs|updated every 10 mins from [this link](https://blockchain.info/en/connected-nodes)
[bitcoin_blockchain_info_7d](http://iplists.firehol.org/?ipset=bitcoin_blockchain_info_7d)|[Blockchain.info](https://blockchain.info/en/connected-nodes) Bitcoin nodes connected to Blockchain.info.|ipv4 hash:ip|2636 unique IPs|updated every 10 mins from [this link](https://blockchain.info/en/connected-nodes)
[bitcoin_nodes](http://iplists.firehol.org/?ipset=bitcoin_nodes)|[BitNodes](https://getaddr.bitnodes.io/) Bitcoin connected nodes, globally.|ipv4 hash:ip|6201 unique IPs|updated every 10 mins from [this link](https://getaddr.bitnodes.io/api/v1/snapshots/latest/)
[bitcoin_nodes_1d](http://iplists.firehol.org/?ipset=bitcoin_nodes_1d)|[BitNodes](https://getaddr.bitnodes.io/) Bitcoin connected nodes, globally.|ipv4 hash:ip|6853 unique IPs|updated every 10 mins from [this link](https://getaddr.bitnodes.io/api/v1/snapshots/latest/)
[bitcoin_nodes_30d](http://iplists.firehol.org/?ipset=bitcoin_nodes_30d)|[BitNodes](https://getaddr.bitnodes.io/) Bitcoin connected nodes, globally.|ipv4 hash:ip|13204 unique IPs|updated every 10 mins from [this link](https://getaddr.bitnodes.io/api/v1/snapshots/latest/)
[bitcoin_nodes_7d](http://iplists.firehol.org/?ipset=bitcoin_nodes_7d)|[BitNodes](https://getaddr.bitnodes.io/) Bitcoin connected nodes, globally.|ipv4 hash:ip|8723 unique IPs|updated every 10 mins from [this link](https://getaddr.bitnodes.io/api/v1/snapshots/latest/)
[blocklist_de](http://iplists.firehol.org/?ipset=blocklist_de)|[Blocklist.de](https://www.blocklist.de/) IPs that have been detected by fail2ban in the last 48 hours|ipv4 hash:ip|23485 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/all.txt)
[blocklist_de_apache](http://iplists.firehol.org/?ipset=blocklist_de_apache)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours as having run attacks on the service Apache, Apache-DDOS, RFI-Attacks.|ipv4 hash:ip|8847 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/apache.txt)
[blocklist_de_bots](http://iplists.firehol.org/?ipset=blocklist_de_bots)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours as having run attacks on the RFI-Attacks, REG-Bots, IRC-Bots or BadBots (BadBots = it has posted a Spam-Comment on a open Forum or Wiki).|ipv4 hash:ip|104 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/bots.txt)
[blocklist_de_bruteforce](http://iplists.firehol.org/?ipset=blocklist_de_bruteforce)|[Blocklist.de](https://www.blocklist.de/) All IPs which attacks Joomla, Wordpress and other Web-Logins with Brute-Force Logins.|ipv4 hash:ip|865 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/bruteforcelogin.txt)
[blocklist_de_ftp](http://iplists.firehol.org/?ipset=blocklist_de_ftp)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours for attacks on the Service FTP.|ipv4 hash:ip|93 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/ftp.txt)
[blocklist_de_imap](http://iplists.firehol.org/?ipset=blocklist_de_imap)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours for attacks on the Service imap, sasl, pop3, etc.|ipv4 hash:ip|3498 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/imap.txt)
[blocklist_de_mail](http://iplists.firehol.org/?ipset=blocklist_de_mail)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours as having run attacks on the service Mail, Postfix.|ipv4 hash:ip|11716 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/mail.txt)
[blocklist_de_sip](http://iplists.firehol.org/?ipset=blocklist_de_sip)|[Blocklist.de](https://www.blocklist.de/) All IP addresses that tried to login in a SIP, VOIP or Asterisk Server and are included in the IPs list from infiltrated.net|ipv4 hash:ip|226 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/sip.txt)
[blocklist_de_ssh](http://iplists.firehol.org/?ipset=blocklist_de_ssh)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours as having run attacks on the service SSH.|ipv4 hash:ip|10461 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/ssh.txt)
[blocklist_de_strongips](http://iplists.firehol.org/?ipset=blocklist_de_strongips)|[Blocklist.de](https://www.blocklist.de/) All IPs which are older then 2 month and have more then 5.000 attacks.|ipv4 hash:ip|772 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/strongips.txt)
[blocklist_net_ua](http://iplists.firehol.org/?ipset=blocklist_net_ua)|[blocklist.net.ua](https://blocklist.net.ua) The BlockList project was created to become protection against negative influence of the harmful and potentially dangerous events on the Internet. First of all this service will help internet and hosting providers to protect subscribers sites from being hacked. BlockList will help to stop receiving a large amount of spam from dubious SMTP relays or from attempts of brute force passwords to servers and network equipment.|ipv4 hash:ip|43924 unique IPs|updated every 10 mins from [this link](https://blocklist.net.ua/blocklist.csv)
[blueliv_crimeserver_last](http://iplists.firehol.org/?ipset=blueliv_crimeserver_last)|[blueliv.com](https://www.blueliv.com/) Last 6 hours Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|24381 unique IPs|updated every 6 hours
[blueliv_crimeserver_last_1d](http://iplists.firehol.org/?ipset=blueliv_crimeserver_last_1d)|[blueliv.com](https://www.blueliv.com/) Last 6 hours Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|58312 unique IPs|updated every 6 hours
[blueliv_crimeserver_last_2d](http://iplists.firehol.org/?ipset=blueliv_crimeserver_last_2d)|[blueliv.com](https://www.blueliv.com/) Last 6 hours Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|71293 unique IPs|updated every 6 hours
[blueliv_crimeserver_last_30d](http://iplists.firehol.org/?ipset=blueliv_crimeserver_last_30d)|[blueliv.com](https://www.blueliv.com/) Last 6 hours Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|87551 unique IPs|updated every 6 hours
[blueliv_crimeserver_last_7d](http://iplists.firehol.org/?ipset=blueliv_crimeserver_last_7d)|[blueliv.com](https://www.blueliv.com/) Last 6 hours Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|77098 unique IPs|updated every 6 hours
[blueliv_crimeserver_online](http://iplists.firehol.org/?ipset=blueliv_crimeserver_online)|[blueliv.com](https://www.blueliv.com/) Online Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|15628 unique IPs|updated every 1 day
[blueliv_crimeserver_recent](http://iplists.firehol.org/?ipset=blueliv_crimeserver_recent)|[blueliv.com](https://www.blueliv.com/) Recent Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|64076 unique IPs|updated every 1 day
bm_tor|[torstatus.blutmagie.de](https://torstatus.blutmagie.de) list of all TOR network servers|ipv4 hash:ip|disabled|updated every 30 mins from [this link](https://torstatus.blutmagie.de/ip_list_all.php/Tor_ip_list_ALL.csv)
[bogons](http://iplists.firehol.org/?ipset=bogons)|[Team-Cymru.org](http://www.team-cymru.org) private and reserved addresses defined by RFC 1918, RFC 5735, and RFC 6598 and netblocks that have not been allocated to a regional internet registry|ipv4 hash:net|13 subnets, 592708608 unique IPs|updated every 1 day
[botscout](http://iplists.firehol.org/?ipset=botscout)|[BotScout](http://botscout.com/) helps prevent automated web scripts, known as bots, from registering on forums, polluting databases, spreading spam, and abusing forms on web sites. They do this by tracking the names, IPs, and email addresses that bots use and logging them as unique signatures for future reference. They also provide a simple yet powerful API that you can use to test forms when they're submitted on your site. This list is composed of the most recently-caught bots.|ipv4 hash:ip|67 unique IPs|updated every 30 mins from [this link](http://botscout.com/last_caught_cache.htm)
[botscout_1d](http://iplists.firehol.org/?ipset=botscout_1d)|[BotScout](http://botscout.com/) helps prevent automated web scripts, known as bots, from registering on forums, polluting databases, spreading spam, and abusing forms on web sites. They do this by tracking the names, IPs, and email addresses that bots use and logging them as unique signatures for future reference. They also provide a simple yet powerful API that you can use to test forms when they're submitted on your site. This list is composed of the most recently-caught bots.|ipv4 hash:ip|1556 unique IPs|updated every 30 mins from [this link](http://botscout.com/last_caught_cache.htm)
[botscout_30d](http://iplists.firehol.org/?ipset=botscout_30d)|[BotScout](http://botscout.com/) helps prevent automated web scripts, known as bots, from registering on forums, polluting databases, spreading spam, and abusing forms on web sites. They do this by tracking the names, IPs, and email addresses that bots use and logging them as unique signatures for future reference. They also provide a simple yet powerful API that you can use to test forms when they're submitted on your site. This list is composed of the most recently-caught bots.|ipv4 hash:ip|21688 unique IPs|updated every 30 mins from [this link](http://botscout.com/last_caught_cache.htm)
[botscout_7d](http://iplists.firehol.org/?ipset=botscout_7d)|[BotScout](http://botscout.com/) helps prevent automated web scripts, known as bots, from registering on forums, polluting databases, spreading spam, and abusing forms on web sites. They do this by tracking the names, IPs, and email addresses that bots use and logging them as unique signatures for future reference. They also provide a simple yet powerful API that you can use to test forms when they're submitted on your site. This list is composed of the most recently-caught bots.|ipv4 hash:ip|6661 unique IPs|updated every 30 mins from [this link](http://botscout.com/last_caught_cache.htm)
[botvrij_dst](http://iplists.firehol.org/?ipset=botvrij_dst)|[botvrij.eu](http://www.botvrij.eu/) Indicators of Compromise (IOCS) about malicious destination IPs, gathered via open source information feeds (blog pages and PDF documents) and then consolidated into different datasets. To ensure the quality of the data all entries older than approx. 6 months are removed.|ipv4 hash:ip|61 unique IPs|updated every 1 day from [this link](http://www.botvrij.eu/data/ioclist.ip-dst.raw)
[botvrij_src](http://iplists.firehol.org/?ipset=botvrij_src)|[botvrij.eu](http://www.botvrij.eu/) Indicators of Compromise (IOCS) about malicious source IPs, gathered via open source information feeds (blog pages and PDF documents) and then consolidated into different datasets. To ensure the quality of the data all entries older than approx. 6 months are removed.|ipv4 hash:ip|0 unique IPs|updated every 1 day from [this link](http://www.botvrij.eu/data/ioclist.ip-src.raw)
[bruteforceblocker](http://iplists.firehol.org/?ipset=bruteforceblocker)|[danger.rulez.sk bruteforceblocker](http://danger.rulez.sk/index.php/bruteforceblocker/) (fail2ban alternative for SSH on OpenBSD). This is an automatically generated list from users reporting failed authentication attempts. An IP seems to be included if 3 or more users report it. Its retention pocily seems 30 days.|ipv4 hash:ip|1773 unique IPs|updated every 3 hours from [this link](http://danger.rulez.sk/projects/bruteforceblocker/blist.php)
[ciarmy](http://iplists.firehol.org/?ipset=ciarmy)|[CIArmy.com](http://ciarmy.com/) IPs with poor Rogue Packet score that have not yet been identified as malicious by the community|ipv4 hash:ip|15000 unique IPs|updated every 3 hours from [this link](http://cinsscore.com/list/ci-badguys.txt)
[cidr_report_bogons](http://iplists.firehol.org/?ipset=cidr_report_bogons)|Unallocated (Free) Address Space, generated on a daily basis using the IANA registry files, the Regional Internet Registry stats files and the Regional Internet Registry whois data.|ipv4 hash:net|6510 subnets, 605324504 unique IPs|updated every 1 day from [this link](http://www.cidr-report.org/bogons/freespace-prefix.txt)
[cleanmx_phishing](http://iplists.firehol.org/?ipset=cleanmx_phishing)|[Clean-MX.de](http://support.clean-mx.de/) IPs sending phishing messages|ipv4 hash:ip|4519 unique IPs|updated every 30 mins from [this link](http://support.clean-mx.de/clean-mx/xmlphishing?response=alive&format=csv&domain=)
[cleanmx_viruses](http://iplists.firehol.org/?ipset=cleanmx_viruses)|[Clean-MX.de](http://support.clean-mx.de/clean-mx/viruses.php) IPs with viruses|ipv4 hash:ip|12190 unique IPs|updated every 30 mins from [this link](http://support.clean-mx.de/clean-mx/xmlviruses.php?response=alive&fields=ip)
[cleantalk](http://iplists.firehol.org/?ipset=cleantalk)|[CleanTalk](https://cleantalk.org/) Today's HTTP Spammers (includes: cleantalk_new cleantalk_updated)|ipv4 hash:ip|475 unique IPs|updated every 1 min
[cleantalk_1d](http://iplists.firehol.org/?ipset=cleantalk_1d)|[CleanTalk](https://cleantalk.org/) Today's HTTP Spammers (includes: cleantalk_new_1d cleantalk_updated_1d)|ipv4 hash:ip|940 unique IPs|updated every 1 min
[cleantalk_30d](http://iplists.firehol.org/?ipset=cleantalk_30d)|[CleanTalk](https://cleantalk.org/) Today's HTTP Spammers (includes: cleantalk_new_30d cleantalk_updated_30d)|ipv4 hash:ip|27474 unique IPs|updated every 1 min
[cleantalk_7d](http://iplists.firehol.org/?ipset=cleantalk_7d)|[CleanTalk](https://cleantalk.org/) Today's HTTP Spammers (includes: cleantalk_new_7d cleantalk_updated_7d)|ipv4 hash:ip|11341 unique IPs|updated every 1 min
[cleantalk_new](http://iplists.firehol.org/?ipset=cleantalk_new)|[CleanTalk](https://cleantalk.org/) Recent HTTP Spammers|ipv4 hash:ip|250 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/submited_today)
[cleantalk_new_1d](http://iplists.firehol.org/?ipset=cleantalk_new_1d)|[CleanTalk](https://cleantalk.org/) Recent HTTP Spammers|ipv4 hash:ip|500 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/submited_today)
[cleantalk_new_30d](http://iplists.firehol.org/?ipset=cleantalk_new_30d)|[CleanTalk](https://cleantalk.org/) Recent HTTP Spammers|ipv4 hash:ip|16272 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/submited_today)
[cleantalk_new_7d](http://iplists.firehol.org/?ipset=cleantalk_new_7d)|[CleanTalk](https://cleantalk.org/) Recent HTTP Spammers|ipv4 hash:ip|6272 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/submited_today)
[cleantalk_top20](http://iplists.firehol.org/?ipset=cleantalk_top20)|[CleanTalk](https://cleantalk.org/) Top 20 HTTP Spammers|ipv4 hash:ip|20 unique IPs|updated every 1 day from [this link](https://cleantalk.org/blacklists/top20)
[cleantalk_updated](http://iplists.firehol.org/?ipset=cleantalk_updated)|[CleanTalk](https://cleantalk.org/) Recurring HTTP Spammers|ipv4 hash:ip|250 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/updated_today)
[cleantalk_updated_1d](http://iplists.firehol.org/?ipset=cleantalk_updated_1d)|[CleanTalk](https://cleantalk.org/) Recurring HTTP Spammers|ipv4 hash:ip|471 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/updated_today)
[cleantalk_updated_30d](http://iplists.firehol.org/?ipset=cleantalk_updated_30d)|[CleanTalk](https://cleantalk.org/) Recurring HTTP Spammers|ipv4 hash:ip|13119 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/updated_today)
[cleantalk_updated_7d](http://iplists.firehol.org/?ipset=cleantalk_updated_7d)|[CleanTalk](https://cleantalk.org/) Recurring HTTP Spammers|ipv4 hash:ip|6052 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/updated_today)
[coinbl_hosts](http://iplists.firehol.org/?ipset=coinbl_hosts)|[CoinBlockerLists](https://gitlab.com/ZeroDot1/CoinBlockerLists) Simple lists that can help prevent cryptomining in the browser or other applications. This list contains all domains - A list for administrators to prevent mining in networks. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|9927 unique IPs|updated every 1 day from [this link](https://zerodot1.gitlab.io/CoinBlockerLists/hosts)
[coinbl_hosts_browser](http://iplists.firehol.org/?ipset=coinbl_hosts_browser)|[CoinBlockerLists](https://gitlab.com/ZeroDot1/CoinBlockerLists) Simple lists that can help prevent cryptomining in the browser or other applications. A hosts list to prevent browser mining only. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|676 unique IPs|updated every 1 day from [this link](https://zerodot1.gitlab.io/CoinBlockerLists/hosts_browser)
[coinbl_hosts_optional](http://iplists.firehol.org/?ipset=coinbl_hosts_optional)|[CoinBlockerLists](https://gitlab.com/ZeroDot1/CoinBlockerLists) Simple lists that can help prevent cryptomining in the browser or other applications. This list contains additional domains, for administrators to prevent mining in networks. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|454 unique IPs|updated every 1 day from [this link](https://zerodot1.gitlab.io/CoinBlockerLists/hosts_optional)
[coinbl_ips](http://iplists.firehol.org/?ipset=coinbl_ips)|[CoinBlockerLists](https://gitlab.com/ZeroDot1/CoinBlockerLists) Simple lists that can help prevent cryptomining in the browser or other applications. This list contains all IPs - An additional list for administrators to prevent mining in networks. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|1390 unique IPs|updated every 1 day from [this link](https://zerodot1.gitlab.io/CoinBlockerLists/MiningServerIPList.txt)
[cruzit_web_attacks](http://iplists.firehol.org/?ipset=cruzit_web_attacks)|[CruzIt.com](http://www.cruzit.com/wbl.php) IPs of compromised machines scanning for vulnerabilities and DDOS attacks|ipv4 hash:ip|11808 unique IPs|updated every 12 hours from [this link](http://www.cruzit.com/xwbl2txt.php)
[cta_cryptowall](http://iplists.firehol.org/?ipset=cta_cryptowall)|[Cyber Threat Alliance](http://www.cyberthreatalliance.org/cryptowall-dashboard.html) CryptoWall is one of the most lucrative and broad-reaching ransomware campaigns affecting Internet users today. Sharing intelligence and analysis resources, the CTA profiled the latest version of CryptoWall, which impacted hundreds of thousands of users, resulting in over US $325 million in damages worldwide.|ipv4 hash:ip|1360 unique IPs|updated every 1 day from [this link](https://public.tableau.com/views/CTAOnlineViz/DashboardData.csv?:embed=y&:showVizHome=no&:showTabs=y&:display_count=y&:display_static_image=y&:bootstrapWhenNotified=true)
[cybercrime](http://iplists.firehol.org/?ipset=cybercrime)|[CyberCrime](http://cybercrime-tracker.net/) A project tracking Command and Control.|ipv4 hash:ip|601 unique IPs|updated every 12 hours from [this link](http://cybercrime-tracker.net/fuckerz.php)
[darklist_de](http://iplists.firehol.org/?ipset=darklist_de)|[darklist.de](http://www.darklist.de/) ssh fail2ban reporting|ipv4 hash:net|7261 subnets, 471916 unique IPs|updated every 1 day from [this link](http://www.darklist.de/raw.php)
[datacenters](http://iplists.firehol.org/?ipset=datacenters)|[Nick Galbreath](https://github.com/client9/ipcat) This is a list of IPv4 address that correspond to datacenters, co-location centers, shared and virtual webhosting providers. In other words, ip addresses that end web consumers should not be using.|ipv4 hash:net|4224 subnets, 95959476 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/client9/ipcat/master/datacenters.csv)
[dataplane_dnsrd](http://iplists.firehol.org/?ipset=dataplane_dnsrd)|[DataPlane.org](https://dataplane.org/) IP addresses that have been identified as sending recursive DNS queries to a remote host. This report lists addresses that may be cataloging open DNS resolvers or evaluating cache entries.|ipv4 hash:ip|1403 unique IPs|updated every 1 hour
[dataplane_dnsrdany](http://iplists.firehol.org/?ipset=dataplane_dnsrdany)|[DataPlane.org](https://dataplane.org/) IP addresses that have been identified as sending recursive DNS IN ANY queries to a remote host. This report lists addresses that may be cataloging open DNS resolvers for the purpose of later using them to facilitate DNS amplification and reflection attacks.|ipv4 hash:ip|267 unique IPs|updated every 1 hour
[dataplane_dnsversion](http://iplists.firehol.org/?ipset=dataplane_dnsversion)|[DataPlane.org](https://dataplane.org/) IP addresses that have been identified as sending DNS CH TXT VERSION.BIND queries to a remote host. This report lists addresses that may be cataloging DNS software.|ipv4 hash:ip|188 unique IPs|updated every 1 hour
[dataplane_sipinvitation](http://iplists.firehol.org/?ipset=dataplane_sipinvitation)|[DataPlane.org](https://dataplane.org/) IP addresses that have been seen initiating a SIP INVITE operation to a remote host. This report lists hosts that are suspicious of more than just port scanning. These hosts may be SIP client cataloging or conducting various forms of telephony abuse.|ipv4 hash:ip|54 unique IPs|updated every 1 hour
[dataplane_sipquery](http://iplists.firehol.org/?ipset=dataplane_sipquery)|[DataPlane.org](https://dataplane.org/) IP addresses that has been seen initiating a SIP OPTIONS query to a remote host. This report lists hosts that are suspicious of more than just port scanning. These hosts may be SIP server cataloging or conducting various forms of telephony abuse.|ipv4 hash:ip|1282 unique IPs|updated every 1 hour
[dataplane_sipregistration](http://iplists.firehol.org/?ipset=dataplane_sipregistration)|[DataPlane.org](https://dataplane.org/) IP addresses that have been seen initiating a SIP REGISTER operation to a remote host. This report lists hosts that are suspicious of more than just port scanning. These hosts may be SIP client cataloging or conducting various forms of telephony abuse.|ipv4 hash:ip|53 unique IPs|updated every 1 hour
[dataplane_sshclient](http://iplists.firehol.org/?ipset=dataplane_sshclient)|[DataPlane.org](https://dataplane.org/) IP addresses that has been seen initiating an SSH connection to a remote host. This report lists hosts that are suspicious of more than just port scanning. These hosts may be SSH server cataloging or conducting authentication attack attempts.|ipv4 hash:ip|21856 unique IPs|updated every 1 hour
[dataplane_sshpwauth](http://iplists.firehol.org/?ipset=dataplane_sshpwauth)|[DataPlane.org](https://dataplane.org/) IP addresses that has been seen attempting to remotely login to a host using SSH password authentication. This report lists hosts that are highly suspicious and are likely conducting malicious SSH password authentication attacks.|ipv4 hash:ip|18187 unique IPs|updated every 1 hour
[dataplane_vncrfb](http://iplists.firehol.org/?ipset=dataplane_vncrfb)|[DataPlane.org](https://dataplane.org/) IP addresses that have been seen initiating a VNC remote frame buffer (RFB) session to a remote host. This report lists hosts that are suspicious of more than just port scanning. These hosts may be VNC server cataloging or conducting various forms of remote access abuse.|ipv4 hash:ip|1577 unique IPs|updated every 1 hour
[dm_tor](http://iplists.firehol.org/?ipset=dm_tor)|[dan.me.uk](https://www.dan.me.uk) dynamic list of TOR nodes|ipv4 hash:ip|6569 unique IPs|updated every 30 mins from [this link](https://www.dan.me.uk/torlist/)
[dronebl_anonymizers](http://iplists.firehol.org/?ipset=dronebl_anonymizers)|[DroneBL.org](https://dronebl.org) List of open proxies. It includes IPs which DroneBL categorizes as SOCKS proxies (8), HTTP proxies (9), web page proxies (11), WinGate proxies (14), proxy chains (10).|ipv4 hash:net|1352497 subnets, 1488613 unique IPs|updated every 1 min
[dronebl_auto_botnets](http://iplists.firehol.org/?ipset=dronebl_auto_botnets)|[DroneBL.org](https://dronebl.org) IPs of automatically detected botnets. It includes IPs for which DroneBL responds with 17.|ipv4 hash:net|10817 subnets, 10926 unique IPs|updated every 1 min
[dronebl_autorooting_worms](http://iplists.firehol.org/?ipset=dronebl_autorooting_worms)|[DroneBL.org](https://dronebl.org) IPs of autorooting worms. It includes IPs for which DroneBL responds with 16. These are usually SSH bruteforce attacks.|ipv4 hash:net|1698 subnets, 1844 unique IPs|updated every 1 min
[dronebl_compromised](http://iplists.firehol.org/?ipset=dronebl_compromised)|[DroneBL.org](https://dronebl.org) IPs of compromised routers / gateways. It includes IPs for which DroneBL responds with 15 (BOPM detected).|ipv4 hash:net|66744 subnets, 67699 unique IPs|updated every 1 min
[dronebl_ddos_drones](http://iplists.firehol.org/?ipset=dronebl_ddos_drones)|[DroneBL.org](https://dronebl.org) IPs of DDoS drones. It includes IPs for which DroneBL responds with 7.|ipv4 hash:net|2592 subnets, 2598 unique IPs|updated every 1 min
[dronebl_dns_mx_on_irc](http://iplists.firehol.org/?ipset=dronebl_dns_mx_on_irc)|[DroneBL.org](https://dronebl.org) List of IPs of DNS / MX hostname detected on IRC. It includes IPs for which DroneBL responds with 18.|ipv4 hash:net|490 subnets, 494 unique IPs|updated every 1 min
[dronebl_irc_drones](http://iplists.firehol.org/?ipset=dronebl_irc_drones)|[DroneBL.org](https://dronebl.org) List of IRC spam drones (litmus/sdbot/fyle). It includes IPs for which DroneBL responds with 3.|ipv4 hash:net|818464 subnets, 986144 unique IPs|updated every 1 min
[dronebl_unknown](http://iplists.firehol.org/?ipset=dronebl_unknown)|[DroneBL.org](https://dronebl.org) List of IPs of uncategorized threats. It includes IPs for which DroneBL responds with 255.|ipv4 hash:net|148 subnets, 148 unique IPs|updated every 1 min
[dronebl_worms_bots](http://iplists.firehol.org/?ipset=dronebl_worms_bots)|[DroneBL.org](https://dronebl.org) IPs of unknown worms or spambots. It includes IPs for which DroneBL responds with 6|ipv4 hash:net|222976 subnets, 233267 unique IPs|updated every 1 min
[dshield](http://iplists.firehol.org/?ipset=dshield)|[DShield.org](https://dshield.org/) top 20 attacking class C (/24) subnets over the last three days|ipv4 hash:net|19 subnets, 5120 unique IPs|updated every 10 mins from [this link](http://feeds.dshield.org/block.txt)
[dshield_1d](http://iplists.firehol.org/?ipset=dshield_1d)|[DShield.org](https://dshield.org/) top 20 attacking class C (/24) subnets over the last three days|ipv4 hash:net|33 subnets, 8960 unique IPs|updated every 10 mins from [this link](http://feeds.dshield.org/block.txt)
[dshield_30d](http://iplists.firehol.org/?ipset=dshield_30d)|[DShield.org](https://dshield.org/) top 20 attacking class C (/24) subnets over the last three days|ipv4 hash:net|68 subnets, 18944 unique IPs|updated every 10 mins from [this link](http://feeds.dshield.org/block.txt)
[dshield_7d](http://iplists.firehol.org/?ipset=dshield_7d)|[DShield.org](https://dshield.org/) top 20 attacking class C (/24) subnets over the last three days|ipv4 hash:net|47 subnets, 12544 unique IPs|updated every 10 mins from [this link](http://feeds.dshield.org/block.txt)
[dshield_top_1000](http://iplists.firehol.org/?ipset=dshield_top_1000)|[DShield.org](https://dshield.org/) top 1000 attacking hosts in the last 30 days|ipv4 hash:ip|1000 unique IPs|updated every 1 hour from [this link](https://isc.sans.edu/api/sources/attacks/1000/)
[dyndns_ponmocup](http://iplists.firehol.org/?ipset=dyndns_ponmocup)|[DynDNS.org](http://security-research.dyndns.org/pub/malware-feeds/) Ponmocup. The malware powering the botnet has been around since 2006 and its known under various names, including Ponmocup, Vundo, Virtumonde, Milicenso and Swisyn. It has been used for ad fraud, data theft and downloading additional threats to infected systems. Ponmocup is one of the largest currently active and, with nine consecutive years, also one of the longest running, but it is rarely noticed as the operators take care to keep it operating under the radar.|ipv4 hash:ip|48 unique IPs|updated every 1 day from [this link](http://security-research.dyndns.org/pub/malware-feeds/ponmocup-infected-domains-shadowserver.csv)
[esentire_14072015_com](http://iplists.firehol.org/?ipset=esentire_14072015_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|579 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/14072015.com_watch_ip.lst)
[esentire_14072015q_com](http://iplists.firehol.org/?ipset=esentire_14072015q_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|575 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/14072015q.com_watch_ip.lst)
[esentire_22072014a_com](http://iplists.firehol.org/?ipset=esentire_22072014a_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|1290 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/22072014a.com_watch_ip.lst)
[esentire_22072014b_com](http://iplists.firehol.org/?ipset=esentire_22072014b_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|1288 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/22072014b.com_watch_ip.lst)
[esentire_22072014c_com](http://iplists.firehol.org/?ipset=esentire_22072014c_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|1289 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/22072014c.com_watch_ip.lst)
[esentire_atomictrivia_ru](http://iplists.firehol.org/?ipset=esentire_atomictrivia_ru)|Andromeda/Gamarue Checkin|ipv4 hash:ip|7 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/atomictrivia.ru_watch_ip.lst)
[esentire_auth_update_ru](http://iplists.firehol.org/?ipset=esentire_auth_update_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|1306 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/auth-update.ru_watch_ip.lst)
[esentire_burmundisoul_ru](http://iplists.firehol.org/?ipset=esentire_burmundisoul_ru)|Ursnif Variant CnC|ipv4 hash:ip|2551 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/burmundisoul.ru_watch_ip.lst)
[esentire_crazyerror_su](http://iplists.firehol.org/?ipset=esentire_crazyerror_su)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|18613 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/crazyerror.su_watch_ip.lst)
[esentire_dagestanskiiviskis_ru](http://iplists.firehol.org/?ipset=esentire_dagestanskiiviskis_ru)|Ursnif Variant CnC|ipv4 hash:ip|517 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/dagestanskiiviskis.ru_watch_ip.lst)
[esentire_differentia_ru](http://iplists.firehol.org/?ipset=esentire_differentia_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|12 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/differentia.ru_watch_ip.lst)
[esentire_disorderstatus_ru](http://iplists.firehol.org/?ipset=esentire_disorderstatus_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|7 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/disorderstatus.ru_watch_ip.lst)
[esentire_dorttlokolrt_com](http://iplists.firehol.org/?ipset=esentire_dorttlokolrt_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|23664 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/dorttlokolrt.com_watch_ip.lst)
[esentire_downs1_ru](http://iplists.firehol.org/?ipset=esentire_downs1_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|7231 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/downs1.ru_watch_ip.lst)
[esentire_ebankoalalusys_ru](http://iplists.firehol.org/?ipset=esentire_ebankoalalusys_ru)|Ursnif Variant CnC|ipv4 hash:ip|898 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/ebankoalalusys.ru_watch_ip.lst)
[esentire_emptyarray_ru](http://iplists.firehol.org/?ipset=esentire_emptyarray_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|20139 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/emptyarray.ru_watch_ip.lst)
[esentire_fioartd_com](http://iplists.firehol.org/?ipset=esentire_fioartd_com)|Andromeda/Gamarue Checkin|ipv4 hash:ip|601 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/fioartd.com_watch_ip.lst)
[esentire_getarohirodrons_com](http://iplists.firehol.org/?ipset=esentire_getarohirodrons_com)|Andromeda/Gamarue Checkin|ipv4 hash:ip|2156 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/getarohirodrons.com_watch_ip.lst)
[esentire_hasanhashsde_ru](http://iplists.firehol.org/?ipset=esentire_hasanhashsde_ru)|Ursnif Variant CnC|ipv4 hash:ip|1184 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/hasanhashsde.ru_watch_ip.lst)
[esentire_inleet_ru](http://iplists.firehol.org/?ipset=esentire_inleet_ru)|Ursnif Variant CnC|ipv4 hash:ip|4219 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/inleet.ru_watch_ip.lst)
[esentire_islamislamdi_ru](http://iplists.firehol.org/?ipset=esentire_islamislamdi_ru)|Ursnif Variant CnC|ipv4 hash:ip|673 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/islamislamdi.ru_watch_ip.lst)
[esentire_krnqlwlplttc_com](http://iplists.firehol.org/?ipset=esentire_krnqlwlplttc_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|2 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/krnqlwlplttc.com_watch_ip.lst)
[esentire_maddox1_ru](http://iplists.firehol.org/?ipset=esentire_maddox1_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|11345 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/maddox1.ru_watch_ip.lst)
[esentire_manning1_ru](http://iplists.firehol.org/?ipset=esentire_manning1_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|6824 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/manning1.ru_watch_ip.lst)
[esentire_misteryherson_ru](http://iplists.firehol.org/?ipset=esentire_misteryherson_ru)|Ursnif Variant CnC|ipv4 hash:ip|176 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/misteryherson.ru_watch_ip.lst)
[esentire_mysebstarion_ru](http://iplists.firehol.org/?ipset=esentire_mysebstarion_ru)|Ursnif Variant CnC|ipv4 hash:ip|1058 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/mysebstarion.ru_watch_ip.lst)
[esentire_smartfoodsglutenfree_kz](http://iplists.firehol.org/?ipset=esentire_smartfoodsglutenfree_kz)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|2674 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/smartfoodsglutenfree.kz_watch_ip.lst)
[esentire_venerologvasan93_ru](http://iplists.firehol.org/?ipset=esentire_venerologvasan93_ru)|Ursnif Variant CnC|ipv4 hash:ip|1263 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/venerologvasan93.ru_watch_ip.lst)
[esentire_volaya_ru](http://iplists.firehol.org/?ipset=esentire_volaya_ru)|Win32/PSW.Papras.CK CnC|ipv4 hash:ip|5080 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/volaya.ru_watch_ip.lst)
[et_block](http://iplists.firehol.org/?ipset=et_block)|[EmergingThreats.net](http://www.emergingthreats.net/) default blacklist (at the time of writing includes spamhaus DROP, dshield and abuse.ch trackers, which are available separately too - prefer to use the direct ipsets instead of this, they seem to lag a bit in updates)|ipv4 hash:net|1335 subnets, 20129583 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt)
[et_botcc](http://iplists.firehol.org/?ipset=et_botcc)|[EmergingThreats.net Command and Control IPs](http://doc.emergingthreats.net/bin/view/Main/BotCC) These IPs are updates every 24 hours and should be considered VERY highly reliable indications that a host is communicating with a known and active Bot or Malware command and control server - (although they say this includes abuse.ch trackers, it does not - check its overlaps)|ipv4 hash:ip|67 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/fwrules/emerging-PIX-CC.rules)
[et_compromised](http://iplists.firehol.org/?ipset=et_compromised)|[EmergingThreats.net compromised hosts](http://doc.emergingthreats.net/bin/view/Main/CompromisedHost)|ipv4 hash:ip|1817 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/blockrules/compromised-ips.txt)
[et_dshield](http://iplists.firehol.org/?ipset=et_dshield)|[EmergingThreats.net](http://www.emergingthreats.net/) dshield blocklist|ipv4 hash:net|19 subnets, 5120 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/fwrules/emerging-PIX-DSHIELD.rules)
[et_spamhaus](http://iplists.firehol.org/?ipset=et_spamhaus)|[EmergingThreats.net](http://www.emergingthreats.net/) spamhaus blocklist|ipv4 hash:net|1015 subnets, 20124160 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/fwrules/emerging-PIX-DROP.rules)
[et_tor](http://iplists.firehol.org/?ipset=et_tor)|[EmergingThreats.net TOR list](http://doc.emergingthreats.net/bin/view/Main/TorRules) of TOR network IPs|ipv4 hash:ip|6864 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/blockrules/emerging-tor.rules)
[feodo](http://iplists.firehol.org/?ipset=feodo)|[Abuse.ch Feodo tracker](https://feodotracker.abuse.ch) trojan includes IPs which are being used by Feodo (also known as Cridex or Bugat) which commits ebanking fraud|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://feodotracker.abuse.ch/blocklist/?download=ipblocklist)
[feodo_badips](http://iplists.firehol.org/?ipset=feodo_badips)|[Abuse.ch Feodo tracker BadIPs](https://feodotracker.abuse.ch) The Feodo Tracker Feodo BadIP Blocklist only contains IP addresses (IPv4) used as C&C communication channel by the Feodo Trojan version B. These IP addresses are usually servers rented by cybercriminals directly and used for the exclusive purpose of hosting a Feodo C&C server. Hence you should expect no legit traffic to those IP addresses. The site highly recommends you to block/drop any traffic towards any Feodo C&C using the Feodo BadIP Blocklist. Please consider that this blocklist only contains IP addresses used by version B of the Feodo Trojan. C&C communication channels used by version A, version C and version D are not covered by this blocklist.|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://feodotracker.abuse.ch/blocklist/?download=badips)
[firehol_abusers_1d](http://iplists.firehol.org/?ipset=firehol_abusers_1d)|An ipset made from blocklists that track abusers in the last 24 hours. (includes: botscout_1d cleantalk_new_1d cleantalk_updated_1d php_commenters_1d php_dictionary_1d php_harvesters_1d php_spammers_1d stopforumspam_1d)|ipv4 hash:net|9280 subnets, 9541 unique IPs|updated every 1 min
[firehol_abusers_30d](http://iplists.firehol.org/?ipset=firehol_abusers_30d)|An ipset made from blocklists that track abusers in the last 30 days. (includes: cleantalk_new_30d cleantalk_updated_30d php_commenters_30d php_dictionary_30d php_harvesters_30d php_spammers_30d stopforumspam sblam)|ipv4 hash:net|220762 subnets, 234273 unique IPs|updated every 1 min
[firehol_anonymous](http://iplists.firehol.org/?ipset=firehol_anonymous)|An ipset that includes all the anonymizing IPs of the world. (includes: anonymous dm_tor firehol_proxies tor_exits)|ipv4 hash:net|1838688 subnets, 1876749 unique IPs|updated every 1 min
[firehol_level1](http://iplists.firehol.org/?ipset=firehol_level1)|A firewall blacklist composed from IP lists, providing maximum protection with minimum false positives. Suitable for basic protection on all internet facing servers, routers and firewalls. (includes: bambenek_c2 dshield feodo fullbogons spamhaus_drop spamhaus_edrop sslbl ransomware_rw)|ipv4 hash:net|2905 subnets, 619589594 unique IPs|updated every 1 min
[firehol_level2](http://iplists.firehol.org/?ipset=firehol_level2)|An ipset made from blocklists that track attacks, during about the last 48 hours. (includes: blocklist_de dshield_1d greensnow)|ipv4 hash:net|16972 subnets, 34020 unique IPs|updated every 1 min
[firehol_level3](http://iplists.firehol.org/?ipset=firehol_level3)|An ipset made from blocklists that track attacks, spyware, viruses. It includes IPs than have been reported or detected in the last 30 days. (includes: bruteforceblocker ciarmy dshield_30d dshield_top_1000 malc0de maxmind_proxy_fraud myip shunlist snort_ipfilter sslbl_aggressive talosintel_ipfilter vxvault)|ipv4 hash:net|17413 subnets, 37744 unique IPs|updated every 1 min
[firehol_level4](http://iplists.firehol.org/?ipset=firehol_level4)|An ipset made from blocklists that track attacks, but may include a large number of false positives. (includes: blocklist_net_ua botscout_30d cruzit_web_attacks cybercrime haley_ssh iblocklist_hijacked iblocklist_spyware iblocklist_webexploit ipblacklistcloud_top iw_wormlist malwaredomainlist)|ipv4 hash:net|135658 subnets, 9288987 unique IPs|updated every 1 min
[firehol_proxies](http://iplists.firehol.org/?ipset=firehol_proxies)|An ipset made from all sources that track open proxies. It includes IPs reported or detected in the last 30 days. (includes: iblocklist_proxies maxmind_proxy_fraud ip2proxy_px1lite proxylists_30d proxz_30d socks_proxy_30d sslproxies_30d xroxy_30d)|ipv4 hash:net|1832495 subnets, 1864253 unique IPs|updated every 1 min
[firehol_webclient](http://iplists.firehol.org/?ipset=firehol_webclient)|An IP blacklist made from blocklists that track IPs that a web client should never talk to. This list is to be used on top of firehol_level1. (includes: ransomware_online sslbl_aggressive cybercrime dyndns_ponmocup maxmind_proxy_fraud)|ipv4 hash:net|1075 subnets, 1231 unique IPs|updated every 1 min
[firehol_webserver](http://iplists.firehol.org/?ipset=firehol_webserver)|A web server IP blacklist made from blocklists that track IPs that should never be used by your web users. (This list includes IPs that are servers hosting malware, bots, etc or users having a long criminal history. This list is to be used on top of firehol_level1, firehol_level2, firehol_level3 and possibly firehol_proxies or firehol_anonymous). (includes: maxmind_proxy_fraud myip pushing_inertia_blocklist stopforumspam_toxic)|ipv4 hash:net|2272 subnets, 57191630 unique IPs|updated every 1 min
[fullbogons](http://iplists.firehol.org/?ipset=fullbogons)|[Team-Cymru.org](http://www.team-cymru.org) IP space that has been allocated to an RIR, but not assigned by that RIR to an actual ISP or other end-user|ipv4 hash:net|1398 subnets, 598593792 unique IPs|updated every 1 day
geolite2_asn|[MaxMind GeoLite2 ASN](https://dev.maxmind.com/geoip/geoip2/geolite2/)|ipv4 hash:net|disabled|updated every 7 days from [this link](http://geolite.maxmind.com/download/geoip/database/GeoLite2-ASN-CSV.zip)
[geolite2_country](https://github.com/firehol/blocklist-ipsets/tree/master/geolite2_country)|[MaxMind GeoLite2](http://dev.maxmind.com/geoip/geoip2/geolite2/) databases are free IP geolocation databases comparable to, but less accurate than, MaxMinds GeoIP2 databases. They include IPs per country, IPs per continent, IPs used by anonymous services (VPNs, Proxies, etc) and Satellite Providers.|ipv4 hash:net|All the world|updated every 7 days from [this link](http://geolite.maxmind.com/download/geoip/database/GeoLite2-Country-CSV.zip)
gofferje_sip|[Stefan Gofferje](http://stefan.gofferje.net/it-stuff/sipfraud/sip-attacker-blacklist) A personal blacklist of networks and IPs of SIP attackers. To end up here, the IP or network must have been the origin of considerable and repeated attacks on my PBX and additionally, the ISP didn't react to any complaint. Note from the author: I don't give any guarantees of accuracy, completeness or even usability! USE AT YOUR OWN RISK! Also note that I block complete countries, namely China, Korea and Palestine with blocklists from ipdeny.com, so some attackers will never even get the chance to get noticed by me to be put on this blacklist. I also don't accept any liabilities related to this blocklist. If you're an ISP and don't like your IPs being listed here, too bad! You should have done something about your customers' behavior and reacted to my complaints. This blocklist is nothing but an expression of my personal opinion and exercising my right of free speech.|ipv4 hash:net|disabled|updated every 6 hours from [this link](http://stefan.gofferje.net/sipblocklist.zone)
[gpf_comics](http://iplists.firehol.org/?ipset=gpf_comics)|The GPF DNS Block List is a list of IP addresses on the Internet that have attacked the [GPF Comics](http://www.gpf-comics.com/) family of Web sites. IPs on this block list have been banned from accessing all of our servers because they were caught in the act of spamming, attempting to exploit our scripts, scanning for vulnerabilities, or consuming resources to the detriment of our human visitors.|ipv4 hash:ip|3400 unique IPs|updated every 1 day from [this link](https://www.gpf-comics.com/dnsbl/export.php)
[graphiclineweb](http://iplists.firehol.org/?ipset=graphiclineweb)|[GraphiclineWeb](https://graphiclineweb.wordpress.com/tech-notes/ip-blacklist/) The IPs, Hosts and Domains listed in this table are banned universally from accessing websites controlled by the maintainer. Some form of bad activity has been seen from the addresses listed. Bad activity includes: unwanted spiders, rule breakers, comment spammers, trackback spammers, spambots, hacker bots, registration bots and other scripting attackers, harvesters, nuisance spiders, spy bots and organizations spying on websites for commercial reasons.|ipv4 hash:net|2579 subnets, 330527 unique IPs|updated every 1 day from [this link](https://graphiclineweb.wordpress.com/tech-notes/ip-blacklist/)
[greensnow](http://iplists.firehol.org/?ipset=greensnow)|[GreenSnow](https://greensnow.co/) is a team harvesting a large number of IPs from different computers located around the world. GreenSnow is comparable with SpamHaus.org for attacks of any kind except for spam. Their list is updated automatically and you can withdraw at any time your IP address if it has been listed. Attacks / bruteforce that are monitored are: Scan Port, FTP, POP3, mod_security, IMAP, SMTP, SSH, cPanel, etc.|ipv4 hash:ip|4768 unique IPs|updated every 30 mins from [this link](http://blocklist.greensnow.co/greensnow.txt)
[haley_ssh](http://iplists.firehol.org/?ipset=haley_ssh)|[Charles Haley](http://charles.the-haleys.org) IPs launching SSH dictionary attacks.|ipv4 hash:ip|62779 unique IPs|updated every 4 hours from [this link](http://charles.the-haleys.org/ssh_dico_attack_hdeny_format.php/hostsdeny.txt)
[hphosts_ats](http://iplists.firehol.org/?ipset=hphosts_ats)|[hpHosts](http://hosts-file.net/?s=Download) ad/tracking servers listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|13037 unique IPs|updated every 1 day from [this link](http://hosts-file.net/ad_servers.txt)
[hphosts_emd](http://iplists.firehol.org/?ipset=hphosts_emd)|[hpHosts](http://hosts-file.net/?s=Download) malware sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|59204 unique IPs|updated every 1 day from [this link](http://hosts-file.net/emd.txt)
[hphosts_exp](http://iplists.firehol.org/?ipset=hphosts_exp)|[hpHosts](http://hosts-file.net/?s=Download) exploit sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|196 unique IPs|updated every 1 day from [this link](http://hosts-file.net/exp.txt)
[hphosts_fsa](http://iplists.firehol.org/?ipset=hphosts_fsa)|[hpHosts](http://hosts-file.net/?s=Download) fraud sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|24764 unique IPs|updated every 1 day from [this link](http://hosts-file.net/fsa.txt)
[hphosts_grm](http://iplists.firehol.org/?ipset=hphosts_grm)|[hpHosts](http://hosts-file.net/?s=Download) sites involved in spam (that do not otherwise meet any other classification criteria) listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|293 unique IPs|updated every 1 day from [this link](http://hosts-file.net/grm.txt)
[hphosts_hfs](http://iplists.firehol.org/?ipset=hphosts_hfs)|[hpHosts](http://hosts-file.net/?s=Download) sites spamming the hpHosts forums (and not meeting any other classification criteria) listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|245 unique IPs|updated every 1 day from [this link](http://hosts-file.net/hfs.txt)
[hphosts_hjk](http://iplists.firehol.org/?ipset=hphosts_hjk)|[hpHosts](http://hosts-file.net/?s=Download) hijack sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|152 unique IPs|updated every 1 day from [this link](http://hosts-file.net/hjk.txt)
[hphosts_mmt](http://iplists.firehol.org/?ipset=hphosts_mmt)|[hpHosts](http://hosts-file.net/?s=Download) sites involved in misleading marketing (e.g. fake Flash update adverts) listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|960 unique IPs|updated every 1 day from [this link](http://hosts-file.net/mmt.txt)
[hphosts_pha](http://iplists.firehol.org/?ipset=hphosts_pha)|[hpHosts](http://hosts-file.net/?s=Download) illegal pharmacy sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|2474 unique IPs|updated every 1 day from [this link](http://hosts-file.net/pha.txt)
[hphosts_psh](http://iplists.firehol.org/?ipset=hphosts_psh)|[hpHosts](http://hosts-file.net/?s=Download) phishing sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|44781 unique IPs|updated every 1 day from [this link](http://hosts-file.net/psh.txt)
[hphosts_wrz](http://iplists.firehol.org/?ipset=hphosts_wrz)|[hpHosts](http://hosts-file.net/?s=Download) warez/piracy sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|905 unique IPs|updated every 1 day from [this link](http://hosts-file.net/wrz.txt)
[iblocklist_abuse_palevo](http://iplists.firehol.org/?ipset=iblocklist_abuse_palevo)|palevotracker.abuse.ch IP blocklist.|ipv4 hash:net|12 subnets, 12 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=erqajhwrxiuvjxqrrwfj&fileformat=p2p&archiveformat=gz)
[iblocklist_abuse_spyeye](http://iplists.firehol.org/?ipset=iblocklist_abuse_spyeye)|spyeyetracker.abuse.ch IP blocklist.|ipv4 hash:net|83 subnets, 84 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=zvjxsfuvdhoxktpeiokq&fileformat=p2p&archiveformat=gz)
[iblocklist_abuse_zeus](http://iplists.firehol.org/?ipset=iblocklist_abuse_zeus)|zeustracker.abuse.ch IP blocklist that contains IP addresses which are currently beeing tracked on the abuse.ch ZeuS Tracker.|ipv4 hash:net|209 subnets, 212 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=ynkdjqsjyfmilsgbogqf&fileformat=p2p&archiveformat=gz)
[iblocklist_ads](http://iplists.firehol.org/?ipset=iblocklist_ads)|Advertising trackers and a short list of bad/intrusive porn sites.|ipv4 hash:net|3384 subnets, 888569 unique IPs|updated every 12 hours
[iblocklist_badpeers](http://iplists.firehol.org/?ipset=iblocklist_badpeers)|IPs that have been reported for bad deeds in p2p.|ipv4 hash:net|48578 subnets, 1569289 unique IPs|updated every 12 hours
[iblocklist_bogons](http://iplists.firehol.org/?ipset=iblocklist_bogons)|Unallocated address space.|ipv4 hash:net|2691 subnets, 643576487 unique IPs|updated every 12 hours
[iblocklist_ciarmy_malicious](http://iplists.firehol.org/?ipset=iblocklist_ciarmy_malicious)|ciarmy.com IP blocklist. Based on information from a network of Sentinel devices deployed around the world, they compile a list of known bad IP addresses. Sentinel devices are uniquely positioned to pick up traffic from bad guys without requiring any type of signature-based or rate-based identification. If an IP is identified in this way by a significant number of Sentinels, the IP is malicious and should be blocked.|ipv4 hash:net|13327 subnets, 15000 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=npkuuhuxcsllnhoamkvm&fileformat=p2p&archiveformat=gz)
[iblocklist_cidr_report_bogons](http://iplists.firehol.org/?ipset=iblocklist_cidr_report_bogons)|cidr-report.org IP list of Unallocated address space.|ipv4 hash:net|6510 subnets, 605329368 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=lujdnbasfaaixitgmxpp&fileformat=p2p&archiveformat=gz)
[iblocklist_cruzit_web_attacks](http://iplists.firehol.org/?ipset=iblocklist_cruzit_web_attacks)|CruzIT IP list with individual IP addresses of compromised machines scanning for vulnerabilities and DDOS attacks.|ipv4 hash:net|12076 subnets, 12329 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=czvaehmjpsnwwttrdoyl&fileformat=p2p&archiveformat=gz)
[iblocklist_dshield](http://iplists.firehol.org/?ipset=iblocklist_dshield)|known Hackers and such people.|ipv4 hash:net|16 subnets, 2566 unique IPs|updated every 12 hours
[iblocklist_edu](http://iplists.firehol.org/?ipset=iblocklist_edu)|IPs used by Educational Institutions.|ipv4 hash:net|43906 subnets, 227930260 unique IPs|updated every 12 hours
[iblocklist_exclusions](http://iplists.firehol.org/?ipset=iblocklist_exclusions)|Exclusions.|ipv4 hash:net|313 subnets, 7488 unique IPs|updated every 12 hours
[iblocklist_fornonlancomputers](http://iplists.firehol.org/?ipset=iblocklist_fornonlancomputers)|IP blocklist for non-LAN computers.|ipv4 hash:net|4 subnets, 302055424 unique IPs|updated every 12 hours
[iblocklist_forumspam](http://iplists.firehol.org/?ipset=iblocklist_forumspam)|Forum spam.|ipv4 hash:net|455 subnets, 479 unique IPs|updated every 12 hours
[iblocklist_hijacked](http://iplists.firehol.org/?ipset=iblocklist_hijacked)|Hijacked IP-Blocks. Contains hijacked IP-Blocks and known IP-Blocks that are used to deliver Spam. This list is a combination of lists with hijacked IP-Blocks. Hijacked IP space are IP blocks that are being used without permission by organizations that have no relation to original organization (or its legal successor) that received the IP block. In essence it's stealing of somebody else's IP resources.|ipv4 hash:net|513 subnets, 8802048 unique IPs|updated every 12 hours
[iblocklist_iana_multicast](http://iplists.firehol.org/?ipset=iblocklist_iana_multicast)|IANA Multicast IPs.|ipv4 hash:net|1 subnets, 268435456 unique IPs|updated every 12 hours
[iblocklist_iana_private](http://iplists.firehol.org/?ipset=iblocklist_iana_private)|IANA Private IPs.|ipv4 hash:net|58 subnets, 51643646 unique IPs|updated every 12 hours
[iblocklist_iana_reserved](http://iplists.firehol.org/?ipset=iblocklist_iana_reserved)|IANA Reserved IPs.|ipv4 hash:net|1 subnets, 536870912 unique IPs|updated every 12 hours
[iblocklist_isp_aol](http://iplists.firehol.org/?ipset=iblocklist_isp_aol)|AOL IPs.|ipv4 hash:net|16 subnets, 6627584 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=toboaiysofkflwgrttmb&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_att](http://iplists.firehol.org/?ipset=iblocklist_isp_att)|AT&T IPs.|ipv4 hash:net|35 subnets, 55845128 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=grbtkzijgrowvobvessf&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_cablevision](http://iplists.firehol.org/?ipset=iblocklist_isp_cablevision)|Cablevision IPs.|ipv4 hash:net|11 subnets, 1787136 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=dwwbsmzirrykdlvpqozb&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_charter](http://iplists.firehol.org/?ipset=iblocklist_isp_charter)|Charter IPs.|ipv4 hash:net|21 subnets, 6138112 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=htnzojgossawhpkbulqw&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_comcast](http://iplists.firehol.org/?ipset=iblocklist_isp_comcast)|Comcast IPs.|ipv4 hash:net|33 subnets, 45121536 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=rsgyxvuklicibautguia&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_embarq](http://iplists.firehol.org/?ipset=iblocklist_isp_embarq)|Embarq IPs.|ipv4 hash:net|14 subnets, 2703360 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=twdblifaysaqtypevvdp&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_qwest](http://iplists.firehol.org/?ipset=iblocklist_isp_qwest)|Qwest IPs.|ipv4 hash:net|73 subnets, 15777552 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=jezlifrpefawuoawnfez&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_sprint](http://iplists.firehol.org/?ipset=iblocklist_isp_sprint)|Sprint IPs.|ipv4 hash:net|73 subnets, 6310570 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=hngtqrhhuadlceqxbrob&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_suddenlink](http://iplists.firehol.org/?ipset=iblocklist_isp_suddenlink)|Suddenlink IPs.|ipv4 hash:net|3 subnets, 458752 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=psaoblrwylfrdsspfuiq&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_twc](http://iplists.firehol.org/?ipset=iblocklist_isp_twc)|Time Warner Cable IPs.|ipv4 hash:net|56 subnets, 15015936 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=aqtsnttnqmcucwrjmohd&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_verizon](http://iplists.firehol.org/?ipset=iblocklist_isp_verizon)|Verizon IPs.|ipv4 hash:net|22 subnets, 18087936 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=cdmdbprvldivlqsaqjol&fileformat=p2p&archiveformat=gz)
[iblocklist_level1](http://iplists.firehol.org/?ipset=iblocklist_level1)|Level 1 (for use in p2p): Companies or organizations who are clearly involved with trying to stop filesharing (e.g. Baytsp, MediaDefender, Mediasentry). Companies which anti-p2p activity has been seen from. Companies that produce or have a strong financial interest in copyrighted material (e.g. music, movie, software industries a.o.). Government ranges or companies that have a strong financial interest in doing work for governments. Legal industry ranges. IPs or ranges of ISPs from which anti-p2p activity has been observed. Basically this list will block all kinds of internet connections that most people would rather not have during their internet travels.|ipv4 hash:net|236294 subnets, 723047882 unique IPs|updated every 12 hours
[iblocklist_level2](http://iplists.firehol.org/?ipset=iblocklist_level2)|Level 2 (for use in p2p). General corporate ranges. Ranges used by labs or researchers. Proxies.|ipv4 hash:net|78367 subnets, 338091430 unique IPs|updated every 12 hours
[iblocklist_level3](http://iplists.firehol.org/?ipset=iblocklist_level3)|Level 3 (for use in p2p). Many portal-type websites. ISP ranges that may be dodgy for some reason. Ranges that belong to an individual, but which have not been determined to be used by a particular company. Ranges for things that are unusual in some way. The L3 list is aka the paranoid list.|ipv4 hash:net|18864 subnets, 137145675 unique IPs|updated every 12 hours
[iblocklist_malc0de](http://iplists.firehol.org/?ipset=iblocklist_malc0de)|malc0de.com IP blocklist. Addresses that have been identified distributing malware during the past 30 days.|ipv4 hash:net|21 subnets, 21 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=pbqcylkejciyhmwttify&fileformat=p2p&archiveformat=gz)
[iblocklist_onion_router](http://iplists.firehol.org/?ipset=iblocklist_onion_router)|The Onion Router IP addresses.|ipv4 hash:net|5586 subnets, 5791 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=togdoptykrlolpddwbvz&fileformat=p2p&archiveformat=gz)
[iblocklist_org_activision](http://iplists.firehol.org/?ipset=iblocklist_org_activision)|Activision IPs.|ipv4 hash:net|49 subnets, 4902 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=gfnxlhxsijzrcuxwzebb&fileformat=p2p&archiveformat=gz)
[iblocklist_org_apple](http://iplists.firehol.org/?ipset=iblocklist_org_apple)|Apple IPs.|ipv4 hash:net|1 subnets, 16777216 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=aphcqvpxuqgrkgufjruj&fileformat=p2p&archiveformat=gz)
[iblocklist_org_blizzard](http://iplists.firehol.org/?ipset=iblocklist_org_blizzard)|Blizzard IPs.|ipv4 hash:net|8 subnets, 16795139 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=ercbntshuthyykfkmhxc&fileformat=p2p&archiveformat=gz)
[iblocklist_org_crowd_control](http://iplists.firehol.org/?ipset=iblocklist_org_crowd_control)|Crowd Control Productions IPs.|ipv4 hash:net|2 subnets, 768 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=eveiyhgmusglurfmjyag&fileformat=p2p&archiveformat=gz)
[iblocklist_org_electronic_arts](http://iplists.firehol.org/?ipset=iblocklist_org_electronic_arts)|Electronic Arts IPs.|ipv4 hash:net|42 subnets, 69720 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=ejqebpcdmffinaetsvxj&fileformat=p2p&archiveformat=gz)
[iblocklist_org_joost](http://iplists.firehol.org/?ipset=iblocklist_org_joost)|Joost IPs.|ipv4 hash:net|4 subnets, 16779456 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=alxugfmeszbhpxqfdits&fileformat=p2p&archiveformat=gz)
[iblocklist_org_linden_lab](http://iplists.firehol.org/?ipset=iblocklist_org_linden_lab)|Linden Lab IPs.|ipv4 hash:net|11 subnets, 23600 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=qnjdimxnaupjmpqolxcv&fileformat=p2p&archiveformat=gz)
[iblocklist_org_logmein](http://iplists.firehol.org/?ipset=iblocklist_org_logmein)|LogMeIn IPs.|ipv4 hash:net|13 subnets, 16781568 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=tgbankumtwtrzllndbmb&fileformat=p2p&archiveformat=gz)
[iblocklist_org_microsoft](http://iplists.firehol.org/?ipset=iblocklist_org_microsoft)|Microsoft IP ranges.|ipv4 hash:net|901 subnets, 1848599 unique IPs|updated every 12 hours
[iblocklist_org_ncsoft](http://iplists.firehol.org/?ipset=iblocklist_org_ncsoft)|NCsoft IPs.|ipv4 hash:net|5 subnets, 12560 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=mwjuwmebrnzyyxpbezxu&fileformat=p2p&archiveformat=gz)
[iblocklist_org_nintendo](http://iplists.firehol.org/?ipset=iblocklist_org_nintendo)|Nintendo IPs.|ipv4 hash:net|45 subnets, 3927 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=pevkykuhgaegqyayzbnr&fileformat=p2p&archiveformat=gz)
[iblocklist_org_pandora](http://iplists.firehol.org/?ipset=iblocklist_org_pandora)|Pandora IPs.|ipv4 hash:net|1 subnets, 2048 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=aevzidimyvwybzkletsg&fileformat=p2p&archiveformat=gz)
[iblocklist_org_pirate_bay](http://iplists.firehol.org/?ipset=iblocklist_org_pirate_bay)|The Pirate Bay IPs.|ipv4 hash:net|5 subnets, 323 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=nzldzlpkgrcncdomnttb&fileformat=p2p&archiveformat=gz)
[iblocklist_org_punkbuster](http://iplists.firehol.org/?ipset=iblocklist_org_punkbuster)|Punkbuster IPs.|ipv4 hash:net|1 subnets, 1 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=zvwwndvzulqcltsicwdg&fileformat=p2p&archiveformat=gz)
[iblocklist_org_riot_games](http://iplists.firehol.org/?ipset=iblocklist_org_riot_games)|Riot Games IPs.|ipv4 hash:net|6 subnets, 1792 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=sdlvfabdjvrdttfjotcy&fileformat=p2p&archiveformat=gz)
[iblocklist_org_sony_online](http://iplists.firehol.org/?ipset=iblocklist_org_sony_online)|Sony Online Entertainment IPs.|ipv4 hash:net|7 subnets, 24616 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=tukpvrvlubsputmkmiwg&fileformat=p2p&archiveformat=gz)
[iblocklist_org_square_enix](http://iplists.firehol.org/?ipset=iblocklist_org_square_enix)|Square Enix IPs.|ipv4 hash:net|2 subnets, 4112 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=odyaqontcydnodrlyina&fileformat=p2p&archiveformat=gz)
[iblocklist_org_steam](http://iplists.firehol.org/?ipset=iblocklist_org_steam)|Steam IPs.|ipv4 hash:net|53 subnets, 596448 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=cnxkgiklecdaihzukrud&fileformat=p2p&archiveformat=gz)
[iblocklist_org_ubisoft](http://iplists.firehol.org/?ipset=iblocklist_org_ubisoft)|Ubisoft IPs.|ipv4 hash:net|10 subnets, 5308 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=etmcrglomupyxtaebzht&fileformat=p2p&archiveformat=gz)
[iblocklist_org_xfire](http://iplists.firehol.org/?ipset=iblocklist_org_xfire)|XFire IPs.|ipv4 hash:net|3 subnets, 3328 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=ppqqnyihmcrryraaqsjo&fileformat=p2p&archiveformat=gz)
[iblocklist_pedophiles](http://iplists.firehol.org/?ipset=iblocklist_pedophiles)|IP ranges of people who we have found to be sharing child pornography in the p2p community.|ipv4 hash:net|29188 subnets, 847889 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=dufcxgnbjsdwmwctgfuj&fileformat=p2p&archiveformat=gz)
[iblocklist_proxies](http://iplists.firehol.org/?ipset=iblocklist_proxies)|Open Proxies IPs list (without TOR)|ipv4 hash:ip|672 unique IPs|updated every 12 hours
[iblocklist_rangetest](http://iplists.firehol.org/?ipset=iblocklist_rangetest)|Suspicious IPs that are under investigation.|ipv4 hash:net|576 subnets, 4280758 unique IPs|updated every 12 hours
[iblocklist_spamhaus_drop](http://iplists.firehol.org/?ipset=iblocklist_spamhaus_drop)|Spamhaus.org DROP (Don't Route Or Peer) list.|ipv4 hash:net|1015 subnets, 20124160 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=zbdlwrqkabxbcppvrnos&fileformat=p2p&archiveformat=gz)
[iblocklist_spider](http://iplists.firehol.org/?ipset=iblocklist_spider)|IP list intended to be used by webmasters to block hostile spiders from their web sites.|ipv4 hash:net|773 subnets, 846788 unique IPs|updated every 12 hours
[iblocklist_spyware](http://iplists.firehol.org/?ipset=iblocklist_spyware)|Known malicious SPYWARE and ADWARE IP Address ranges. It is compiled from various sources, including other available spyware blacklists, HOSTS files, from research found at many of the top anti-spyware forums, logs of spyware victims, etc.|ipv4 hash:net|3365 subnets, 339055 unique IPs|updated every 12 hours
[iblocklist_webexploit](http://iplists.firehol.org/?ipset=iblocklist_webexploit)|Web server hack and exploit attempts. IP addresses related to current web server hack and exploit attempts that have been logged or can be found in and cross referenced with other related IP databases. Malicious and other non search engine bots will also be listed here, along with anything found that can have a negative impact on a website or webserver such as proxies being used for negative SEO hijacks, unauthorised site mirroring, harvesting, scraping, snooping and data mining / spy bot / security & copyright enforcement companies that target and continuosly scan webservers.|ipv4 hash:ip|15382 unique IPs|updated every 12 hours
[iblocklist_yoyo_adservers](http://iplists.firehol.org/?ipset=iblocklist_yoyo_adservers)|pgl.yoyo.org ad servers|ipv4 hash:net|8591 subnets, 10054 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=zhogegszwduurnvsyhdf&fileformat=p2p&archiveformat=gz)
[ip2location_country](https://github.com/ktsaou/blocklist-ipsets/tree/master/ip2location_country)|[IP2Location.com](http://lite.ip2location.com/database-ip-country) geolocation database|ipv4 hash:net|All the world|updated every 1 day from [this link](http://download.ip2location.com/lite/IP2LOCATION-LITE-DB1.CSV.ZIP)
[ip2location_country_eh](http://iplists.firehol.org/?ipset=ip2location_country_eh)|Western Sahara (EH) -- [IP2Location.com](http://lite.ip2location.com/database-ip-country)|ipv4 hash:net|1 subnets, 256 unique IPs|updated every 1 day from [this link](http://download.ip2location.com/lite/IP2LOCATION-LITE-DB1.CSV.ZIP)
[ip2proxy_px1lite](http://iplists.firehol.org/?ipset=ip2proxy_px1lite)|[IP2Location.com](https://lite.ip2location.com/database/px1-ip-country) IP2Proxy LITE IP-COUNTRY Database contains IP addresses which are used as public proxies. The LITE edition is a free version of database that is limited to public proxies IP address.|ipv4 hash:net|1831031 subnets, 1861630 unique IPs|updated every 1 day
[ipblacklistcloud_recent](http://iplists.firehol.org/?ipset=ipblacklistcloud_recent)|[IP Blacklist Cloud](http://www.ip-finder.me/) These are the most recent IP addresses that have been blacklisted by websites. IP Blacklist Cloud plugin protects your WordPress based website from spam comments, gives details about login attacks which you don't even know are happening without this plugin!|ipv4 hash:ip|32 unique IPs|updated every 4 hours from [this link](http://www.ip-finder.me/download/)
[ipblacklistcloud_recent_1d](http://iplists.firehol.org/?ipset=ipblacklistcloud_recent_1d)|[IP Blacklist Cloud](http://www.ip-finder.me/) These are the most recent IP addresses that have been blacklisted by websites. IP Blacklist Cloud plugin protects your WordPress based website from spam comments, gives details about login attacks which you don't even know are happening without this plugin!|ipv4 hash:ip|32 unique IPs|updated every 4 hours from [this link](http://www.ip-finder.me/download/)
[ipblacklistcloud_recent_30d](http://iplists.firehol.org/?ipset=ipblacklistcloud_recent_30d)|[IP Blacklist Cloud](http://www.ip-finder.me/) These are the most recent IP addresses that have been blacklisted by websites. IP Blacklist Cloud plugin protects your WordPress based website from spam comments, gives details about login attacks which you don't even know are happening without this plugin!|ipv4 hash:ip|196 unique IPs|updated every 4 hours from [this link](http://www.ip-finder.me/download/)
[ipblacklistcloud_recent_7d](http://iplists.firehol.org/?ipset=ipblacklistcloud_recent_7d)|[IP Blacklist Cloud](http://www.ip-finder.me/) These are the most recent IP addresses that have been blacklisted by websites. IP Blacklist Cloud plugin protects your WordPress based website from spam comments, gives details about login attacks which you don't even know are happening without this plugin!|ipv4 hash:ip|64 unique IPs|updated every 4 hours from [this link](http://www.ip-finder.me/download/)
[ipblacklistcloud_top](http://iplists.firehol.org/?ipset=ipblacklistcloud_top)|[IP Blacklist Cloud](http://www.ip-finder.me/) These are the top IP addresses that have been blacklisted by many websites. IP Blacklist Cloud plugin protects your WordPress based website from spam comments, gives details about login attacks which you don't even know are happening without this plugin!|ipv4 hash:ip|200 unique IPs|updated every 1 day from [this link](http://www.ip-finder.me/ip-full-list/)
[ipdeny_country](https://github.com/firehol/blocklist-ipsets/tree/master/ipdeny_country)|[IPDeny.com](http://www.ipdeny.com/) geolocation database|ipv4 hash:net|All the world|updated every 1 day from [this link](http://www.ipdeny.com/ipblocks/data/countries/all-zones.tar.gz)
[iw_spamlist](http://iplists.firehol.org/?ipset=iw_spamlist)|[ImproWare Antispam](http://antispam.imp.ch/) IPs sending spam, in the last 3 days|ipv4 hash:ip|0 unique IPs|updated every 1 hour from [this link](http://antispam.imp.ch/spamlist)
[iw_wormlist](http://iplists.firehol.org/?ipset=iw_wormlist)|[ImproWare Antispam](http://antispam.imp.ch/) IPs sending emails with viruses or worms, in the last 3 days|ipv4 hash:ip|0 unique IPs|updated every 1 hour from [this link](http://antispam.imp.ch/wormlist)
[lashback_ubl](http://iplists.firehol.org/?ipset=lashback_ubl)|[The LashBack UBL](http://blacklist.lashback.com/) The Unsubscribe Blacklist (UBL) is a real-time blacklist of IP addresses which are sending email to names harvested from suppression files (this is a big list, more than 500.000 IPs)|ipv4 hash:ip|37994 unique IPs|updated every 1 day from [this link](http://www.unsubscore.com/blacklist.txt)
[malc0de](http://iplists.firehol.org/?ipset=malc0de)|[Malc0de.com](http://malc0de.com) malicious IPs of the last 30 days|ipv4 hash:ip|21 unique IPs|updated every 1 day from [this link](http://malc0de.com/bl/IP_Blacklist.txt)
[malwaredomainlist](http://iplists.firehol.org/?ipset=malwaredomainlist)|[malwaredomainlist.com](http://www.malwaredomainlist.com) list of malware active ip addresses|ipv4 hash:ip|996 unique IPs|updated every 12 hours from [this link](http://www.malwaredomainlist.com/hostslist/ip.txt)
[maxmind_proxy_fraud](http://iplists.firehol.org/?ipset=maxmind_proxy_fraud)|[MaxMind.com](https://www.maxmind.com/en/high-risk-ip-sample-list) sample list of high-risk IP addresses.|ipv4 hash:ip|583 unique IPs|updated every 4 hours from [this link](https://www.maxmind.com/en/high-risk-ip-sample-list)
[myip](http://iplists.firehol.org/?ipset=myip)|[myip.ms](http://www.myip.ms/info/about) IPs identified as web bots in the last 10 days, using several sites that require human action|ipv4 hash:ip|831 unique IPs|updated every 1 day from [this link](http://www.myip.ms/files/blacklist/csf/latest_blacklist.txt)
[nixspam](http://iplists.firehol.org/?ipset=nixspam)|[NiX Spam](http://www.heise.de/ix/NiX-Spam-DNSBL-and-blacklist-for-download-499637.html) IP addresses that sent spam in the last hour - automatically generated entries without distinguishing open proxies from relays, dialup gateways, and so on. All IPs are removed after 12 hours if there is no spam from there.|ipv4 hash:ip|12095 unique IPs|updated every 15 mins from [this link](http://www.dnsbl.manitu.net/download/nixspam-ip.dump.gz)
[normshield_all_attack](http://iplists.firehol.org/?ipset=normshield_all_attack)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category attack with severity all|ipv4 hash:ip|549 unique IPs|updated every 12 hours
[normshield_all_bruteforce](http://iplists.firehol.org/?ipset=normshield_all_bruteforce)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category bruteforce with severity all|ipv4 hash:ip|196 unique IPs|updated every 12 hours
[normshield_all_ddosbot](http://iplists.firehol.org/?ipset=normshield_all_ddosbot)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category ddosbot with severity all|ipv4 hash:ip|1 unique IPs|updated every 12 hours
[normshield_all_dnsscan](http://iplists.firehol.org/?ipset=normshield_all_dnsscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category dnsscan with severity all|ipv4 hash:ip|1 unique IPs|updated every 12 hours
[normshield_all_spam](http://iplists.firehol.org/?ipset=normshield_all_spam)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category spam with severity all|ipv4 hash:ip|17 unique IPs|updated every 12 hours
[normshield_all_suspicious](http://iplists.firehol.org/?ipset=normshield_all_suspicious)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category suspicious with severity all|ipv4 hash:ip|11 unique IPs|updated every 12 hours
[normshield_all_wannacry](http://iplists.firehol.org/?ipset=normshield_all_wannacry)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category wannacry with severity all|ipv4 hash:ip|1165 unique IPs|updated every 12 hours
[normshield_all_webscan](http://iplists.firehol.org/?ipset=normshield_all_webscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category webscan with severity all|ipv4 hash:ip|46 unique IPs|updated every 12 hours
[normshield_all_wormscan](http://iplists.firehol.org/?ipset=normshield_all_wormscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category wormscan with severity all|ipv4 hash:ip|28 unique IPs|updated every 12 hours
[normshield_high_attack](http://iplists.firehol.org/?ipset=normshield_high_attack)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category attack with severity high|ipv4 hash:ip|549 unique IPs|updated every 12 hours
[normshield_high_bruteforce](http://iplists.firehol.org/?ipset=normshield_high_bruteforce)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category bruteforce with severity high|ipv4 hash:ip|196 unique IPs|updated every 12 hours
[normshield_high_ddosbot](http://iplists.firehol.org/?ipset=normshield_high_ddosbot)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category ddosbot with severity high|ipv4 hash:ip|1 unique IPs|updated every 12 hours
[normshield_high_dnsscan](http://iplists.firehol.org/?ipset=normshield_high_dnsscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category dnsscan with severity high|ipv4 hash:ip|1 unique IPs|updated every 12 hours
[normshield_high_spam](http://iplists.firehol.org/?ipset=normshield_high_spam)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category spam with severity high|ipv4 hash:ip|17 unique IPs|updated every 12 hours
[normshield_high_suspicious](http://iplists.firehol.org/?ipset=normshield_high_suspicious)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category suspicious with severity high|ipv4 hash:ip|11 unique IPs|updated every 12 hours
[normshield_high_wannacry](http://iplists.firehol.org/?ipset=normshield_high_wannacry)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category wannacry with severity high|ipv4 hash:ip|1165 unique IPs|updated every 12 hours
[normshield_high_webscan](http://iplists.firehol.org/?ipset=normshield_high_webscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category webscan with severity high|ipv4 hash:ip|46 unique IPs|updated every 12 hours
[normshield_high_wormscan](http://iplists.firehol.org/?ipset=normshield_high_wormscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category wormscan with severity high|ipv4 hash:ip|28 unique IPs|updated every 12 hours
[nt_malware_dns](http://iplists.firehol.org/?ipset=nt_malware_dns)|[No Think](http://www.nothink.org/) Malware DNS (the original list includes hostnames and domains, which are ignored)|ipv4 hash:ip|235 unique IPs|updated every 1 hour from [this link](http://www.nothink.org/blacklist/blacklist_malware_dns.txt)
[nt_malware_http](http://iplists.firehol.org/?ipset=nt_malware_http)|[No Think](http://www.nothink.org/) Malware HTTP|ipv4 hash:ip|69 unique IPs|updated every 1 hour from [this link](http://www.nothink.org/blacklist/blacklist_malware_http.txt)
[nt_malware_irc](http://iplists.firehol.org/?ipset=nt_malware_irc)|[No Think](http://www.nothink.org/) Malware IRC|ipv4 hash:ip|42 unique IPs|updated every 1 hour from [this link](http://www.nothink.org/blacklist/blacklist_malware_irc.txt)
[nt_ssh_7d](http://iplists.firehol.org/?ipset=nt_ssh_7d)|[NoThink](http://www.nothink.org/) Last 7 days SSH attacks|ipv4 hash:ip|169 unique IPs|updated every 1 hour from [this link](http://www.nothink.org/blacklist/blacklist_ssh_week.txt)
[nullsecure](http://iplists.firehol.org/?ipset=nullsecure)|[nullsecure.org](http://nullsecure.org/) This is a free threat feed provided for use in any acceptable manner. This feed was aggregated using the [Tango Honeypot Intelligence Splunk App](https://github.com/aplura/Tango) by Brian Warehime, a Senior Security Analyst at Defense Point Security.|ipv4 hash:ip|29439 unique IPs|updated every 8 hours from [this link](http://nullsecure.org/threatfeed/master.txt)
[packetmail](http://iplists.firehol.org/?ipset=packetmail)|[PacketMail.net](https://www.packetmail.net/) IP addresses that have been detected performing TCP SYN to 206.82.85.196/30 to a non-listening service or daemon. No assertion is made, nor implied, that any of the below listed IP addresses are accurate, malicious, hostile, or engaged in nefarious acts. Use this list at your own risk.|ipv4 hash:ip|3986 unique IPs|updated every 4 hours from [this link](https://www.packetmail.net/iprep.txt)
[packetmail_emerging_ips](http://iplists.firehol.org/?ipset=packetmail_emerging_ips)|[PacketMail.net](https://www.packetmail.net/) IP addresses that have been detected as potentially of interest based on the number of unique users of the packetmail IP Reputation system. No assertion is made, nor implied, that any of the below listed IP addresses are accurate, malicious, hostile, or engaged in nefarious acts. Use this list at your own risk.|ipv4 hash:ip|26 unique IPs|updated every 4 hours from [this link](https://www.packetmail.net/iprep_emerging_ips.txt)
[packetmail_mail](http://iplists.firehol.org/?ipset=packetmail_mail)|[PacketMail.net](https://www.packetmail.net/) IP addresses that have been detected performing behavior not in compliance with the requirements this system enforces for email acceptance. No assertion is made, nor implied, that any of the below listed IP addresses are accurate, malicious, hostile, or engaged in nefarious acts. Use this list at your own risk.|ipv4 hash:ip|73 unique IPs|updated every 4 hours from [this link](https://www.packetmail.net/iprep_mail.txt)
[packetmail_ramnode](http://iplists.firehol.org/?ipset=packetmail_ramnode)|[PacketMail.net](https://www.packetmail.net/) IP addresses that have been detected performing TCP SYN to 81.4.103.251 to a non-listening service or daemon. No assertion is made, nor implied, that any of the below listed IP addresses are accurate, malicious, hostile, or engaged in nefarious acts. Use this list at your own risk.|ipv4 hash:ip|2502 unique IPs|updated every 4 hours from [this link](https://www.packetmail.net/iprep_ramnode.txt)
php_bad|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) bad web hosts (this list is composed using an RSS feed)|ipv4 hash:ip|disabled|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=b&rss=1)
[php_commenters](http://iplists.firehol.org/?ipset=php_commenters)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) comment spammers (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=c&rss=1)
[php_commenters_1d](http://iplists.firehol.org/?ipset=php_commenters_1d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) comment spammers (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=c&rss=1)
[php_commenters_30d](http://iplists.firehol.org/?ipset=php_commenters_30d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) comment spammers (this list is composed using an RSS feed)|ipv4 hash:ip|1184 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=c&rss=1)
[php_commenters_7d](http://iplists.firehol.org/?ipset=php_commenters_7d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) comment spammers (this list is composed using an RSS feed)|ipv4 hash:ip|326 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=c&rss=1)
[php_dictionary](http://iplists.firehol.org/?ipset=php_dictionary)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) directory attackers (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1)
[php_dictionary_1d](http://iplists.firehol.org/?ipset=php_dictionary_1d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) directory attackers (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1)
[php_dictionary_30d](http://iplists.firehol.org/?ipset=php_dictionary_30d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) directory attackers (this list is composed using an RSS feed)|ipv4 hash:ip|1158 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1)
[php_dictionary_7d](http://iplists.firehol.org/?ipset=php_dictionary_7d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) directory attackers (this list is composed using an RSS feed)|ipv4 hash:ip|346 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1)
[php_harvesters](http://iplists.firehol.org/?ipset=php_harvesters)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) harvesters (IPs that surf the internet looking for email addresses) (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=h&rss=1)
[php_harvesters_1d](http://iplists.firehol.org/?ipset=php_harvesters_1d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) harvesters (IPs that surf the internet looking for email addresses) (this list is composed using an RSS feed)|ipv4 hash:ip|80 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=h&rss=1)
[php_harvesters_30d](http://iplists.firehol.org/?ipset=php_harvesters_30d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) harvesters (IPs that surf the internet looking for email addresses) (this list is composed using an RSS feed)|ipv4 hash:ip|531 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=h&rss=1)
[php_harvesters_7d](http://iplists.firehol.org/?ipset=php_harvesters_7d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) harvesters (IPs that surf the internet looking for email addresses) (this list is composed using an RSS feed)|ipv4 hash:ip|196 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=h&rss=1)
[php_spammers](http://iplists.firehol.org/?ipset=php_spammers)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) spam servers (IPs used by spammers to send messages) (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=s&rss=1)
[php_spammers_1d](http://iplists.firehol.org/?ipset=php_spammers_1d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) spam servers (IPs used by spammers to send messages) (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=s&rss=1)
[php_spammers_30d](http://iplists.firehol.org/?ipset=php_spammers_30d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) spam servers (IPs used by spammers to send messages) (this list is composed using an RSS feed)|ipv4 hash:ip|1140 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=s&rss=1)
[php_spammers_7d](http://iplists.firehol.org/?ipset=php_spammers_7d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) spam servers (IPs used by spammers to send messages) (this list is composed using an RSS feed)|ipv4 hash:ip|320 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=s&rss=1)
[proxylists](http://iplists.firehol.org/?ipset=proxylists)|[proxylists.net](http://www.proxylists.net/) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|2668 unique IPs|updated every 1 hour from [this link](http://www.proxylists.net/proxylists.xml)
[proxylists_1d](http://iplists.firehol.org/?ipset=proxylists_1d)|[proxylists.net](http://www.proxylists.net/) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|5094 unique IPs|updated every 1 hour from [this link](http://www.proxylists.net/proxylists.xml)
[proxylists_30d](http://iplists.firehol.org/?ipset=proxylists_30d)|[proxylists.net](http://www.proxylists.net/) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|10138 unique IPs|updated every 1 hour from [this link](http://www.proxylists.net/proxylists.xml)
[proxylists_7d](http://iplists.firehol.org/?ipset=proxylists_7d)|[proxylists.net](http://www.proxylists.net/) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|8263 unique IPs|updated every 1 hour from [this link](http://www.proxylists.net/proxylists.xml)
proxyrss|[proxyrss.com](http://www.proxyrss.com) open proxies syndicated from multiple sources.|ipv4 hash:ip|disabled|updated every 4 hours from [this link](http://www.proxyrss.com/proxylists/all.gz)
[proxyspy_1d](http://iplists.firehol.org/?ipset=proxyspy_1d)|[ProxySpy](http://spys.ru/en/) open proxies (updated hourly)|ipv4 hash:ip|300 unique IPs|updated every 1 hour from [this link](http://txt.proxyspy.net/proxy.txt)
[proxyspy_30d](http://iplists.firehol.org/?ipset=proxyspy_30d)|[ProxySpy](http://spys.ru/en/) open proxies (updated hourly)|ipv4 hash:ip|6720 unique IPs|updated every 1 hour from [this link](http://txt.proxyspy.net/proxy.txt)
[proxyspy_7d](http://iplists.firehol.org/?ipset=proxyspy_7d)|[ProxySpy](http://spys.ru/en/) open proxies (updated hourly)|ipv4 hash:ip|2828 unique IPs|updated every 1 hour from [this link](http://txt.proxyspy.net/proxy.txt)
[proxz](http://iplists.firehol.org/?ipset=proxz)|[proxz.com](http://www.proxz.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|26 unique IPs|updated every 1 hour from [this link](http://www.proxz.com/proxylists.xml)
[proxz_1d](http://iplists.firehol.org/?ipset=proxz_1d)|[proxz.com](http://www.proxz.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|266 unique IPs|updated every 1 hour from [this link](http://www.proxz.com/proxylists.xml)
[proxz_30d](http://iplists.firehol.org/?ipset=proxz_30d)|[proxz.com](http://www.proxz.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|3338 unique IPs|updated every 1 hour from [this link](http://www.proxz.com/proxylists.xml)
[proxz_7d](http://iplists.firehol.org/?ipset=proxz_7d)|[proxz.com](http://www.proxz.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|1201 unique IPs|updated every 1 hour from [this link](http://www.proxz.com/proxylists.xml)
[pushing_inertia_blocklist](http://iplists.firehol.org/?ipset=pushing_inertia_blocklist)|[Pushing Inertia](https://github.com/pushinginertia/ip-blacklist) IPs of hosting providers that are known to host various bots, spiders, scrapers, etc. to block access from these providers to web servers.|ipv4 hash:net|1279 subnets, 57166830 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/pushinginertia/ip-blacklist/master/ip_blacklist.conf)
[ransomware_cryptowall_ps](http://iplists.firehol.org/?ipset=ransomware_cryptowall_ps)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is CW_PS_IPBL: CryptoWall Ransomware Payment Sites IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/CW_PS_IPBL.txt)
[ransomware_feed](http://iplists.firehol.org/?ipset=ransomware_feed)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. The IPs in this list have been extracted from the tracker data feed.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/feeds/csv/)
[ransomware_locky_c2](http://iplists.firehol.org/?ipset=ransomware_locky_c2)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is LY_C2_IPBL: Locky Ransomware C2 URL blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/LY_C2_IPBL.txt)
[ransomware_locky_ps](http://iplists.firehol.org/?ipset=ransomware_locky_ps)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is LY_PS_IPBL: Locky Ransomware Payment Sites IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/LY_PS_IPBL.txt)
[ransomware_online](http://iplists.firehol.org/?ipset=ransomware_online)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. The IPs in this list have been extracted from the tracker data feed, filtering only online IPs.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/feeds/csv/)
[ransomware_rw](http://iplists.firehol.org/?ipset=ransomware_rw)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list includes TC_PS_IPBL, LY_C2_IPBL, TL_C2_IPBL, TL_PS_IPBL and it is the recommended blocklist. It might not catch everything, but the false positive rate should be low. However, false positives are possible, especially with regards to RW_IPBL. IP addresses associated with Ransomware Payment Sites (*_PS_IPBL) or Locky botnet C&Cs (LY_C2_IPBL) stay listed on RW_IPBL for a time of 30 days after the last appearance. This means that an IP address stays listed on RW_IPBL even after the threat has been eliminated (e.g. the VPS / server has been suspended by the hosting provider) for another 30 days.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt)
[ransomware_teslacrypt_ps](http://iplists.firehol.org/?ipset=ransomware_teslacrypt_ps)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is TC_PS_IPBL: TeslaCrypt Ransomware Payment Sites IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/TC_PS_IPBL.txt)
[ransomware_torrentlocker_c2](http://iplists.firehol.org/?ipset=ransomware_torrentlocker_c2)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is TL_C2_IPBL: TorrentLocker Ransomware C2 IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/TL_C2_IPBL.txt)
[ransomware_torrentlocker_ps](http://iplists.firehol.org/?ipset=ransomware_torrentlocker_ps)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is TL_PS_IPBL: TorrentLocker Ransomware Payment Sites IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/TL_PS_IPBL.txt)
ri_connect_proxies|[rosinstrument.com](http://www.rosinstrument.com) open CONNECT proxies (this list is composed using an RSS feed)|ipv4 hash:ip|disabled|updated every 1 hour from [this link](http://tools.rosinstrument.com/proxy/plab100.xml)
ri_web_proxies|[rosinstrument.com](http://www.rosinstrument.com) open HTTP proxies (this list is composed using an RSS feed)|ipv4 hash:ip|disabled|updated every 1 hour from [this link](http://tools.rosinstrument.com/proxy/l100.xml)
[sblam](http://iplists.firehol.org/?ipset=sblam)|[sblam.com](http://sblam.com) IPs used by web form spammers, during the last month|ipv4 hash:ip|7242 unique IPs|updated every 1 day from [this link](http://sblam.com/blacklist.txt)
[shunlist](http://iplists.firehol.org/?ipset=shunlist)|[AutoShun.org](http://autoshun.org/) IPs identified as hostile by correlating logs from distributed snort installations running the autoshun plugin|ipv4 hash:ip|500 unique IPs|updated every 4 hours
[snort_ipfilter](http://iplists.firehol.org/?ipset=snort_ipfilter)|[labs.snort.org](https://labs.snort.org/) supplied IP blacklist (this list seems to be updated frequently, but we found no information about it)|ipv4 hash:ip|836 unique IPs|updated every 12 hours from [this link](http://labs.snort.org/feeds/ip-filter.blf)
[socks_proxy](http://iplists.firehol.org/?ipset=socks_proxy)|[socks-proxy.net](http://www.socks-proxy.net/) open SOCKS proxies|ipv4 hash:ip|302 unique IPs|updated every 10 mins from [this link](http://www.socks-proxy.net/)
[socks_proxy_1d](http://iplists.firehol.org/?ipset=socks_proxy_1d)|[socks-proxy.net](http://www.socks-proxy.net/) open SOCKS proxies|ipv4 hash:ip|10317 unique IPs|updated every 10 mins from [this link](http://www.socks-proxy.net/)
[socks_proxy_30d](http://iplists.firehol.org/?ipset=socks_proxy_30d)|[socks-proxy.net](http://www.socks-proxy.net/) open SOCKS proxies|ipv4 hash:ip|53178 unique IPs|updated every 10 mins from [this link](http://www.socks-proxy.net/)
[socks_proxy_7d](http://iplists.firehol.org/?ipset=socks_proxy_7d)|[socks-proxy.net](http://www.socks-proxy.net/) open SOCKS proxies|ipv4 hash:ip|26160 unique IPs|updated every 10 mins from [this link](http://www.socks-proxy.net/)
[sorbs_anonymizers](http://iplists.firehol.org/?ipset=sorbs_anonymizers)|[Sorbs.net](https://www.sorbs.net/) List of open HTTP and SOCKS proxies.|ipv4 hash:net|597391 subnets, 610263 unique IPs|updated every 1 min
sorbs_block|[Sorbs.net](https://www.sorbs.net/) List of hosts demanding that they never be tested by SORBS.|ipv4 hash:net|disabled|
[sorbs_dul](http://iplists.firehol.org/?ipset=sorbs_dul)|[Sorbs.net](https://www.sorbs.net/) Dynamic IP Addresses.|ipv4 hash:net|607718 subnets, 375474210 unique IPs|updated every 1 min
[sorbs_escalations](http://iplists.firehol.org/?ipset=sorbs_escalations)|[Sorbs.net](https://www.sorbs.net/) Netblocks of spam supporting service providers, including those who provide websites, DNS or drop boxes for a spammer. Spam supporters are added on a 'third strike and you are out' basis, where the third spam will cause the supporter to be added to the list.|ipv4 hash:net|8 subnets, 2304 unique IPs|updated every 1 min
[sorbs_new_spam](http://iplists.firehol.org/?ipset=sorbs_new_spam)|[Sorbs.net](https://www.sorbs.net/) List of hosts that have been noted as sending spam/UCE/UBE within the last 48 hours|ipv4 hash:net|33977 subnets, 35967 unique IPs|updated every 1 min
[sorbs_noserver](http://iplists.firehol.org/?ipset=sorbs_noserver)|[Sorbs.net](https://www.sorbs.net/) IP addresses and netblocks of where system administrators and ISPs owning the network have indicated that servers should not be present.|ipv4 hash:net|15066 subnets, 22951270 unique IPs|updated every 1 min
[sorbs_recent_spam](http://iplists.firehol.org/?ipset=sorbs_recent_spam)|[Sorbs.net](https://www.sorbs.net/) List of hosts that have been noted as sending spam/UCE/UBE within the last 28 days (includes sorbs_new_spam)|ipv4 hash:net|522240 subnets, 555438 unique IPs|updated every 1 min
[sorbs_smtp](http://iplists.firehol.org/?ipset=sorbs_smtp)|[Sorbs.net](https://www.sorbs.net/) List of SMTP Open Relays.|ipv4 hash:net|1968 subnets, 1976 unique IPs|updated every 1 min
[sorbs_web](http://iplists.firehol.org/?ipset=sorbs_web)|[Sorbs.net](https://www.sorbs.net/) List of IPs which have spammer abusable vulnerabilities (e.g. FormMail scripts)|ipv4 hash:net|5895259 subnets, 6375029 unique IPs|updated every 1 min
[sorbs_zombie](http://iplists.firehol.org/?ipset=sorbs_zombie)|[Sorbs.net](https://www.sorbs.net/) List of networks hijacked from their original owners, some of which have already used for spamming.|ipv4 hash:net|78 subnets, 1903876 unique IPs|updated every 1 min
[spamhaus_drop](http://iplists.firehol.org/?ipset=spamhaus_drop)|[Spamhaus.org](http://www.spamhaus.org) DROP list (according to their site this list should be dropped at tier-1 ISPs globally)|ipv4 hash:net|1015 subnets, 20124160 unique IPs|updated every 12 hours from [this link](http://www.spamhaus.org/drop/drop.txt)
[spamhaus_edrop](http://iplists.firehol.org/?ipset=spamhaus_edrop)|[Spamhaus.org](http://www.spamhaus.org) EDROP (extended matches that should be used with DROP)|ipv4 hash:net|63 subnets, 965632 unique IPs|updated every 12 hours from [this link](http://www.spamhaus.org/drop/edrop.txt)
[sslbl](http://iplists.firehol.org/?ipset=sslbl)|[Abuse.ch SSL Blacklist](https://sslbl.abuse.ch/) bad SSL traffic related to malware or botnet activities|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://sslbl.abuse.ch/blacklist/sslipblacklist.csv)
[sslbl_aggressive](http://iplists.firehol.org/?ipset=sslbl_aggressive)|[Abuse.ch SSL Blacklist](https://sslbl.abuse.ch/) The aggressive version of the SSL IP Blacklist contains all IPs that SSLBL ever detected being associated with a malicious SSL certificate. Since IP addresses can be reused (e.g. when the customer changes), this blacklist may cause false positives. Hence I highly recommend you to use the standard version instead of the aggressive one.|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.csv)
[sslproxies](http://iplists.firehol.org/?ipset=sslproxies)|[SSLProxies.org](http://www.sslproxies.org/) open SSL proxies|ipv4 hash:ip|102 unique IPs|updated every 10 mins from [this link](http://www.sslproxies.org/)
[sslproxies_1d](http://iplists.firehol.org/?ipset=sslproxies_1d)|[SSLProxies.org](http://www.sslproxies.org/) open SSL proxies|ipv4 hash:ip|1071 unique IPs|updated every 10 mins from [this link](http://www.sslproxies.org/)
[sslproxies_30d](http://iplists.firehol.org/?ipset=sslproxies_30d)|[SSLProxies.org](http://www.sslproxies.org/) open SSL proxies|ipv4 hash:ip|4717 unique IPs|updated every 10 mins from [this link](http://www.sslproxies.org/)
[sslproxies_7d](http://iplists.firehol.org/?ipset=sslproxies_7d)|[SSLProxies.org](http://www.sslproxies.org/) open SSL proxies|ipv4 hash:ip|2302 unique IPs|updated every 10 mins from [this link](http://www.sslproxies.org/)
[stopforumspam](http://iplists.firehol.org/?ipset=stopforumspam)|[StopForumSpam.com](http://www.stopforumspam.com) Banned IPs used by forum spammers|ipv4 hash:ip|205979 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/bannedips.zip)
[stopforumspam_180d](http://iplists.firehol.org/?ipset=stopforumspam_180d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers (last 180 days)|ipv4 hash:ip|367223 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/listed_ip_180.zip)
[stopforumspam_1d](http://iplists.firehol.org/?ipset=stopforumspam_1d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers in the last 24 hours|ipv4 hash:ip|7572 unique IPs|updated every 1 hour from [this link](http://www.stopforumspam.com/downloads/listed_ip_1.zip)
[stopforumspam_30d](http://iplists.firehol.org/?ipset=stopforumspam_30d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers (last 30 days)|ipv4 hash:ip|89413 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/listed_ip_30.zip)
[stopforumspam_365d](http://iplists.firehol.org/?ipset=stopforumspam_365d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers (last 365 days)|ipv4 hash:ip|624240 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/listed_ip_365.zip)
[stopforumspam_7d](http://iplists.firehol.org/?ipset=stopforumspam_7d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers (last 7 days)|ipv4 hash:ip|28041 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/listed_ip_7.zip)
[stopforumspam_90d](http://iplists.firehol.org/?ipset=stopforumspam_90d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers (last 90 days)|ipv4 hash:ip|206326 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/listed_ip_90.zip)
[stopforumspam_toxic](http://iplists.firehol.org/?ipset=stopforumspam_toxic)|[StopForumSpam.com](http://www.stopforumspam.com) Networks that have large amounts of spambots and are flagged as toxic. Toxic IP ranges are infrequently changed.|ipv4 hash:net|45 subnets, 120651 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/toxic_ip_cidr.txt)
[taichung](http://iplists.firehol.org/?ipset=taichung)|[Taichung Education Center](https://www.tc.edu.tw/net/netflow/lkout/recent/30) Blocked IP Addresses (attacks and bots).|ipv4 hash:ip|2658 unique IPs|updated every 1 day from [this link](https://www.tc.edu.tw/net/netflow/lkout/recent/30)
[talosintel_ipfilter](http://iplists.firehol.org/?ipset=talosintel_ipfilter)|[TalosIntel.com](http://talosintel.com/additional-resources/) List of known malicious network threats|ipv4 hash:ip|732 unique IPs|updated every 15 mins from [this link](http://talosintel.com/feeds/ip-filter.blf)
[threatcrowd](http://iplists.firehol.org/?ipset=threatcrowd)|[Crowdsourced IP feed from ThreatCrowd](http://threatcrowd.blogspot.gr/2016/02/crowdsourced-feeds-from-threatcrowd.html). These feeds are not a substitute for the scale of auto-extracted command and control domains or the quality of some commercially provided feeds. But crowd-sourcing does go some way towards the quick sharing of threat intelligence between the community.|ipv4 hash:ip|977 unique IPs|updated every 1 hour from [this link](https://www.threatcrowd.org/feeds/ips.txt)
[tor_exits](http://iplists.firehol.org/?ipset=tor_exits)|[TorProject.org](https://www.torproject.org) list of all current TOR exit points (TorDNSEL)|ipv4 hash:ip|1366 unique IPs|updated every 5 mins from [this link](https://check.torproject.org/exit-addresses)
[tor_exits_1d](http://iplists.firehol.org/?ipset=tor_exits_1d)|[TorProject.org](https://www.torproject.org) list of all current TOR exit points (TorDNSEL)|ipv4 hash:ip|1366 unique IPs|updated every 5 mins from [this link](https://check.torproject.org/exit-addresses)
[tor_exits_30d](http://iplists.firehol.org/?ipset=tor_exits_30d)|[TorProject.org](https://www.torproject.org) list of all current TOR exit points (TorDNSEL)|ipv4 hash:ip|1410 unique IPs|updated every 5 mins from [this link](https://check.torproject.org/exit-addresses)
[tor_exits_7d](http://iplists.firehol.org/?ipset=tor_exits_7d)|[TorProject.org](https://www.torproject.org) list of all current TOR exit points (TorDNSEL)|ipv4 hash:ip|1366 unique IPs|updated every 5 mins from [this link](https://check.torproject.org/exit-addresses)
[turris_greylist](http://iplists.firehol.org/?ipset=turris_greylist)|[Turris Greylist](https://www.turris.cz/en/greylist) IPs that are blocked on the firewalls of Turris routers. The data is processed and clasified every week and behaviour of IP addresses that accessed a larger number of Turris routers is evaluated. The result is a list of addresses that have tried to obtain information about services on the router or tried to gain access to them. We do not recommend to use these data as a list of addresses that should be blocked but it can be used for example in analysis of the traffic in other networks.|ipv4 hash:ip|8209 unique IPs|updated every 7 days from [this link](https://www.turris.cz/greylist-data/greylist-latest.csv)
[urandomusto_dns](http://iplists.firehol.org/?ipset=urandomusto_dns)|IP Feed about dns, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|67 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=dns&out=txt&submit=go)
[urandomusto_ftp](http://iplists.firehol.org/?ipset=urandomusto_ftp)|IP Feed about ftp, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|152 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=ftp&out=txt&submit=go)
[urandomusto_http](http://iplists.firehol.org/?ipset=urandomusto_http)|IP Feed about http, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|289 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=http&out=txt&submit=go)
[urandomusto_mailer](http://iplists.firehol.org/?ipset=urandomusto_mailer)|IP Feed about mailer, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|259 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=mailer&out=txt&submit=go)
[urandomusto_malware](http://iplists.firehol.org/?ipset=urandomusto_malware)|IP Feed about malware, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|1 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=malware&out=txt&submit=go)
[urandomusto_ntp](http://iplists.firehol.org/?ipset=urandomusto_ntp)|IP Feed about ntp, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|72 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=ntp&out=txt&submit=go)
[urandomusto_rdp](http://iplists.firehol.org/?ipset=urandomusto_rdp)|IP Feed about rdp, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|133 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=rdp&out=txt&submit=go)
[urandomusto_smb](http://iplists.firehol.org/?ipset=urandomusto_smb)|IP Feed about smb, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|45 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=smb&out=txt&submit=go)
[urandomusto_spam](http://iplists.firehol.org/?ipset=urandomusto_spam)|IP Feed about spam, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|4 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=spam&out=txt&submit=go)
[urandomusto_ssh](http://iplists.firehol.org/?ipset=urandomusto_ssh)|IP Feed about ssh, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|126 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=ssh&out=txt&submit=go)
[urandomusto_telnet](http://iplists.firehol.org/?ipset=urandomusto_telnet)|IP Feed about telnet, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|299 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=telnet&out=txt&submit=go)
[urandomusto_unspecified](http://iplists.firehol.org/?ipset=urandomusto_unspecified)|IP Feed about unspecified, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|178 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=unspecified&out=txt&submit=go)
[urandomusto_vnc](http://iplists.firehol.org/?ipset=urandomusto_vnc)|IP Feed about vnc, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|27 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=vnc&out=txt&submit=go)
[urlvir](http://iplists.firehol.org/?ipset=urlvir)|[URLVir.com](http://www.urlvir.com/) Active Malicious IP Addresses Hosting Malware. URLVir is an online security service developed by NoVirusThanks Company Srl that automatically monitors changes of malicious URLs (executable files).|ipv4 hash:ip|171 unique IPs|updated every 1 day from [this link](http://www.urlvir.com/export-ip-addresses/)
[uscert_hidden_cobra](http://iplists.firehol.org/?ipset=uscert_hidden_cobra)|Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace. DHS and FBI assess that HIDDEN COBRA actors will continue to use cyber operations to advance their governments military and strategic objectives. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware. Variants of malware and tools used by HIDDEN COBRA actors include Destover, Wild Positron/Duuzer and Hangman.|ipv4 hash:ip|627 unique IPs|updated every 1 day from [this link](https://www.us-cert.gov/sites/default/files/publications/TA-17-164A_csv.csv)
[voipbl](http://iplists.firehol.org/?ipset=voipbl)|[VoIPBL.org](http://www.voipbl.org/) a distributed VoIP blacklist that is aimed to protects against VoIP Fraud and minimizing abuse for network that have publicly accessible PBX's. Several algorithms, external sources and manual confirmation are used before they categorize something as an attack and determine the threat level.|ipv4 hash:net|19501 subnets, 20999 unique IPs|updated every 4 hours from [this link](http://www.voipbl.org/update/)
[vxvault](http://iplists.firehol.org/?ipset=vxvault)|[VxVault](http://vxvault.net) The latest 100 additions of VxVault.|ipv4 hash:ip|57 unique IPs|updated every 12 hours from [this link](http://vxvault.net/ViriList.php?s=0&m=100)
[xforce_bccs](http://iplists.firehol.org/?ipset=xforce_bccs)|[IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/) Botnet Command and Control Servers|ipv4 hash:ip|412 unique IPs|updated every 1 day from [this link](https://api.xforce.ibmcloud.com/taxii)
[xroxy](http://iplists.firehol.org/?ipset=xroxy)|[xroxy.com](http://www.xroxy.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|58 unique IPs|updated every 1 hour from [this link](http://www.xroxy.com/proxyrss.xml)
[xroxy_1d](http://iplists.firehol.org/?ipset=xroxy_1d)|[xroxy.com](http://www.xroxy.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|58 unique IPs|updated every 1 hour from [this link](http://www.xroxy.com/proxyrss.xml)
[xroxy_30d](http://iplists.firehol.org/?ipset=xroxy_30d)|[xroxy.com](http://www.xroxy.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|532 unique IPs|updated every 1 hour from [this link](http://www.xroxy.com/proxyrss.xml)
[xroxy_7d](http://iplists.firehol.org/?ipset=xroxy_7d)|[xroxy.com](http://www.xroxy.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|58 unique IPs|updated every 1 hour from [this link](http://www.xroxy.com/proxyrss.xml)
[yoyo_adservers](http://iplists.firehol.org/?ipset=yoyo_adservers)|[Yoyo.org](http://pgl.yoyo.org/adservers/) IPs of ad servers|ipv4 hash:ip|10054 unique IPs|updated every 12 hours from [this link](http://pgl.yoyo.org/adservers/iplist.php?ipformat=plain&showintro=0&mimetype=plaintext)
zeus|[Abuse.ch Zeus tracker](https://zeustracker.abuse.ch) standard, contains the same data as the ZeuS IP blocklist (zeus_badips) but with the slight difference that it doesn't exclude hijacked websites (level 2) and free web hosting providers (level 3). This means that this blocklist contains all IPv4 addresses associated with ZeuS C&Cs which are currently being tracked by ZeuS Tracker. Hence this blocklist will likely cause some false positives.|ipv4 hash:ip|disabled|updated every 30 mins from [this link](https://zeustracker.abuse.ch/blocklist.php?download=ipblocklist)
zeus_badips|[Abuse.ch Zeus tracker](https://zeustracker.abuse.ch) badips includes IPv4 addresses that are used by the ZeuS trojan. It is the recommened blocklist if you want to block only ZeuS IPs. It excludes IP addresses that ZeuS Tracker believes to be hijacked (level 2) or belong to a free web hosting provider (level 3). Hence the false postive rate should be much lower compared to the standard ZeuS IP blocklist.|ipv4 hash:ip|disabled|updated every 30 mins from [this link](https://zeustracker.abuse.ch/blocklist.php?download=badips)

610
alienvault_reputation.ipset Normal file
View File

@ -0,0 +1,610 @@
#
# alienvault_reputation
#
# ipv4 hash:ip ipset
#
# [AlienVault.com] (https://www.alienvault.com/) IP
# reputation database
#
# Maintainer : Alien Vault
# Maintainer URL : https://www.alienvault.com/
# List source URL : https://reputation.alienvault.com/reputation.generic
# Source File Date: Fri Sep 3 03:40:48 UTC 2021
#
# Category : reputation
# Version : 4100
#
# This File Date : Fri Sep 3 03:48:17 UTC 2021
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 580 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=alienvault_reputation
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.1.188.23
1.234.41.218
1.246.222.38
1.246.222.41
1.246.223.82
1.246.223.83
1.246.223.146
1.246.223.223
3.139.188.148
4.71.37.45
4.71.37.46
5.182.216.204
5.189.162.164
14.173.226.168
14.240.55.102
14.248.164.165
18.116.216.184
23.243.213.63
24.188.100.85
24.212.27.190
27.17.119.69
27.35.58.5
27.38.61.20
27.38.61.122
27.38.254.234
27.40.78.209
27.43.108.151
27.45.8.11
27.201.170.101
27.203.123.114
27.208.141.222
27.215.50.112
27.215.53.94
27.215.85.42
27.215.125.141
27.215.192.48
27.215.226.79
27.217.219.90
31.173.16.94
31.208.67.136
34.106.219.215
35.196.187.116
35.232.220.184
36.251.18.208
39.65.70.128
39.65.248.24
39.84.155.95
39.86.250.213
39.87.64.10
39.134.165.19
40.117.100.8
41.86.18.35
41.86.21.52
42.193.250.90
45.141.84.35
45.141.84.215
45.143.200.54
45.146.164.110
45.229.54.8
45.229.54.57
45.229.54.59
45.229.54.96
45.229.54.112
45.229.54.133
45.229.54.141
45.229.54.164
45.229.54.218
45.229.54.233
45.229.54.250
45.229.54.252
45.229.55.13
45.229.55.81
45.229.55.83
45.248.194.48
46.4.123.15
47.103.201.98
49.37.146.120
49.89.22.179
49.114.149.224
49.143.32.6
49.206.116.240
51.38.58.203
51.158.125.239
52.15.110.24
52.82.21.51
52.152.139.147
58.248.145.70
58.248.193.2
58.248.193.9
58.248.193.18
58.248.193.81
58.248.193.86
58.248.193.107
58.248.193.145
58.248.193.167
58.248.193.174
58.248.193.202
58.248.193.215
58.248.193.220
58.248.193.248
58.249.74.201
58.249.83.229
58.249.84.162
58.249.91.144
58.249.110.74
58.249.110.131
58.252.205.4
58.253.51.48
58.255.203.171
59.63.204.76
59.63.204.242
59.63.207.69
60.20.200.125
60.212.219.149
60.214.102.93
61.32.31.209
61.52.4.168
61.129.101.59
61.155.0.253
61.160.247.34
61.242.40.16
61.242.40.28
61.242.40.30
61.242.40.55
61.242.40.68
61.242.40.89
61.242.40.100
61.242.40.119
61.242.40.132
61.242.40.160
61.242.40.198
61.242.40.201
61.242.40.203
61.242.40.213
61.242.40.216
61.242.40.223
61.242.40.225
61.242.54.7
61.242.54.12
61.242.54.16
61.242.54.56
61.242.54.58
61.242.54.83
61.242.54.94
61.242.54.133
61.242.54.134
61.242.54.145
61.242.54.150
61.242.54.151
61.242.54.159
61.242.54.160
61.242.54.165
61.242.54.170
61.242.54.171
61.242.54.172
61.242.54.186
61.242.54.197
61.242.54.204
61.242.54.211
61.242.54.219
61.242.54.225
61.242.54.234
61.242.54.236
61.242.58.9
61.242.58.15
61.242.58.27
61.242.58.29
61.242.58.45
61.242.58.46
61.242.58.64
61.242.58.68
61.242.58.88
61.242.58.106
61.242.58.148
61.242.58.152
61.242.58.157
61.242.58.163
61.242.58.164
61.242.58.169
61.242.58.174
61.242.58.198
61.242.58.199
61.242.58.203
64.39.106.91
64.39.106.123
64.227.90.185
71.6.135.131
71.164.108.123
72.90.201.50
74.102.39.43
75.119.140.117
75.119.140.120
77.234.40.136
78.173.186.62
78.187.192.44
80.14.216.204
80.246.81.123
81.68.179.203
82.151.123.31
83.110.155.113
83.150.63.208
83.251.143.42
84.53.216.200
84.119.146.69
85.105.219.98
89.208.122.221
91.132.58.20
91.132.58.102
91.188.215.198
91.234.62.220
91.234.62.225
91.234.62.249
92.124.148.142
93.43.95.193
99.225.109.225
100.27.42.241
100.27.42.242
100.27.42.243
100.27.42.244
101.0.49.180
101.0.57.62
101.34.130.93
101.108.147.78
103.24.188.67
103.40.172.173
103.40.172.174
103.40.172.189
103.40.172.190
103.41.25.52
103.47.104.225
103.47.104.226
103.47.104.234
103.47.104.241
103.52.250.116
103.91.245.47
103.106.29.148
103.138.94.87
103.211.189.195
103.217.117.224
103.249.106.47
106.111.36.145
106.124.158.143
110.25.95.241
110.185.146.93
110.251.200.249
110.253.36.79
110.255.197.187
111.38.103.114
111.38.123.197
111.48.159.207
111.90.191.7
111.92.73.77
111.92.74.120
111.92.81.65
111.92.119.254
111.222.15.142
111.231.202.210
112.27.123.173
112.27.124.110
112.30.1.158
112.30.1.238
112.30.38.19
112.30.38.98
112.30.110.30
112.30.110.52
112.30.110.58
112.30.110.63
112.81.80.137
112.94.96.44
112.94.96.241
112.94.97.6
112.94.97.9
112.94.97.31
112.94.97.116
112.94.97.182
112.94.97.216
112.94.98.2
112.94.98.6
112.94.98.27
112.94.98.49
112.94.99.99
112.94.99.145
112.94.101.79
112.94.102.113
112.94.187.58
112.95.83.169
112.123.109.120
112.234.159.116
112.239.113.101
112.247.47.125
112.247.132.224
112.248.101.142
112.248.111.131
112.248.113.44
112.248.116.146
112.248.245.204
112.252.130.68
113.88.152.97
113.141.83.7
113.235.121.100
114.33.13.68
114.199.200.140
114.215.186.128
114.246.34.26
114.246.35.154
114.247.113.144
114.255.249.172
115.42.32.124
115.50.61.48
115.59.213.201
115.74.16.106
115.159.205.39
116.68.96.138
116.68.100.53
116.68.101.2
116.68.110.154
116.177.15.105
116.211.100.26
117.15.2.75
117.20.222.138
117.63.233.39
117.63.234.228
117.161.12.146
117.200.76.163
118.233.93.72
119.179.248.183
119.179.253.177
119.189.225.194
119.236.128.231
120.12.147.51
120.48.25.231
120.48.27.90
120.82.119.237
120.84.109.7
120.85.91.19
120.85.91.139
120.85.91.160
120.85.92.106
120.85.93.175
120.85.93.211
120.85.93.230
120.85.94.31
120.85.94.68
120.85.94.92
120.85.94.180
120.85.105.106
120.85.112.24
120.85.112.84
120.85.112.88
120.85.112.125
120.85.112.158
120.85.112.191
120.85.112.200
120.85.112.232
120.85.113.32
120.85.113.64
120.85.113.94
120.85.113.101
120.85.113.147
120.85.113.201
120.85.113.227
120.85.113.232
120.85.114.4
120.85.114.135
120.85.114.157
120.85.114.161
120.85.114.168
120.85.114.178
120.85.114.186
120.85.114.196
120.85.114.240
120.85.114.253
120.85.115.1
120.85.115.23
120.85.115.29
120.85.115.35
120.85.115.89
120.85.115.107
120.85.115.153
120.85.116.12
120.85.116.16
120.85.116.62
120.85.116.70
120.85.116.177
120.85.116.224
120.85.117.44
120.85.117.48
120.85.117.126
120.85.118.24
120.85.118.76
120.85.118.94
120.85.118.114
120.85.118.117
120.85.119.25
120.85.119.43
120.85.119.61
120.85.119.116
120.85.119.133
120.85.119.255
120.85.147.27
120.85.172.152
120.85.197.176
120.85.236.155
120.86.237.1
120.86.237.77
120.86.252.160
120.86.253.87
120.86.254.42
120.86.254.68
120.86.254.82
120.86.255.36
120.86.255.212
120.193.91.199
120.193.91.204
120.209.99.127
120.240.48.83
121.5.155.158
121.8.107.214
121.28.4.186
121.61.100.43
121.133.90.107
121.182.36.42
121.184.202.80
122.117.102.192
122.189.140.36
122.199.86.74
123.4.85.222
123.14.80.153
123.129.129.194
124.255.20.105
125.41.13.30
125.44.33.190
125.127.155.237
128.199.139.15
130.61.10.60
138.68.10.39
138.68.43.241
138.68.46.47
138.68.155.103
138.197.203.254
139.59.252.56
139.190.238.139
140.206.86.124
140.206.86.125
142.4.124.171
142.93.211.235
143.110.144.173
143.110.232.208
143.198.111.25
143.244.128.87
143.255.167.37
146.56.112.239
148.72.244.86
150.136.192.92
152.136.96.109
153.36.18.183
156.251.136.4
157.245.62.90
159.89.135.183
159.89.139.216
159.203.166.72
161.97.143.54
164.132.177.1
165.22.105.27
165.227.8.212
165.232.137.89
167.71.216.222
167.172.219.157
170.247.76.139
172.83.47.91
172.87.27.129
174.83.73.163
175.0.60.28
175.6.40.66
175.151.7.93
176.111.173.123
176.221.220.216
178.46.213.183
178.72.70.15
178.72.70.29
178.72.70.59
178.72.70.107
178.72.71.236
178.72.75.78
178.72.76.209
178.72.78.233
178.134.185.49
180.188.248.246
180.188.249.102
180.188.250.126
180.188.251.61
180.188.251.127
180.215.123.33
181.176.169.221
181.199.170.210
181.199.170.230
182.114.101.246
182.114.120.37
182.117.26.94
182.119.190.176
182.121.206.214
182.126.82.44
182.155.216.15
182.161.38.75
182.222.195.160
183.131.169.147
183.240.8.102
185.10.68.19
185.128.41.50
185.202.1.30
185.207.249.29
185.222.59.10
186.4.132.71
186.4.171.93
188.169.45.57
188.169.174.237
190.3.163.207
190.180.154.229
192.30.243.113
194.132.235.192
194.163.147.42
194.163.164.207
195.154.61.206
198.100.149.190
202.129.58.130
202.164.130.139
202.164.130.155
202.164.139.138
202.164.139.192
202.164.139.202
202.164.139.228
203.248.175.71
203.248.175.72
206.189.101.13
207.180.219.238
209.141.36.53
210.13.110.60
210.13.110.61
210.50.204.70
210.89.58.23
210.89.59.230
210.89.63.39
210.89.63.60
210.89.63.112
211.51.181.106
211.192.166.89
211.224.94.7
211.237.2.243
212.102.39.142
212.129.26.4
216.4.95.61
216.4.95.62
218.2.106.125
218.67.217.201
218.214.102.125
219.84.106.91
219.154.122.155
220.134.214.69
220.135.136.93
220.198.209.17
220.198.209.27
220.198.209.83
220.198.209.203
220.198.209.207
220.198.209.226
220.250.18.142
221.160.177.204
221.231.61.212
222.77.181.28
222.95.155.6
222.118.248.149
222.136.46.250
222.141.27.163
222.186.30.238
223.130.31.15
223.130.31.23
223.131.58.81
223.149.243.126
223.152.26.134
223.155.87.47

30
asprox_c2.ipset Normal file
View File

@ -0,0 +1,30 @@
#
# asprox_c2
#
# ipv4 hash:ip ipset
#
# [h3x.eu] (http://atrack.h3x.eu/) ASPROX Tracker - Asprox
# C&C Sites
#
# Maintainer : h3x.eu
# Maintainer URL : http://atrack.h3x.eu/
# List source URL : http://atrack.h3x.eu/c2
# Source File Date: Mon Nov 6 03:04:11 UTC 2017
#
# Category : malware
# Version : 1
#
# This File Date : Sun Jun 3 05:36:21 UTC 2018
# Update Frequency: 1 day
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=asprox_c2
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

167
bambenek_banjori.ipset Normal file
View File

@ -0,0 +1,167 @@
#
# bambenek_banjori
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of banjori C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/banjori-iplist.txt
# Source File Date: Wed Jul 29 20:05:53 UTC 2020
#
# Category : malware
# Version : 17534
#
# This File Date : Wed Jul 29 20:12:14 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 136 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_banjori
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
3.216.121.17
5.79.79.212
13.59.74.74
14.192.4.75
18.213.250.117
18.215.128.143
23.89.20.107
23.89.102.123
23.107.124.53
23.110.15.74
23.226.53.226
23.227.38.65
23.231.218.195
23.236.62.147
34.98.99.30
34.102.136.180
35.186.238.101
35.226.69.129
43.230.142.125
43.241.196.105
43.249.76.176
47.91.170.222
47.245.10.59
50.117.86.130
52.4.209.250
52.25.92.0
52.58.78.16
54.65.172.3
54.85.65.140
62.149.142.219
67.20.112.155
74.208.236.219
74.220.199.8
78.24.9.52
78.46.156.194
81.169.145.88
81.169.145.159
81.169.145.160
81.169.145.161
89.188.24.70
92.53.96.22
94.130.109.30
95.211.75.10
96.30.52.60
103.70.226.182
104.24.102.57
104.24.103.57
104.24.108.92
104.24.109.92
104.164.181.36
104.171.23.69
104.171.23.70
107.165.137.88
107.180.26.185
108.59.12.99
108.59.12.101
109.70.4.246
109.71.54.17
112.78.125.29
112.121.187.246
119.3.179.174
119.188.157.23
121.40.153.149
121.54.175.96
122.10.99.22
130.211.40.170
133.130.35.90
133.242.195.32
134.73.61.187
137.175.15.6
145.131.10.247
149.255.58.42
150.95.255.38
154.95.106.131
154.195.133.14
154.195.209.90
154.201.77.14
154.213.139.148
154.216.122.13
154.216.243.104
156.224.61.139
156.225.101.57
156.238.79.182
156.247.12.40
156.250.218.137
158.177.208.8
160.121.36.178
160.153.96.67
162.209.205.67
162.210.102.66
162.210.195.111
163.43.102.74
169.50.13.61
169.50.57.89
172.67.143.254
172.67.211.10
172.106.32.42
175.29.102.46
178.22.59.66
180.153.100.94
185.104.45.33
185.135.241.4
185.216.113.170
186.202.153.222
192.169.243.26
192.190.87.140
193.222.100.37
196.22.132.17
198.23.48.104
198.38.83.24
198.54.117.197
198.54.117.198
198.54.117.199
198.54.117.200
198.54.121.133
199.58.179.10
199.59.242.153
202.124.241.178
202.181.97.76
202.254.234.152
203.156.192.80
208.73.210.202
208.73.210.217
208.73.211.165
208.73.211.177
208.91.197.91
208.109.80.14
212.12.54.87
213.176.50.208
213.186.33.5
216.40.47.17
217.26.53.16
217.26.63.20
217.70.184.38
219.118.71.121
219.235.5.224

31
bambenek_bebloh.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_bebloh
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of bebloh C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/bebloh-iplist.txt
# Source File Date: Thu Jun 7 00:02:37 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:33 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_bebloh
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

517
bambenek_c2.ipset Normal file
View File

@ -0,0 +1,517 @@
#
# bambenek_c2
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) master feed of
# known, active and non-sinkholed C&Cs IP addresses
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/c2-ipmasterlist.txt
# Source File Date: Tue Apr 14 23:17:00 UTC 2020
#
# Category : malware
# Version : 16212
#
# This File Date : Tue Apr 14 23:20:06 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 486 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_c2
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
3.90.198.217
5.63.155.65
5.79.79.211
5.157.84.170
5.180.102.147
13.90.196.81
14.128.136.68
14.192.4.35
18.213.250.117
18.215.128.143
18.218.40.17
18.224.184.93
23.89.20.107
23.89.102.123
23.89.102.127
23.107.49.18
23.107.124.53
23.110.15.74
23.227.38.65
23.229.213.5
23.231.218.195
23.236.62.147
31.11.32.144
31.186.169.41
31.217.192.121
34.197.76.50
34.206.12.234
34.225.182.233
35.169.58.188
35.186.238.101
35.187.36.248
35.209.70.88
35.214.186.61
35.224.11.86
35.226.69.129
37.152.88.55
40.255.0.62
43.230.112.86
43.230.142.125
43.241.196.105
45.33.2.79
45.33.23.183
45.38.3.236
45.56.79.23
45.77.226.209
45.79.19.196
45.82.253.244
45.88.202.115
45.114.106.55
45.136.245.235
45.202.208.234
45.204.37.242
45.204.41.153
46.28.105.107
46.30.215.126
46.30.215.145
46.30.215.194
46.165.220.141
46.165.220.142
46.165.220.143
46.165.220.144
46.165.220.145
46.165.220.146
46.165.220.147
46.165.220.148
46.165.220.149
46.165.220.150
46.165.220.151
46.165.220.152
46.165.220.153
46.165.220.154
46.165.220.155
46.165.221.136
46.165.221.144
46.165.221.154
46.165.229.164
46.165.229.165
46.165.229.166
46.165.229.167
46.165.254.193
46.165.254.194
46.165.254.195
46.165.254.196
46.165.254.197
46.165.254.198
46.165.254.199
46.165.254.200
46.165.254.201
46.165.254.202
46.165.254.203
46.165.254.204
46.165.254.205
46.165.254.206
46.165.254.207
46.165.254.208
46.165.254.209
46.165.254.210
46.165.254.211
46.165.254.212
46.165.254.213
46.165.254.214
46.242.242.252
46.249.43.105
50.63.103.1
50.87.145.146
50.87.146.132
50.93.202.39
50.118.129.167
52.0.217.44
52.4.209.250
52.58.78.16
52.63.118.238
52.218.36.4
52.218.98.4
52.218.100.36
54.72.11.253
54.88.108.200
54.208.77.124
59.188.232.88
62.97.115.37
62.129.200.14
62.149.128.72
62.149.128.74
62.149.128.151
62.149.128.154
62.149.128.157
62.149.128.160
62.149.128.163
62.149.128.166
62.149.142.219
62.153.122.95
63.251.106.29
64.21.149.167
64.68.200.46
64.95.103.189
64.135.149.51
64.207.140.209
64.235.41.10
65.127.154.211
66.29.58.119
66.96.149.31
66.175.208.22
67.20.112.155
67.23.117.19
67.59.157.51
67.229.184.183
68.66.216.25
68.71.58.245
69.15.64.241
69.41.162.77
69.103.233.16
69.191.176.179
69.195.124.132
72.5.161.7
72.26.218.70
72.26.218.83
74.208.215.45
74.208.236.219
74.220.199.8
75.5.255.185
77.111.240.32
77.111.240.52
78.24.9.52
78.46.156.194
78.47.106.15
79.170.40.236
80.67.28.246
80.85.86.6
80.237.132.180
80.237.132.244
81.2.194.62
81.2.194.128
81.2.194.176
81.169.145.68
81.169.145.83
81.169.145.84
81.169.145.88
81.169.145.93
81.169.145.94
81.169.145.105
81.169.145.144
81.169.145.159
81.169.145.160
81.169.145.161
81.177.165.51
82.98.135.43
82.100.220.53
82.112.184.197
82.220.91.188
84.38.224.155
85.13.129.76
85.13.132.239
85.13.158.14
85.114.135.128
85.128.185.12
85.236.47.218
87.98.230.60
88.198.56.106
89.31.143.1
89.46.108.57
89.188.24.70
89.223.109.60
91.121.59.137
91.121.154.229
91.174.205.10
91.195.240.13
91.195.240.82
91.195.240.87
91.199.77.50
91.212.28.29
91.223.145.130
92.43.203.171
92.53.96.22
92.61.39.239
93.89.19.124
93.185.103.42
94.130.109.30
94.152.8.56
94.229.72.116
94.229.72.123
96.30.52.60
96.126.123.244
103.4.217.55
103.70.226.182
103.120.83.30
103.224.212.222
104.18.40.160
104.18.41.160
104.18.58.253
104.18.59.253
104.24.108.81
104.24.109.81
104.27.180.130
104.27.180.160
104.27.181.130
104.27.181.160
104.27.184.30
104.27.185.30
104.28.26.243
104.28.27.243
104.28.28.252
104.28.29.252
104.149.174.100
104.156.57.40
104.171.23.69
104.171.23.70
104.195.23.59
104.197.104.56
104.202.22.13
104.202.87.74
104.203.167.207
104.206.78.18
104.244.75.32
107.6.74.80
107.6.74.93
107.151.119.204
107.180.41.146
108.59.12.98
108.59.12.99
108.59.12.100
108.61.19.11
108.61.19.14
108.179.252.199
109.70.4.246
109.71.54.17
109.248.10.176
112.78.125.29
112.121.187.246
116.202.231.184
119.3.179.174
119.188.157.23
120.107.3.165
120.227.100.34
121.35.145.102
121.40.153.149
121.41.147.32
121.54.175.96
121.241.144.35
121.254.178.252
122.10.99.22
123.254.108.81
129.181.96.164
130.211.40.170
130.229.91.0
132.148.25.127
132.148.231.248
132.213.126.70
133.37.107.164
133.130.35.90
133.242.195.32
134.73.61.187
134.73.142.227
134.73.209.244
137.74.151.103
137.74.217.60
138.68.142.109
141.105.126.87
142.111.199.16
143.95.79.234
143.215.15.199
145.131.10.247
146.148.34.125
149.216.106.61
149.255.58.42
150.95.255.38
154.80.242.31
154.90.36.229
154.90.37.102
154.95.135.196
154.195.209.90
154.196.20.154
154.198.219.27
154.212.209.96
154.214.250.73
154.216.243.104
155.159.53.217
155.159.172.76
156.225.101.57
156.232.185.254
156.234.43.65
156.238.79.182
156.245.93.85
157.7.44.219
157.7.184.14
157.7.184.17
157.7.188.207
157.230.67.179
159.8.210.35
160.16.199.126
160.16.223.90
160.121.17.22
160.121.22.55
160.181.164.88
162.144.26.233
162.209.205.41
162.210.102.66
162.217.99.132
162.217.99.137
162.243.55.152
162.255.119.102
162.255.119.204
163.43.102.74
163.172.86.124
164.155.160.223
164.155.160.228
164.155.163.203
169.50.13.61
172.98.192.37
172.104.243.27
172.120.167.67
172.120.168.177
172.252.250.177
173.231.184.61
173.231.184.117
173.231.184.123
173.236.178.74
173.239.5.6
173.239.8.164
178.22.59.66
178.254.10.14
180.153.100.94
180.215.129.7
185.26.105.244
185.42.107.8
185.51.65.38
185.66.237.14
185.104.45.33
185.114.108.15
185.135.241.4
185.181.104.74
185.183.8.67
185.232.248.163
186.202.153.222
188.165.143.5
189.50.110.40
192.64.119.63
192.64.119.107
192.64.119.138
192.64.147.231
192.74.245.227
192.124.249.106
192.155.198.18
192.185.72.119
192.190.87.140
193.41.64.176
193.146.253.35
193.146.253.36
193.146.253.37
193.146.253.38
193.146.253.51
193.222.100.37
194.9.94.85
194.9.94.86
194.150.113.18
194.150.113.50
194.242.61.31
195.74.38.62
195.110.124.188
195.123.216.248
196.22.132.17
198.23.48.104
198.38.83.24
198.54.117.197
198.54.117.198
198.54.117.199
198.54.117.200
198.54.121.133
198.58.118.167
199.34.228.76
199.58.179.10
199.59.242.153
202.124.241.178
202.181.97.76
202.254.234.152
203.88.111.122
203.156.192.80
205.144.171.124
206.189.61.126
207.10.232.16
207.10.232.21
208.73.210.202
208.73.210.217
208.73.211.165
208.73.211.177
208.91.197.26
208.91.197.27
208.91.197.66
208.91.197.91
208.109.80.14
209.99.40.222
209.99.40.223
209.99.64.33
209.140.30.61
209.160.65.66
210.172.183.32
211.43.203.53
212.12.54.87
212.57.32.149
212.85.106.71
213.176.50.208
213.186.33.5
213.186.33.19
213.186.33.87
213.247.47.190
216.40.47.17
217.20.116.129
217.20.116.130
217.20.116.131
217.20.116.132
217.20.116.133
217.20.116.134
217.20.116.135
217.20.116.136
217.20.116.137
217.20.116.138
217.20.116.139
217.20.116.140
217.20.116.141
217.20.116.142
217.20.116.143
217.20.116.145
217.20.116.146
217.20.116.147
217.20.116.148
217.20.116.149
217.20.116.150
217.20.116.151
217.20.116.152
217.20.116.153
217.26.53.16
217.26.63.20
217.70.184.38
217.74.71.168
217.116.16.235
217.160.0.27
217.160.0.59
217.160.0.169
217.160.0.225
217.160.0.231
217.160.0.239
217.160.122.61
217.160.223.127
217.160.233.84
219.94.129.157
219.235.5.224
220.158.225.187

31
bambenek_cl.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_cl
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of cl C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/cl-iplist.txt
# Source File Date: Fri Dec 14 00:05:01 UTC 2018
#
# Category : malware
# Version : 18
#
# This File Date : Fri Dec 14 00:08:08 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_cl
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

31
bambenek_cryptowall.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_cryptowall
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of cryptowall C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/cryptowall-iplist.txt
# Source File Date: Thu Dec 3 12:25:05 UTC 2015
#
# Category : malware
# Version : 5
#
# This File Date : Thu Jun 7 00:08:34 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_cryptowall
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

33
bambenek_dircrypt.ipset Normal file
View File

@ -0,0 +1,33 @@
#
# bambenek_dircrypt
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of dircrypt C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/dircrypt-iplist.txt
# Source File Date: Sat Jul 18 09:06:23 UTC 2020
#
# Category : malware
# Version : 260
#
# This File Date : Sat Jul 18 09:08:07 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 2 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_dircrypt
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
164.155.216.36
169.50.13.61

31
bambenek_dyre.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_dyre
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of dyre C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/dyre-iplist.txt
# Source File Date: Thu Jun 7 00:03:08 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:34 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_dyre
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

31
bambenek_geodo.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_geodo
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of geodo C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/geodo-iplist.txt
# Source File Date: Thu Jun 7 00:02:33 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:34 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_geodo
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

33
bambenek_hesperbot.ipset Normal file
View File

@ -0,0 +1,33 @@
#
# bambenek_hesperbot
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of hesperbot C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/hesperbot-iplist.txt
# Source File Date: Sat Jul 18 10:07:53 UTC 2020
#
# Category : malware
# Version : 234
#
# This File Date : Sat Jul 18 10:12:32 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 2 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_hesperbot
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
72.5.161.7
164.155.219.11

32
bambenek_matsnu.ipset Normal file
View File

@ -0,0 +1,32 @@
#
# bambenek_matsnu
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of matsnu C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/matsnu-iplist.txt
# Source File Date: Mon Jul 27 04:09:06 UTC 2020
#
# Category : malware
# Version : 522
#
# This File Date : Mon Jul 27 04:12:41 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_matsnu
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
64.207.152.130

44
bambenek_necurs.ipset Normal file
View File

@ -0,0 +1,44 @@
#
# bambenek_necurs
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of necurs C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/necurs-iplist.txt
# Source File Date: Wed Jul 29 01:11:02 UTC 2020
#
# Category : malware
# Version : 10186
#
# This File Date : Wed Jul 29 01:16:08 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 13 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_necurs
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
40.121.206.97
64.47.209.23
64.63.188.85
64.231.250.149
65.79.10.48
65.159.138.178
66.7.34.215
66.247.157.54
68.199.246.20
69.47.125.180
69.79.159.208
70.23.145.183
70.63.91.183

31
bambenek_p2pgoz.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_p2pgoz
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of p2pgoz C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/p2pgoz-iplist.txt
# Source File Date: Sun Jul 26 15:10:57 UTC 2020
#
# Category : malware
# Version : 478
#
# This File Date : Sun Jul 26 15:16:09 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_p2pgoz
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

31
bambenek_pushdo.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_pushdo
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of pushdo C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/pushdo-iplist.txt
# Source File Date: Sat Jun 20 05:15:31 UTC 2020
#
# Category : malware
# Version : 12
#
# This File Date : Sat Jun 20 05:20:06 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_pushdo
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

36
bambenek_pykspa.ipset Normal file
View File

@ -0,0 +1,36 @@
#
# bambenek_pykspa
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of pykspa C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/pykspa-iplist.txt
# Source File Date: Wed Jul 29 04:13:10 UTC 2020
#
# Category : malware
# Version : 1373
#
# This File Date : Wed Jul 29 04:16:06 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 5 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_pykspa
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
40.255.0.62
78.47.106.15
169.50.13.61
189.50.110.40
193.146.253.37

33
bambenek_qakbot.ipset Normal file
View File

@ -0,0 +1,33 @@
#
# bambenek_qakbot
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of qakbot C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/qakbot-iplist.txt
# Source File Date: Sun Jul 26 12:13:39 UTC 2020
#
# Category : malware
# Version : 453
#
# This File Date : Sun Jul 26 12:16:47 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 2 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_qakbot
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
72.26.218.72
199.21.76.82

129
bambenek_ramnit.ipset Normal file
View File

@ -0,0 +1,129 @@
#
# bambenek_ramnit
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of ramnit C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/ramnit-iplist.txt
# Source File Date: Wed Jul 29 20:18:04 UTC 2020
#
# Category : malware
# Version : 3671
#
# This File Date : Wed Jul 29 20:24:06 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 98 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_ramnit
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.180.102.147
13.90.196.81
18.213.250.117
18.215.128.143
34.197.76.50
34.225.182.233
35.224.11.86
46.17.47.67
46.165.220.141
46.165.220.142
46.165.220.143
46.165.220.144
46.165.220.145
46.165.220.146
46.165.220.147
46.165.220.148
46.165.220.149
46.165.220.150
46.165.220.151
46.165.220.152
46.165.220.153
46.165.220.154
46.165.220.155
46.165.221.136
46.165.221.144
46.165.221.154
46.165.229.164
46.165.229.165
46.165.229.166
46.165.229.167
46.165.254.193
46.165.254.194
46.165.254.195
46.165.254.196
46.165.254.197
46.165.254.198
46.165.254.199
46.165.254.200
46.165.254.201
46.165.254.202
46.165.254.203
46.165.254.204
46.165.254.205
46.165.254.206
46.165.254.207
46.165.254.208
46.165.254.209
46.165.254.210
46.165.254.211
46.165.254.212
46.165.254.213
46.165.254.214
47.91.170.222
52.4.209.250
72.26.218.70
82.112.184.197
88.212.208.67
109.248.10.176
154.216.211.122
160.16.199.126
160.16.223.90
164.155.216.31
169.50.13.61
173.239.5.6
173.239.8.164
178.33.69.68
193.146.253.36
193.146.253.38
193.146.253.44
194.67.71.41
194.67.71.114
208.91.197.66
213.186.33.19
213.247.47.190
217.20.116.129
217.20.116.130
217.20.116.131
217.20.116.132
217.20.116.133
217.20.116.134
217.20.116.135
217.20.116.136
217.20.116.137
217.20.116.138
217.20.116.139
217.20.116.140
217.20.116.141
217.20.116.142
217.20.116.143
217.20.116.145
217.20.116.146
217.20.116.147
217.20.116.148
217.20.116.149
217.20.116.150
217.20.116.151
217.20.116.152
217.20.116.153

31
bambenek_ranbyus.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_ranbyus
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of ranbyus C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/ranbyus-iplist.txt
# Source File Date: Thu Feb 14 14:06:27 UTC 2019
#
# Category : malware
# Version : 101
#
# This File Date : Thu Feb 14 14:12:10 UTC 2019
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_ranbyus
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

162
bambenek_simda.ipset Normal file
View File

@ -0,0 +1,162 @@
#
# bambenek_simda
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of simda C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/simda-iplist.txt
# Source File Date: Wed Jul 29 20:19:03 UTC 2020
#
# Category : malware
# Version : 17362
#
# This File Date : Wed Jul 29 20:24:07 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 131 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_simda
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.157.84.170
14.128.136.68
23.89.102.127
23.236.62.147
31.11.32.144
31.186.169.41
31.217.192.121
34.98.99.30
34.102.136.180
45.82.253.244
46.28.105.107
46.30.215.127
46.30.215.202
46.242.242.252
46.249.43.105
52.25.92.0
52.58.78.16
54.65.172.3
62.97.115.37
62.129.200.14
62.149.128.72
62.149.128.74
62.149.128.151
62.149.128.154
62.149.128.157
62.149.128.160
62.149.128.163
62.149.128.166
62.149.181.236
62.153.122.95
67.229.36.115
69.162.80.54
69.162.80.58
77.111.240.49
77.111.240.59
79.170.40.236
80.85.86.6
80.237.132.180
81.2.194.62
81.2.194.128
81.2.194.176
81.169.145.68
81.169.145.84
81.169.145.93
81.169.145.94
81.169.145.105
81.169.145.161
81.177.165.51
82.98.135.43
82.100.220.53
84.38.224.155
85.13.129.76
85.13.132.239
85.114.135.128
85.128.185.12
85.236.47.218
87.98.230.60
88.198.56.106
89.31.143.1
89.46.108.57
91.121.59.137
91.121.154.229
91.174.205.10
91.195.241.136
91.199.77.50
91.212.28.29
91.223.145.130
92.43.203.171
92.61.39.239
93.185.103.42
93.190.48.3
94.152.8.56
95.211.117.215
95.211.219.65
104.27.180.160
104.27.181.160
104.28.26.243
104.28.27.243
104.28.28.252
104.28.29.252
116.202.231.184
141.105.126.87
146.148.34.125
149.216.106.61
157.7.188.207
162.217.99.134
162.255.119.102
163.172.86.124
169.50.13.61
172.67.156.67
172.67.157.206
172.67.184.127
173.236.178.74
178.254.10.14
185.26.105.244
185.51.65.38
185.66.237.14
185.114.108.15
185.181.104.74
185.183.8.67
185.232.248.163
188.93.150.101
188.165.143.5
192.64.147.231
193.41.64.176
194.9.94.85
194.9.94.86
194.150.113.18
194.242.61.31
195.74.38.62
195.110.124.188
199.34.228.76
199.59.242.153
205.144.171.124
208.91.197.91
209.140.30.61
210.172.183.32
211.43.203.53
212.57.32.149
212.85.106.71
213.186.33.5
217.70.184.38
217.74.71.168
217.116.16.235
217.160.0.59
217.160.0.97
217.160.0.169
217.160.0.225
217.160.0.239
217.160.122.61
217.160.233.84

139
bambenek_suppobox.ipset Normal file
View File

@ -0,0 +1,139 @@
#
# bambenek_suppobox
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of suppobox C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/suppobox-iplist.txt
# Source File Date: Wed Jul 29 20:19:32 UTC 2020
#
# Category : malware
# Version : 9682
#
# This File Date : Wed Jul 29 20:24:08 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 108 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_suppobox
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
18.216.20.136
23.83.35.75
23.227.38.65
23.236.62.147
34.102.136.180
34.198.7.77
34.202.122.77
34.225.38.128
35.169.225.248
35.186.238.101
35.231.184.193
39.106.40.57
43.226.23.42
45.133.2.132
45.192.23.245
45.199.245.19
46.30.213.209
46.166.189.98
52.0.7.30
54.36.56.87
54.84.104.245
62.233.121.5
63.251.235.71
66.6.44.4
66.96.161.157
67.195.197.24
67.227.226.240
69.163.184.176
69.172.201.218
72.26.218.72
74.96.70.52
74.208.236.135
75.2.37.224
80.77.123.65
81.28.232.67
83.140.241.13
84.49.232.107
87.98.242.65
89.106.12.49
94.136.40.82
95.143.172.148
97.74.182.1
98.124.199.77
103.67.235.120
104.16.12.194
104.16.13.194
104.16.14.194
104.16.15.194
104.16.16.194
104.27.188.229
104.27.189.229
104.248.50.87
104.248.60.43
104.248.63.231
104.248.63.248
106.249.28.73
112.216.156.206
121.42.239.99
121.78.197.82
121.254.178.233
137.220.193.208
138.207.69.72
139.129.156.33
150.95.255.38
151.80.184.231
154.208.167.236
157.65.171.29
157.245.130.6
159.8.210.35
161.47.102.211
162.217.99.134
162.217.99.139
162.217.99.141
162.241.194.34
162.241.224.134
162.241.224.200
162.243.212.245
162.255.119.8
162.255.119.250
172.67.154.177
173.231.184.119
173.231.189.30
173.236.166.37
185.55.85.123
192.64.119.20
192.64.119.148
192.64.119.202
192.227.107.19
193.93.253.54
194.59.222.76
198.54.117.197
198.54.117.198
198.54.117.199
198.54.117.200
199.34.228.69
199.59.242.153
206.191.152.37
206.191.152.49
207.96.1.77
208.91.197.26
208.91.197.27
208.91.197.46
208.91.197.91
208.91.197.194
212.96.137.160
213.186.33.5
213.250.113.193
217.160.0.16

32
bambenek_symmi.ipset Normal file
View File

@ -0,0 +1,32 @@
#
# bambenek_symmi
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of symmi C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/symmi-iplist.txt
# Source File Date: Fri Jun 26 10:49:11 UTC 2020
#
# Category : malware
# Version : 14
#
# This File Date : Fri Jun 26 10:56:26 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_symmi
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
208.100.26.245

35
bambenek_tinba.ipset Normal file
View File

@ -0,0 +1,35 @@
#
# bambenek_tinba
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of tinba C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/tinba-iplist.txt
# Source File Date: Wed Jul 29 16:20:23 UTC 2020
#
# Category : malware
# Version : 3576
#
# This File Date : Wed Jul 29 16:24:10 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 4 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_tinba
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
198.54.117.197
198.54.117.198
198.54.117.199
198.54.117.200

32
bambenek_volatile.ipset Normal file
View File

@ -0,0 +1,32 @@
#
# bambenek_volatile
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of volatile C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/volatile-iplist.txt
# Source File Date: Fri Feb 7 15:08:38 UTC 2020
#
# Category : malware
# Version : 10
#
# This File Date : Fri Feb 7 15:12:21 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_volatile
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
169.50.13.61

2717
bbcan177_ms1.netset Normal file

File diff suppressed because it is too large Load Diff

1175
bbcan177_ms3.netset Normal file

File diff suppressed because it is too large Load Diff

2465
bds_atif.ipset Normal file

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

6231
bitcoin_nodes.ipset Normal file

File diff suppressed because it is too large Load Diff

6840
bitcoin_nodes_1d.ipset Normal file

File diff suppressed because it is too large Load Diff

13165
bitcoin_nodes_30d.ipset Normal file

File diff suppressed because it is too large Load Diff

8704
bitcoin_nodes_7d.ipset Normal file

File diff suppressed because it is too large Load Diff

23515
blocklist_de.ipset Normal file

File diff suppressed because it is too large Load Diff

8878
blocklist_de_apache.ipset Normal file

File diff suppressed because it is too large Load Diff

137
blocklist_de_bots.ipset Normal file
View File

@ -0,0 +1,137 @@
#
# blocklist_de_bots
#
# ipv4 hash:ip ipset
#
# [Blocklist.de] (https://www.blocklist.de/) All IP addresses
# which have been reported within the last 48 hours as having
# run attacks on the RFI-Attacks, REG-Bots, IRC-Bots or
# BadBots (BadBots = it has posted a Spam-Comment on a open
# Forum or Wiki).
#
# Maintainer : Blocklist.de
# Maintainer URL : https://www.blocklist.de/
# List source URL : http://lists.blocklist.de/lists/bots.txt
# Source File Date: Fri Sep 3 09:18:07 UTC 2021
#
# Category : attacks
# Version : 35390
#
# This File Date : Fri Sep 3 09:20:05 UTC 2021
# Update Frequency: 15 mins
# Aggregation : none
# Entries : 104 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=blocklist_de_bots
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.104.110.89
5.133.198.144
34.140.2.52
34.140.77.133
35.240.115.63
46.91.55.191
46.161.11.43
46.161.11.53
46.161.11.63
46.161.11.73
46.161.11.83
46.161.11.93
46.161.11.103
46.161.11.113
46.161.11.123
66.249.64.98
66.249.64.101
66.249.64.127
66.249.79.123
66.249.79.125
66.249.79.127
81.109.86.251
88.130.134.80
106.55.160.125
106.55.168.183
106.55.250.60
111.206.198.178
111.206.198.209
111.206.222.221
116.179.32.32
116.179.32.66
116.179.32.87
116.179.32.131
116.179.37.2
116.179.37.4
116.179.37.8
116.179.37.18
116.179.37.24
116.179.37.45
116.179.37.47
116.179.37.49
116.179.37.54
116.179.37.58
116.179.37.60
116.179.37.67
116.179.37.70
116.179.37.76
116.179.37.82
116.179.37.85
116.179.37.90
116.179.37.99
116.179.37.102
116.179.37.112
116.179.37.131
116.179.37.135
116.179.37.138
116.179.37.139
116.179.37.141
116.179.37.143
116.179.37.145
116.179.37.150
116.179.37.152
116.179.37.157
116.179.37.158
116.179.37.161
116.179.37.162
116.179.37.163
116.179.37.166
116.179.37.170
116.179.37.171
116.179.37.179
116.179.37.189
116.179.37.197
116.179.37.200
116.179.37.206
116.179.37.207
116.179.37.208
116.179.37.211
116.179.37.212
116.179.37.215
116.179.37.217
116.179.37.222
116.179.37.223
116.179.37.225
116.179.37.234
116.179.37.237
116.179.37.240
116.179.37.242
116.179.37.243
116.179.37.245
119.91.114.144
120.235.126.71
125.64.94.212
135.181.75.235
138.128.109.253
144.91.125.96
144.91.125.197
183.136.225.56
185.193.52.180
192.121.158.93
192.121.158.186
192.165.113.142
199.249.230.167
213.239.216.194

View File

@ -0,0 +1,896 @@
#
# blocklist_de_bruteforce
#
# ipv4 hash:ip ipset
#
# [Blocklist.de] (https://www.blocklist.de/) All IPs which
# attacks Joomla, Wordpress and other Web-Logins with
# Brute-Force Logins.
#
# Maintainer : Blocklist.de
# Maintainer URL : https://www.blocklist.de/
# List source URL : http://lists.blocklist.de/lists/bruteforcelogin.txt
# Source File Date: Fri Sep 3 10:06:07 UTC 2021
#
# Category : attacks
# Version : 68838
#
# This File Date : Fri Sep 3 10:12:05 UTC 2021
# Update Frequency: 15 mins
# Aggregation : none
# Entries : 865 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=blocklist_de_bruteforce
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.186.121.83
1.186.122.151
3.7.224.27
3.9.181.247
3.21.90.123
3.65.207.167
3.83.181.111
5.101.157.43
8.131.70.186
13.67.114.154
13.69.130.86
13.71.7.99
13.75.40.166
13.77.201.87
13.127.4.121
13.210.86.192
13.250.49.109
14.99.119.177
14.161.23.112
14.226.249.57
14.228.112.19
18.117.199.252
18.138.146.221
18.188.217.194
18.189.11.154
18.225.5.32
20.46.42.46
20.62.193.224
20.85.121.92
20.93.203.168
20.102.127.213
20.197.199.55
23.29.122.202
23.88.38.131
23.94.120.151
23.97.205.210
23.146.241.144
23.148.145.114
24.46.199.210
27.5.143.124
27.124.127.178
27.131.131.133
27.145.249.87
31.14.161.240
31.223.78.219
34.87.100.243
34.89.201.61
34.93.37.156
34.123.169.231
34.125.8.155
34.126.168.172
34.131.177.130
35.195.29.143
35.195.251.126
35.198.229.83
35.200.137.92
35.205.44.38
35.221.181.187
35.224.216.78
35.225.94.95
35.226.194.118
35.231.49.189
35.236.172.75
35.238.155.231
36.78.187.174
36.85.221.72
36.89.251.105
37.19.213.129
37.24.72.14
37.29.41.91
37.33.1.17
37.140.192.219
37.187.17.28
37.192.26.228
39.46.93.126
39.105.217.117
39.108.0.223
39.123.249.114
40.69.160.139
40.90.253.25
40.122.130.155
40.124.105.177
41.39.154.107
41.203.58.102
41.208.72.154
41.212.30.52
41.220.235.176
41.242.49.99
41.251.13.0
42.112.31.173
42.192.199.124
42.193.1.230
42.193.21.177
42.193.193.225
42.194.139.23
43.241.193.222
44.229.111.204
45.8.227.175
45.12.32.57
45.40.166.141
45.40.166.142
45.61.146.241
45.64.54.158
45.77.171.46
45.80.172.48
45.84.226.34
45.88.110.148
45.117.81.105
45.118.144.87
45.119.212.66
45.120.69.121
45.124.142.11
45.124.142.36
45.134.144.80
45.134.225.229
45.146.161.44
45.153.160.133
45.189.30.239
45.207.65.42
46.97.170.54
46.101.87.188
46.101.115.116
46.101.150.34
46.148.234.229
46.151.190.22
46.209.193.30
46.227.96.83
46.235.70.142
46.243.183.208
46.246.41.157
47.22.188.6
47.23.35.26
47.88.102.45
47.112.232.140
47.114.3.188
47.114.4.136
47.241.31.202
47.241.216.223
47.242.61.245
47.242.169.32
47.254.172.206
47.254.247.161
49.12.207.89
49.68.146.69
49.150.53.119
49.204.225.76
49.204.229.90
49.233.209.205
49.244.36.121
49.244.42.12
49.244.56.45
49.248.16.26
51.15.27.8
51.36.32.19
51.38.132.17
51.38.227.245
51.75.200.183
51.79.157.54
51.81.28.74
51.81.81.10
51.91.123.235
51.178.146.199
51.195.235.195
51.210.223.128
51.222.27.60
52.36.227.214
52.66.242.197
52.86.228.7
52.125.141.21
52.183.8.192
52.203.213.48
52.234.128.68
52.247.246.98
54.36.165.185
54.39.29.64
54.39.105.88
54.94.28.229
54.164.149.253
54.207.5.227
54.214.60.40
54.242.57.221
58.11.55.142
58.11.70.236
58.97.227.231
58.140.210.128
58.177.156.94
59.12.193.83
59.13.120.80
60.54.133.174
61.90.8.195
61.220.197.211
62.28.191.2
62.109.15.92
62.122.254.38
62.141.38.111
62.169.181.25
62.204.247.194
62.210.82.116
62.210.97.19
62.210.114.27
62.210.114.97
62.210.122.74
62.210.180.146
63.34.207.206
64.33.179.210
64.43.89.85
64.43.89.155
64.43.89.240
64.43.90.7
64.43.90.14
64.91.250.76
64.124.38.130
64.252.89.158
64.252.114.58
66.33.212.126
66.42.57.223
66.115.173.18
67.205.12.218
67.205.44.54
67.205.61.32
67.205.61.254
67.211.219.84
67.220.184.130
68.183.7.45
68.183.92.42
68.183.225.85
68.183.232.22
69.164.207.134
69.197.163.229
72.22.151.11
72.167.42.12
74.82.230.134
74.208.103.228
74.208.136.178
75.119.141.150
77.68.17.32
77.68.119.124
77.79.246.5
77.247.110.108
77.247.110.120
78.26.243.30
78.46.90.120
78.47.111.28
78.63.14.234
78.98.36.132
79.112.220.156
80.153.94.188
80.169.210.148
80.172.253.26
80.179.219.10
80.209.139.99
80.241.141.109
80.249.164.190
80.251.219.111
81.4.100.144
81.88.52.26
81.88.52.154
81.88.52.163
81.88.52.175
81.92.156.118
81.213.127.58
82.64.135.27
82.65.205.244
82.102.16.198
82.114.78.71
82.165.69.201
82.202.172.211
82.220.8.172
83.229.58.238
83.241.149.166
84.21.188.41
84.46.13.69
84.71.127.194
84.245.236.45
84.255.199.31
85.8.185.8
85.25.213.205
85.93.88.200
85.126.136.26
85.214.223.203
86.1.128.254
87.106.204.238
87.154.246.151
87.201.20.80
88.81.91.125
89.31.189.194
89.154.96.38
91.98.100.44
91.98.100.194
91.150.190.5
91.203.111.125
91.206.200.5
91.211.91.90
91.222.140.48
91.238.164.176
91.245.72.54
92.53.120.155
92.95.75.160
92.204.54.113
93.37.81.3
93.90.177.166
93.123.233.203
93.157.120.114
93.224.20.222
94.23.86.99
94.189.252.161
94.252.121.240
95.38.149.210
95.128.43.176
95.217.3.203
95.255.112.187
96.125.171.153
101.32.26.253
101.32.178.221
101.53.234.92
102.39.178.187
102.69.130.239
102.82.40.10
102.118.132.108
102.118.161.107
102.252.65.58
103.6.150.186
103.6.244.158
103.9.159.226
103.28.37.180
103.41.26.150
103.47.60.33
103.47.60.44
103.54.249.241
103.60.175.13
103.70.28.5
103.70.29.32
103.70.29.44
103.77.0.49
103.80.54.109
103.87.25.171
103.90.235.91
103.92.235.122
103.98.30.72
103.109.28.1
103.110.85.98
103.116.16.173
103.121.89.184
103.124.94.44
103.124.95.104
103.130.218.178
103.133.105.9
103.133.108.4
103.137.165.49
103.137.165.120
103.137.165.232
103.140.244.248
103.142.25.112
103.145.169.58
103.146.176.84
103.146.177.226
103.146.224.41
103.146.224.42
103.147.10.253
103.147.92.120
103.147.184.237
103.164.54.193
103.167.90.17
103.196.235.154
103.209.153.32
103.216.62.28
103.231.162.124
103.241.136.148
103.253.194.228
103.255.4.68
103.255.73.228
104.131.13.166
104.131.68.67
104.131.76.160
104.131.102.251
104.131.161.146
104.131.167.46
104.161.80.222
104.198.1.26
104.205.237.214
104.236.45.171
104.237.143.111
104.244.73.169
104.244.77.53
104.248.155.231
104.248.233.244
106.52.141.198
106.53.103.118
106.200.197.162
106.205.207.201
107.150.60.235
107.150.60.237
107.189.2.131
107.189.4.10
107.189.4.31
107.189.30.104
107.189.31.247
108.170.55.202
108.184.1.57
109.24.144.155
109.115.162.166
109.159.90.145
109.175.24.5
109.234.160.153
110.74.172.93
110.159.227.93
110.159.227.94
110.159.227.95
110.168.25.41
110.168.29.214
110.168.30.191
110.169.33.222
110.169.145.41
110.171.21.208
111.93.56.221
112.134.104.73
112.134.105.115
112.134.107.136
112.134.108.216
112.134.111.122
113.70.243.191
113.111.82.177
113.161.72.211
114.79.145.69
115.84.112.36
115.84.182.6
115.87.227.52
116.12.133.212
116.62.48.216
116.118.48.211
116.203.45.31
116.212.142.188
117.213.202.5
117.222.220.151
117.223.251.204
118.10.56.229
118.69.173.199
118.107.139.194
118.131.79.155
118.136.191.99
118.195.187.202
121.7.2.105
121.160.115.126
121.243.95.160
122.129.220.66
122.163.28.187
122.182.207.174
123.31.43.156
124.13.240.73
124.120.30.158
124.121.95.48
124.121.176.125
124.121.177.32
124.121.236.68
124.148.26.189
124.158.11.204
124.217.255.60
125.188.36.223
125.206.171.197
125.209.73.18
128.199.18.253
128.199.111.168
128.199.151.249
128.199.220.215
128.199.248.200
129.226.48.4
130.185.182.27
130.185.182.28
130.185.182.41
130.185.182.45
130.185.182.65
130.185.182.78
130.185.182.83
130.185.182.118
130.185.182.124
130.185.182.125
130.185.182.141
130.185.182.165
130.185.182.171
130.185.182.185
131.72.236.93
131.72.236.108
131.72.236.123
131.72.236.148
134.122.21.117
134.209.146.214
134.209.152.115
134.236.250.160
135.148.12.125
135.181.203.12
136.243.174.233
136.243.251.228
137.184.75.143
138.68.168.249
138.128.176.138
138.186.236.31
138.197.157.15
138.199.31.100
139.59.10.130
139.59.25.246
139.59.33.202
139.59.83.248
139.59.118.238
139.59.248.46
139.155.225.232
141.94.70.77
142.4.10.188
142.11.204.54
142.47.216.34
142.54.171.66
142.54.171.67
142.54.177.4
142.54.177.6
142.54.181.59
142.54.181.60
142.54.188.77
142.54.188.78
142.68.179.122
142.93.225.137
142.93.253.189
143.0.19.154
143.44.164.236
143.110.157.74
143.110.188.214
143.110.224.182
143.198.52.40
143.198.229.94
143.244.161.193
144.91.105.135
144.168.230.162
144.217.123.236
144.217.139.27
145.239.15.127
146.0.33.36
146.185.134.51
147.46.62.209
147.182.248.182
148.66.129.233
148.66.129.250
148.71.238.8
148.251.129.211
149.28.151.180
149.36.239.36
149.56.26.158
149.56.132.20
149.202.47.142
149.224.68.169
150.60.156.131
150.107.189.192
151.106.32.149
151.106.35.146
151.236.58.45
153.173.4.0
154.79.249.166
155.133.142.66
156.67.218.117
156.67.220.104
156.204.81.169
157.90.143.75
157.230.4.238
157.230.141.171
157.245.55.216
157.245.57.139
157.245.110.251
157.245.148.183
158.58.187.51
159.65.76.38
159.65.118.118
159.65.191.209
159.65.219.238
159.75.71.179
159.89.89.205
159.89.234.226
159.203.37.43
159.203.101.143
159.203.115.159
159.242.234.91
160.242.72.235
161.35.60.239
161.35.74.104
161.35.126.102
161.35.161.13
161.35.208.18
161.35.222.116
161.97.90.4
162.0.237.68
162.144.66.89
162.144.195.153
162.214.108.91
162.214.121.146
162.214.122.88
162.214.198.70
162.214.229.147
162.216.161.102
162.240.5.3
162.241.67.253
162.241.69.46
162.241.200.25
162.243.8.129
162.243.144.224
163.172.39.65
164.52.207.236
164.68.100.64
165.16.98.80
165.22.213.0
165.22.255.242
165.227.129.197
165.227.170.189
165.227.228.124
165.227.230.191
165.227.239.212
166.62.125.246
167.71.69.173
167.71.193.214
167.71.199.171
167.86.124.222
167.88.60.230
167.99.54.31
167.99.68.174
167.99.157.88
167.99.163.124
167.99.227.124
167.172.151.91
167.172.175.147
168.90.157.5
168.253.229.11
170.81.247.52
171.5.169.52
171.97.30.101
171.97.42.198
171.97.153.15
171.97.153.234
171.99.147.114
171.100.122.29
171.100.122.161
171.101.69.105
171.101.224.23
171.101.225.243
171.101.226.143
171.101.227.81
171.101.227.96
171.244.8.25
171.244.50.60
172.105.154.216
173.189.210.44
173.199.126.103
173.212.223.158
173.236.136.5
173.236.139.221
173.249.56.26
174.138.36.1
176.9.54.210
176.36.89.231
176.235.216.155
177.10.60.13
177.55.111.13
177.55.111.14
177.55.112.109
177.55.116.247
178.20.40.233
178.33.237.105
178.62.230.65
178.63.103.183
178.128.93.77
178.128.125.179
178.128.202.122
178.128.211.81
178.128.247.244
180.73.246.187
180.226.131.58
180.251.182.213
181.78.27.100
182.53.193.49
182.93.24.226
182.93.59.250
182.186.175.248
182.254.156.95
185.2.4.44
185.2.4.71
185.2.6.12
185.2.6.13
185.3.235.206
185.15.21.71
185.49.20.78
185.49.20.79
185.50.199.194
185.51.202.228
185.72.243.46
185.77.145.17
185.88.178.36
185.104.44.53
185.104.249.174
185.108.30.211
185.108.31.177
185.108.31.223
185.108.31.247
185.115.83.40
185.119.216.14
185.119.216.56
185.119.216.129
185.119.216.142
185.119.217.4
185.119.218.198
185.119.218.220
185.119.219.138
185.119.219.191
185.121.81.206
185.122.201.129
185.128.26.218
185.137.220.77
185.138.223.25
185.138.223.68
185.138.223.140
185.138.223.150
185.138.223.195
185.138.223.223
185.138.223.246
185.182.56.183
185.182.57.100
185.182.228.2
185.190.39.66
185.220.101.136
185.220.101.231
185.220.102.240
185.226.64.113
185.253.74.135
185.253.97.235
186.64.114.25
186.64.114.65
186.64.114.80
186.64.115.80
186.64.115.90
186.64.116.15
186.64.116.235
186.64.117.125
186.64.118.60
186.64.118.215
186.64.119.80
186.64.119.95
186.64.119.165
186.64.119.195
186.78.246.241
186.78.248.10
186.211.79.54
186.215.143.149
187.108.198.95
187.188.202.123
187.189.171.43
187.189.234.240
188.35.131.246
188.166.209.237
188.225.18.207
189.6.222.100
189.59.69.3
189.89.154.50
189.203.145.119
190.56.50.188
190.89.95.64
190.96.96.130
190.107.177.239
190.135.1.10
190.239.201.142
191.101.209.78
191.102.120.145
191.183.97.166
192.99.207.151
192.151.145.138
192.163.251.40
192.187.114.10
192.251.238.2
193.46.255.227
193.142.146.138
193.142.146.201
193.189.100.196
193.189.100.204
194.26.29.21
194.32.153.71
194.71.145.75
194.233.75.106
195.2.92.46
195.88.50.242
195.154.167.133
195.154.173.236
195.162.70.251
195.244.21.103
196.1.238.130
196.21.218.222
196.41.122.224
196.196.203.110
196.196.203.213
196.202.215.153
196.203.219.49
196.203.248.229
197.62.118.60
198.11.177.173
198.54.128.144
198.98.48.175
198.204.234.254
198.245.63.37
199.58.78.197
200.1.212.6
200.43.37.251
200.131.21.237
200.137.215.30
200.147.58.22
201.17.158.74
201.148.139.53
201.177.140.71
201.248.68.19
202.40.178.13
202.55.134.250
202.63.242.138
202.78.235.177
202.80.212.203
202.162.198.147
202.189.179.194
203.34.37.39
203.72.56.17
203.99.57.70
203.100.67.242
203.137.115.113
203.205.21.168
203.210.102.30
203.212.244.201
203.218.98.99
205.185.116.103
205.185.119.131
206.189.133.154
206.189.139.182
207.81.2.36
207.154.212.155
207.180.203.19
207.180.206.165
207.244.233.113
208.113.153.203
209.50.61.193
209.141.46.232
209.141.50.151
209.141.59.228
209.212.158.76
209.222.96.146
209.235.136.136
210.13.75.122
210.57.216.56
210.211.113.133
210.215.153.171
210.245.80.75
210.245.90.202
212.48.107.233
212.83.160.218
212.102.50.33
212.103.77.246
212.110.92.155
213.112.164.95
213.154.22.162
213.238.167.121
216.37.42.50
216.250.248.82
217.66.226.211
217.70.186.133
217.160.9.83
222.255.77.87
223.19.28.12
223.178.226.233
223.238.173.203

124
blocklist_de_ftp.ipset Normal file
View File

@ -0,0 +1,124 @@
#
# blocklist_de_ftp
#
# ipv4 hash:ip ipset
#
# [Blocklist.de] (https://www.blocklist.de/) All IP addresses
# which have been reported within the last 48 hours for
# attacks on the Service FTP.
#
# Maintainer : Blocklist.de
# Maintainer URL : https://www.blocklist.de/
# List source URL : http://lists.blocklist.de/lists/ftp.txt
# Source File Date: Fri Sep 3 09:54:08 UTC 2021
#
# Category : attacks
# Version : 59655
#
# This File Date : Fri Sep 3 10:04:05 UTC 2021
# Update Frequency: 15 mins
# Aggregation : none
# Entries : 93 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=blocklist_de_ftp
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
14.170.154.13
14.192.203.218
27.208.232.84
36.46.100.242
36.68.216.46
36.106.199.155
39.98.217.118
39.105.129.219
41.33.13.26
42.178.91.132
45.140.17.104
47.98.170.47
47.105.183.181
47.110.246.27
49.228.205.157
58.47.59.2
58.47.124.97
59.56.54.254
60.191.219.198
61.163.38.30
81.70.153.179
85.26.167.89
89.41.43.210
91.98.96.76
101.37.33.19
103.45.249.172
103.168.198.59
103.226.248.225
103.238.231.105
111.229.22.189
111.242.193.219
112.184.70.135
113.116.171.231
113.221.22.114
114.215.211.129
115.230.83.103
116.0.1.138
116.5.129.71
116.5.144.151
116.16.41.93
116.16.44.98
116.20.231.135
117.50.120.208
117.94.205.233
118.166.253.177
120.11.235.250
120.228.206.127
121.4.58.26
121.4.66.164
121.40.113.225
121.40.174.131
121.43.186.155
121.148.71.200
121.201.110.37
122.6.176.101
122.160.115.155
122.190.171.245
122.226.177.236
123.118.76.18
123.178.150.230
124.118.186.230
125.43.11.52
125.247.59.233
131.0.178.166
139.155.106.240
139.224.63.124
140.143.229.228
148.70.16.207
148.70.150.207
153.142.111.160
162.214.230.219
166.62.177.210
175.170.19.105
183.18.52.106
183.63.226.206
183.82.56.121
187.188.201.104
189.252.155.134
203.189.141.214
208.118.197.192
210.86.146.228
211.218.98.56
218.53.132.142
218.89.226.78
221.4.211.230
221.13.137.138
221.200.215.117
221.202.168.254
221.217.88.230
222.214.222.79
223.15.176.123
223.150.222.230
223.150.245.131

3529
blocklist_de_imap.ipset Normal file

File diff suppressed because it is too large Load Diff

11747
blocklist_de_mail.ipset Normal file

File diff suppressed because it is too large Load Diff

257
blocklist_de_sip.ipset Normal file
View File

@ -0,0 +1,257 @@
#
# blocklist_de_sip
#
# ipv4 hash:ip ipset
#
# [Blocklist.de] (https://www.blocklist.de/) All IP addresses
# that tried to login in a SIP, VOIP or Asterisk Server and
# are included in the IPs list from infiltrated.net
#
# Maintainer : Blocklist.de
# Maintainer URL : https://www.blocklist.de/
# List source URL : http://lists.blocklist.de/lists/sip.txt
# Source File Date: Fri Sep 3 10:06:06 UTC 2021
#
# Category : attacks
# Version : 63207
#
# This File Date : Fri Sep 3 10:12:05 UTC 2021
# Update Frequency: 15 mins
# Aggregation : none
# Entries : 226 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=blocklist_de_sip
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
3.18.59.77
3.144.104.148
3.234.213.234
4.15.184.52
4.16.25.14
4.16.115.254
4.16.125.163
4.28.70.186
4.59.86.238
4.71.216.202
5.151.163.187
5.152.223.106
5.159.117.126
8.28.167.32
12.29.8.140
12.49.197.254
12.69.182.59
12.111.241.9
12.133.70.180
12.146.6.203
12.188.20.118
12.197.132.50
12.203.12.194
12.204.184.222
12.207.96.41
13.90.94.189
13.127.196.226
13.233.97.84
20.110.84.254
23.114.103.100
23.117.192.178
24.103.196.139
27.74.247.144
31.169.121.27
34.126.70.125
35.131.198.134
36.68.52.101
36.71.140.113
36.75.66.133
38.140.144.204
40.76.136.45
40.80.148.11
40.89.152.162
41.242.54.134
45.64.135.35
45.95.147.5
45.125.65.46
45.134.144.172
45.143.138.226
46.33.132.94
46.247.20.67
47.190.86.201
50.20.2.147
50.74.18.198
50.79.85.81
50.79.85.84
50.79.85.85
50.194.9.193
50.204.173.143
50.204.173.157
50.237.37.11
50.240.84.106
51.132.138.59
52.150.17.56
60.32.168.9
63.168.112.171
63.211.120.42
63.224.161.46
63.247.185.98
64.28.118.210
64.28.118.214
64.60.102.2
64.72.105.133
64.85.163.205
64.89.119.126
64.225.70.10
65.51.33.50
65.51.65.122
65.51.155.58
65.105.167.50
65.152.64.82
65.155.0.35
65.155.152.118
65.205.43.54
65.242.130.60
65.255.80.137
66.23.227.210
66.44.92.50
66.238.137.174
66.251.198.179
67.20.153.18
67.52.66.51
67.55.90.124
67.71.247.165
67.134.29.38
69.27.226.2
69.27.226.86
69.63.229.3
69.74.77.106
69.74.225.154
69.75.159.146
69.90.197.44
70.90.37.84
71.174.91.43
71.179.80.126
72.18.63.238
72.95.223.171
72.165.186.221
74.142.113.171
75.140.142.165
75.151.249.21
77.141.117.13
80.69.93.181
82.138.194.147
82.220.8.162
91.25.105.26
91.206.168.16
94.107.238.154
96.71.142.194
96.73.246.49
96.87.117.154
96.91.204.3
96.92.245.33
96.93.51.205
96.95.7.45
97.76.109.44
98.117.59.150
98.174.185.14
103.70.29.167
103.121.23.122
103.228.204.134
104.192.135.178
104.255.140.50
107.170.104.125
107.178.1.20
108.45.172.211
108.178.234.142
117.221.144.150
120.48.25.84
120.55.112.155
122.177.101.219
122.227.205.34
125.165.198.241
128.151.154.22
128.191.249.30
128.191.249.41
128.191.249.68
128.191.249.80
129.126.194.66
130.185.138.42
130.185.182.157
136.144.41.137
138.199.16.151
143.244.57.82
143.244.57.109
144.91.188.236
144.121.92.154
144.126.129.74
147.0.234.126
148.59.195.78
148.77.98.106
148.122.20.98
152.32.129.20
157.130.190.82
159.75.133.54
161.199.160.21
162.17.134.93
162.210.145.250
167.98.40.10
168.10.172.16
171.6.1.85
173.251.97.110
175.144.145.58
176.236.24.73
177.152.143.104
179.15.131.159
180.184.64.255
185.40.4.128
185.53.90.113
187.189.243.249
188.121.2.186
189.138.120.180
191.190.140.10
192.156.240.14
192.241.58.106
193.46.255.197
193.46.255.203
193.46.255.208
193.46.255.212
193.46.255.220
193.46.255.223
193.46.255.225
193.46.255.226
193.117.229.100
193.240.229.155
194.237.231.228
195.50.170.114
195.154.53.237
198.41.91.83
199.34.93.19
200.54.80.36
200.58.72.190
201.199.244.164
202.186.173.216
205.251.67.117
207.91.163.235
207.245.90.100
208.66.4.14
208.67.142.28
208.116.164.171
208.116.185.82
209.10.78.134
209.36.29.163
209.43.16.134
209.118.148.174
209.123.15.130
212.111.209.69
213.82.10.213
213.216.5.6
216.21.59.98
216.46.3.244
216.144.89.3
216.182.87.29
216.215.100.222
216.245.220.34
217.138.220.148

10492
blocklist_de_ssh.ipset Normal file

File diff suppressed because it is too large Load Diff

View File

@ -0,0 +1,802 @@
#
# blocklist_de_strongips
#
# ipv4 hash:ip ipset
#
# [Blocklist.de] (https://www.blocklist.de/) All IPs which
# are older then 2 month and have more then 5.000 attacks.
#
# Maintainer : Blocklist.de
# Maintainer URL : https://www.blocklist.de/
# List source URL : http://lists.blocklist.de/lists/strongips.txt
# Source File Date: Fri Sep 3 08:24:11 UTC 2021
#
# Category : attacks
# Version : 32956
#
# This File Date : Fri Sep 3 08:32:06 UTC 2021
# Update Frequency: 15 mins
# Aggregation : none
# Entries : 772 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=blocklist_de_strongips
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.56.207.130
1.119.131.102
1.179.137.10
1.179.185.50
1.202.76.226
1.235.192.218
2.82.170.124
2.184.4.3
4.7.94.244
5.3.6.82
5.188.206.98
5.188.206.99
5.188.206.100
5.188.206.101
5.188.206.102
8.209.73.223
14.21.42.158
14.136.104.38
14.140.95.157
14.225.17.9
20.188.107.54
23.97.180.45
23.247.33.61
31.210.21.26
34.80.223.251
35.186.145.141
35.199.73.100
35.244.25.124
35.245.33.180
36.22.187.34
36.67.197.52
36.80.48.9
36.82.106.238
36.91.119.221
36.110.111.51
37.139.1.197
37.252.187.140
37.252.190.224
40.118.226.96
41.78.75.45
41.221.168.167
41.223.142.211
41.226.25.4
42.118.242.189
42.159.80.91
42.200.66.164
42.200.78.78
42.200.80.42
45.7.196.77
45.55.57.6
45.55.88.16
45.55.180.7
45.55.184.78
45.55.189.252
45.55.224.209
45.55.233.213
45.55.237.182
45.80.64.246
45.119.82.251
45.124.144.116
45.133.1.6
45.133.1.99
45.133.1.130
45.133.1.252
45.142.120.11
45.173.28.1
45.183.192.14
45.232.73.83
46.101.113.206
46.101.204.20
46.101.224.184
46.101.245.176
46.146.136.8
47.50.246.114
47.176.104.74
47.190.132.213
47.245.35.63
49.88.112.60
49.88.112.65
49.88.112.68
49.88.112.69
49.88.112.71
49.88.112.72
49.88.112.73
49.88.112.75
49.88.112.77
49.88.112.110
49.88.112.112
49.88.112.113
49.88.112.115
49.88.112.117
49.88.112.118
49.233.77.12
49.234.18.158
49.234.99.246
49.234.124.225
49.234.131.75
51.15.118.15
51.158.111.168
51.254.248.18
52.188.69.174
58.33.35.82
58.33.49.196
58.57.4.238
58.65.136.170
58.210.82.250
59.13.125.142
59.56.99.130
59.152.237.118
60.30.98.194
60.171.208.199
60.249.82.121
60.250.164.169
61.93.240.18
61.133.122.19
61.155.138.100
61.177.172.158
61.177.173.2
61.177.173.7
61.177.173.8
61.177.173.9
61.177.173.11
61.177.173.24
61.177.173.25
61.177.173.27
61.177.173.28
61.177.173.31
61.177.173.32
62.28.217.62
62.28.222.221
62.92.48.242
62.148.142.202
64.202.187.246
64.213.148.44
64.225.25.59
64.225.70.10
64.227.67.106
66.49.84.65
66.98.45.242
67.207.94.180
68.116.41.6
68.183.12.127
68.183.66.107
68.183.88.186
68.183.110.49
68.183.145.59
68.183.156.109
69.55.54.65
69.172.87.212
72.167.224.135
77.109.173.12
79.120.54.174
80.244.179.6
81.4.110.153
81.182.254.124
82.64.32.76
82.65.23.62
82.196.113.78
82.200.65.218
83.12.171.68
84.1.30.70
84.2.226.70
84.255.249.179
85.247.0.210
87.246.7.212
87.246.7.228
87.246.7.245
88.132.66.26
88.157.229.58
89.97.218.142
89.163.209.26
89.232.192.40
91.231.213.51
92.50.249.166
93.39.116.254
93.51.29.92
93.108.242.140
93.115.1.195
101.36.151.78
101.69.200.162
101.71.51.192
101.96.113.50
101.231.146.34
101.231.146.36
101.236.60.31
101.255.65.138
102.53.4.42
103.21.53.11
103.26.40.145
103.31.47.58
103.48.193.7
103.57.123.1
103.63.108.25
103.76.252.6
103.86.180.10
103.89.252.123
103.92.26.252
103.125.191.106
103.125.191.233
103.129.223.98
103.133.104.182
103.136.40.88
104.131.39.193
104.131.45.150
104.131.55.236
104.131.88.229
104.131.91.148
104.131.190.193
104.131.231.109
104.198.16.231
104.236.52.94
104.236.72.182
104.236.224.69
104.236.228.230
104.236.230.165
104.236.244.98
104.248.61.192
104.248.116.140
104.248.147.78
104.248.149.130
104.248.181.156
104.248.244.119
106.12.38.109
106.12.111.201
106.12.113.204
106.12.140.168
106.12.199.30
106.12.199.117
106.12.202.180
106.12.204.81
106.12.219.184
106.13.19.75
106.13.25.242
106.13.26.62
106.13.34.131
106.13.47.10
106.13.88.44
106.13.203.62
106.51.80.198
106.51.85.16
106.52.106.61
106.54.98.89
106.54.112.173
106.75.141.160
106.241.33.158
107.170.20.247
107.170.37.74
107.170.76.170
107.170.104.125
107.170.113.190
107.170.131.23
107.170.135.29
107.170.249.6
108.36.253.227
109.227.63.3
110.45.155.101
110.80.17.26
111.21.99.227
111.93.24.98
111.93.235.74
111.95.141.34
111.132.5.132
111.161.41.156
111.161.74.106
111.161.74.113
111.161.74.118
111.229.48.141
111.229.78.120
111.229.187.216
111.229.235.119
111.231.33.135
112.21.191.10
112.26.44.112
112.64.32.118
112.64.33.38
112.78.188.194
112.85.42.72
112.95.225.158
112.166.133.216
113.31.104.89
113.200.60.74
114.4.227.194
114.67.95.121
114.67.110.227
114.199.123.211
115.124.64.126
115.159.25.60
115.182.105.68
116.132.47.50
116.228.53.227
116.247.81.99
117.232.127.51
118.24.123.34
118.27.9.23
118.40.248.20
118.89.108.37
118.101.192.62
119.29.216.238
120.31.71.238
120.35.26.129
120.88.46.226
120.92.34.203
121.15.2.178
121.46.26.17
121.46.26.126
122.4.249.171
122.51.167.43
122.51.204.45
122.51.211.131
122.51.248.76
122.166.237.117
122.202.32.70
122.225.230.10
123.126.106.88
123.140.114.196
123.143.203.67
123.206.174.21
124.29.236.163
124.160.83.138
124.160.96.249
124.239.153.215
125.19.153.156
125.99.173.162
125.141.139.9
125.141.139.29
125.212.203.113
128.199.52.4
128.199.52.45
128.199.95.60
128.199.99.204
128.199.103.239
128.199.109.128
128.199.123.0
128.199.129.68
128.199.142.0
128.199.143.19
128.199.162.2
128.199.162.108
128.199.167.161
128.199.170.33
128.199.177.224
128.199.185.42
128.199.204.164
129.28.78.8
129.152.141.71
129.158.74.141
129.204.46.170
129.211.49.17
129.211.94.30
129.226.138.179
132.232.1.155
132.232.4.33
134.122.124.193
134.175.59.225
134.175.227.112
134.209.228.253
134.209.236.191
134.209.248.200
138.68.4.8
138.68.21.125
138.68.40.92
138.68.75.113
138.68.81.162
138.68.94.173
138.68.106.62
138.68.148.177
138.68.178.64
138.68.184.70
138.68.226.175
138.197.21.218
138.197.66.68
138.197.69.184
138.197.129.38
138.197.151.213
138.197.171.79
138.197.180.102
138.197.217.164
139.59.3.114
139.59.7.177
139.59.18.197
139.59.38.252
139.59.46.243
139.59.57.39
139.59.129.45
139.59.169.103
139.59.241.75
139.186.4.114
139.198.122.19
139.198.122.76
139.198.177.151
139.199.14.128
139.215.217.180
139.215.217.181
140.86.12.31
140.86.39.162
140.143.39.177
140.143.136.89
140.206.157.242
141.98.10.125
142.93.52.3
142.93.101.148
142.93.212.10
142.93.212.91
146.185.130.101
148.66.132.190
148.72.212.161
148.235.57.183
148.235.82.68
149.129.222.60
149.129.251.152
150.242.213.189
151.69.170.146
151.236.193.195
152.231.140.150
153.101.29.178
157.230.2.208
157.230.19.72
157.230.42.76
157.230.47.241
157.230.100.192
157.230.109.166
157.230.132.100
157.230.151.241
157.230.153.75
157.230.190.90
157.245.54.200
157.245.91.72
157.245.101.31
157.245.227.165
157.245.252.34
157.245.252.154
159.65.1.41
159.65.11.115
159.65.30.66
159.65.41.104
159.65.91.105
159.65.111.89
159.65.128.182
159.65.131.92
159.65.142.192
159.65.147.235
159.65.152.201
159.65.176.156
159.65.180.64
159.65.245.182
159.89.91.67
159.89.114.40
159.89.115.74
159.89.163.226
159.89.171.81
159.89.188.167
159.89.194.103
159.89.197.1
159.89.236.71
159.192.143.249
159.203.63.125
159.203.72.14
159.203.82.179
159.203.85.196
159.203.102.122
159.203.111.100
159.203.179.230
159.203.242.122
160.153.234.236
161.35.9.18
161.35.45.62
161.35.99.173
161.35.193.16
162.243.22.191
162.243.42.225
162.243.99.164
162.243.116.41
162.243.233.102
162.243.237.90
162.248.52.82
163.44.197.129
163.172.61.214
163.172.167.225
164.77.117.10
164.163.23.19
164.163.99.10
165.22.49.42
165.22.61.82
165.22.186.178
165.169.241.28
165.227.46.89
165.227.101.226
165.227.114.134
165.227.124.168
165.227.182.136
165.227.193.157
165.227.211.13
165.227.225.195
165.232.105.80
167.71.9.180
167.71.162.16
167.99.66.2
167.99.75.240
167.99.88.37
167.99.96.114
167.99.99.10
167.99.137.75
167.172.98.89
167.172.133.221
167.172.156.12
167.172.195.99
170.150.72.28
170.210.203.201
170.210.214.50
171.244.51.114
171.244.139.178
172.81.243.232
174.138.64.163
175.24.103.72
175.123.253.220
175.126.176.21
175.138.108.78
175.139.1.34
175.140.138.193
175.193.13.3
175.198.80.24
175.207.13.22
176.111.173.13
177.22.35.126
177.44.208.107
177.91.80.8
177.189.244.193
178.62.37.78
178.62.117.106
178.62.187.136
178.62.199.240
178.62.214.85
178.128.14.102
178.128.21.38
178.128.72.84
178.128.121.137
178.128.144.227
178.128.162.10
178.128.183.90
178.128.215.16
178.128.221.85
178.128.221.162
178.128.232.28
178.128.242.233
178.128.243.225
178.128.247.181
178.128.248.121
178.217.173.54
178.234.37.197
179.27.60.34
179.107.34.178
179.232.1.254
180.71.47.198
180.76.181.47
180.76.242.204
180.76.246.38
180.97.31.28
180.97.80.12
180.166.117.254
180.167.67.133
180.168.95.234
180.180.123.227
180.250.115.121
180.250.124.227
180.250.247.45
180.250.248.170
181.48.139.118
181.48.155.149
181.49.154.26
181.52.172.107
181.53.251.181
181.209.159.166
182.52.90.164
182.61.21.155
182.61.37.35
182.61.37.144
182.61.49.107
182.73.123.118
182.74.25.246
182.75.139.26
182.156.209.222
182.253.184.20
184.70.244.67
185.38.3.138
185.56.153.236
185.74.4.17
185.74.4.189
185.118.48.206
185.194.49.132
186.4.222.45
186.10.125.209
186.85.159.135
186.96.102.198
186.122.148.216
187.12.167.85
187.18.108.73
187.109.10.100
187.123.56.57
187.174.65.4
187.188.90.141
187.188.240.7
187.189.241.135
188.6.161.77
188.128.39.127
188.152.189.220
188.166.225.37
188.170.13.225
188.226.192.115
188.254.0.2
188.254.0.112
188.254.0.160
189.7.129.60
189.7.217.23
189.8.68.56
189.206.165.62
190.0.8.134
190.1.203.180
190.24.6.162
190.52.191.49
190.94.18.2
190.144.14.170
190.145.12.233
190.145.192.106
190.145.224.18
190.156.231.245
190.171.240.51
190.202.109.244
190.202.147.253
191.31.104.17
192.141.107.58
192.241.185.120
194.61.24.152
194.61.24.153
194.61.24.154
194.61.25.28
194.152.206.93
194.152.206.103
194.170.156.9
194.204.194.11
195.24.129.234
195.122.226.164
195.158.28.62
195.222.163.54
195.224.138.61
196.1.97.216
196.15.211.91
196.15.211.92
196.27.127.61
196.38.70.24
198.23.148.137
200.41.86.59
200.52.80.34
200.54.51.124
200.70.56.204
200.88.48.99
200.92.226.50
200.105.183.118
200.108.139.242
200.108.143.6
200.116.3.133
200.219.207.42
201.72.190.98
201.116.12.217
201.149.20.162
201.163.180.183
201.222.57.21
202.47.116.107
202.88.154.70
202.154.180.51
202.163.126.134
202.188.20.123
203.66.168.81
203.95.212.41
203.128.242.166
203.130.255.2
203.159.80.219
203.159.249.215
203.172.76.4
203.192.219.7
203.217.140.77
203.245.41.96
205.185.113.140
206.189.3.176
206.189.73.164
206.189.87.108
206.189.124.254
206.189.129.144
206.189.132.8
206.189.178.171
206.189.198.237
206.189.200.15
207.154.193.178
207.154.215.3
210.5.85.150
210.16.187.206
210.21.226.2
210.206.92.137
210.211.116.204
210.212.237.67
211.22.154.223
211.26.187.128
211.220.27.191
211.234.119.189
211.241.177.69
211.253.10.96
211.253.24.250
212.33.250.241
212.70.149.56
212.70.149.71
212.70.149.88
213.87.101.176
213.141.131.22
213.158.29.179
213.230.107.202
216.6.201.3
217.111.239.37
218.4.239.146
218.18.161.186
218.25.161.226
218.56.11.236
218.56.160.82
218.75.156.247
218.75.210.46
218.90.138.98
218.92.0.190
218.92.0.191
218.92.0.200
218.92.0.201
218.92.0.202
218.92.0.203
218.92.0.205
218.92.0.206
218.92.0.207
218.94.136.90
220.78.28.68
220.88.1.208
220.123.241.30
220.132.75.140
220.133.95.68
220.225.126.55
221.122.73.130
221.131.165.23
221.131.165.56
221.131.165.87
221.156.126.1
221.181.185.19
221.181.185.135
221.181.185.140
221.181.185.151
221.181.185.159
221.181.185.198
221.181.185.220
221.181.185.223
221.213.129.46
222.99.52.216
222.101.206.56
222.112.220.12
222.122.31.133
222.127.97.91
222.185.235.186
222.186.30.76
222.186.30.112
222.186.42.7
222.186.42.13
222.186.42.137
222.186.42.213
222.186.180.130
222.187.254.38
222.187.254.41
222.222.31.70
222.255.115.237
223.197.151.55

43961
blocklist_net_ua.ipset Normal file

File diff suppressed because it is too large Load Diff

104
botscout.ipset Normal file
View File

@ -0,0 +1,104 @@
#
# botscout
#
# ipv4 hash:ip ipset
#
# [BotScout] (http://botscout.com/) helps prevent automated
# web scripts, known as bots, from registering on forums,
# polluting databases, spreading spam, and abusing forms on
# web sites. They do this by tracking the names, IPs, and
# email addresses that bots use and logging them as unique
# signatures for future reference. They also provide a simple
# yet powerful API that you can use to test forms when
# they're submitted on your site. This list is composed of
# the most recently-caught bots.
#
# Maintainer : BotScout.com
# Maintainer URL : http://botscout.com/
# List source URL : http://botscout.com/last_caught_cache.htm
# Source File Date: Fri Sep 3 10:04:22 UTC 2021
#
# Category : abuse
# Version : 47485
#
# This File Date : Fri Sep 3 10:04:22 UTC 2021
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 67 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=botscout
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.157.55.32
5.188.210.72
18.27.197.252
23.94.86.239
23.95.81.172
23.229.23.72
23.231.38.107
31.210.20.110
36.227.168.15
45.4.173.239
45.72.81.15
45.81.4.23
46.29.251.80
50.3.83.115
54.39.29.64
61.5.153.95
62.210.178.249
91.151.234.197
91.243.100.107
92.223.85.67
94.155.33.23
103.130.112.84
104.160.8.165
104.227.255.117
107.158.86.57
107.174.232.214
107.175.178.156
107.175.216.111
109.70.100.33
120.40.130.70
138.128.13.239
144.168.218.15
158.174.168.148
162.158.90.7
165.231.227.39
170.83.179.206
171.25.193.77
172.255.81.189
175.138.5.57
179.197.84.9
180.73.47.167
181.214.32.84
182.92.0.222
185.3.132.199
185.246.210.5
186.179.6.122
188.126.79.20
191.101.31.40
191.101.132.56
193.150.98.69
193.239.232.102
195.234.125.30
196.196.195.56
196.242.20.75
196.244.46.229
196.245.148.219
196.245.149.66
196.245.154.44
201.220.149.25
205.185.123.97
209.127.109.90
209.127.118.199
209.127.119.209
212.115.61.75
212.126.110.250
223.29.254.227
223.91.2.102

1548
botscout_1d.ipset Normal file

File diff suppressed because it is too large Load Diff

20862
botscout_30d.ipset Normal file

File diff suppressed because it is too large Load Diff

6468
botscout_7d.ipset Normal file

File diff suppressed because it is too large Load Diff

95
botvrij_dst.ipset Normal file
View File

@ -0,0 +1,95 @@
#
# botvrij_dst
#
# ipv4 hash:ip ipset
#
# [botvrij.eu] (http://www.botvrij.eu/) Indicators of
# Compromise (IOCS) about malicious destination IPs, gathered
# via open source information feeds (blog pages and PDF
# documents) and then consolidated into different datasets.
# To ensure the quality of the data all entries older than
# approx. 6 months are removed.
#
# Maintainer : botvrij.eu
# Maintainer URL : http://www.botvrij.eu/
# List source URL : http://www.botvrij.eu/data/ioclist.ip-dst.raw
# Source File Date: Sat Aug 28 20:01:42 UTC 2021
#
# Category : attacks
# Version : 27
#
# This File Date : Sun Aug 29 00:24:04 UTC 2021
# Update Frequency: 1 day
# Aggregation : none
# Entries : 61 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=botvrij_dst
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.2.69.14
5.254.43.18
23.106.223.174
45.77.64.111
45.77.252.175
45.95.11.158
45.248.10.244
64.32.25.202
68.65.122.109
73.234.155.208
74.208.73.149
77.61.36.169
80.85.155.80
80.92.205.81
81.91.177.54
82.118.21.1
85.93.88.165
86.105.18.116
89.34.111.11
89.45.4.192
91.192.103.43
94.130.110.78
103.77.192.219
104.21.49.220
104.140.114.110
104.223.143.132
104.248.49.97
104.250.191.110
107.180.72.97
107.180.73.34
107.180.73.135
108.61.246.56
110.42.4.180
112.66.255.71
116.203.37.39
134.122.120.22
139.59.56.239
149.28.14.163
157.230.221.198
161.35.1.207
161.35.1.225
161.35.45.41
161.35.51.41
161.35.76.1
162.244.80.235
165.232.154.116
167.99.168.251
167.99.239.29
169.50.13.61
182.18.152.105
185.141.63.120
185.243.214.107
185.250.151.72
188.166.162.201
191.101.5.183
192.81.208.169
193.38.54.110
194.87.69.35
198.101.242.72
203.160.69.66
211.56.98.146

34
botvrij_src.ipset Normal file
View File

@ -0,0 +1,34 @@
#
# botvrij_src
#
# ipv4 hash:ip ipset
#
# [botvrij.eu] (http://www.botvrij.eu/) Indicators of
# Compromise (IOCS) about malicious source IPs, gathered via
# open source information feeds (blog pages and PDF
# documents) and then consolidated into different datasets.
# To ensure the quality of the data all entries older than
# approx. 6 months are removed.
#
# Maintainer : botvrij.eu
# Maintainer URL : http://www.botvrij.eu/
# List source URL : http://www.botvrij.eu/data/ioclist.ip-src.raw
# Source File Date: Wed May 30 20:46:06 UTC 2018
#
# Category : attacks
# Version : 5
#
# This File Date : Thu Jun 7 00:07:35 UTC 2018
# Update Frequency: 1 day
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=botvrij_src
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

1807
bruteforceblocker.ipset Normal file

File diff suppressed because it is too large Load Diff

15031
ciarmy.ipset Normal file

File diff suppressed because it is too large Load Diff

6542
cidr_report_bogons.netset Normal file

File diff suppressed because it is too large Load Diff

4549
cleanmx_phishing.ipset Normal file

File diff suppressed because it is too large Load Diff

12221
cleanmx_viruses.ipset Normal file

File diff suppressed because it is too large Load Diff

505
cleantalk.ipset Normal file
View File

@ -0,0 +1,505 @@
#
# cleantalk
#
# ipv4 hash:ip ipset
#
# [CleanTalk] (https://cleantalk.org/) Today's HTTP Spammers
# (includes: cleantalk_new cleantalk_updated)
#
# Maintainer : CleanTalk
# Maintainer URL : https://cleantalk.org/
# List source URL :
# Source File Date: Thu Sep 2 13:44:10 UTC 2021
#
# Category : abuse
# Version : 22582
#
# This File Date : Thu Sep 2 13:44:10 UTC 2021
# Update Frequency: 1 min
# Aggregation : none
# Entries : 475 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=cleantalk
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
2.28.25.15
5.14.149.205
5.169.43.221
12.215.72.27
23.31.99.169
24.21.38.249
24.134.42.201
31.10.136.107
32.220.127.150
34.71.127.65
34.105.142.177
36.84.98.12
37.45.10.140
38.104.196.126
39.144.93.87
42.118.18.224
45.53.195.170
46.70.77.30
49.146.34.36
50.251.48.41
54.167.227.113
59.92.199.90
61.5.108.88
62.14.69.105
62.18.34.85
62.195.48.61
66.76.45.54
68.132.194.29
69.75.111.66
69.115.207.79
69.131.80.104
69.234.73.211
70.27.239.100
70.29.132.188
70.114.76.115
71.172.32.253
72.218.170.209
73.1.23.125
73.45.7.164
73.106.205.162
73.149.200.204
73.164.241.110
74.103.25.122
74.215.54.144
77.10.110.75
78.92.127.160
79.0.10.118
79.107.72.4
79.198.199.4
79.208.246.214
79.222.88.86
79.241.130.96
80.174.185.242
80.180.182.219
81.250.51.128
82.12.185.135
82.159.18.17
84.47.62.108
86.17.236.4
86.89.255.58
86.166.29.104
87.125.5.25
88.155.62.69
88.220.46.18
88.230.144.133
90.240.129.45
91.251.87.139
93.87.230.108
94.222.5.236
95.92.92.171
99.224.39.199
102.67.67.247
102.101.174.37
105.71.20.103
105.226.53.80
106.128.193.217
109.221.148.211
110.42.231.13
110.238.43.241
111.95.96.3
112.202.58.40
115.135.139.82
124.253.196.209
125.235.212.133
135.125.70.140
142.114.232.157
151.45.41.165
151.47.166.49
151.224.49.144
157.38.31.7
161.22.27.98
162.221.31.218
162.225.57.108
167.179.174.216
168.232.83.106
168.253.110.250
171.5.70.244
172.73.1.144
172.83.19.35
172.97.18.54
172.109.155.44
173.18.56.100
173.206.157.33
173.242.80.40
174.55.158.18
174.62.133.5
174.80.130.51
174.82.234.112
174.86.164.174
174.88.50.114
174.109.209.224
174.198.147.224
174.210.69.54
174.248.134.190
175.141.234.44
176.88.44.83
176.92.184.237
176.95.196.166
176.138.169.210
176.175.111.106
176.207.255.124
177.39.169.9
177.87.95.140
177.94.214.11
177.126.145.240
177.245.211.152
178.4.231.254
178.34.16.183
178.49.25.17
178.159.37.44
178.159.37.60
178.159.37.125
178.159.37.128
178.159.37.131
178.159.37.142
178.213.21.185
178.214.15.163
178.214.213.115
179.58.76.209
179.60.80.57
179.154.4.248
179.175.177.155
179.193.229.9
179.236.109.181
180.163.220.3
180.163.220.4
180.241.45.136
180.241.191.67
180.242.232.54
180.242.253.82
180.252.95.140
180.252.161.165
180.254.70.234
180.254.116.70
181.9.187.101
181.13.22.146
181.21.26.45
181.44.40.47
181.45.30.51
181.57.139.156
181.81.140.77
181.136.117.215
181.165.233.122
181.167.207.8
181.192.19.180
181.225.42.164
181.228.52.27
181.228.200.112
182.2.100.74
182.16.41.26
182.183.148.117
182.228.196.82
182.254.156.95
183.87.50.14
184.72.233.35
184.99.100.55
184.100.13.234
184.170.130.154
184.176.94.244
185.16.28.226
185.26.180.159
185.31.175.228
185.31.175.231
185.31.175.240
185.31.175.252
185.32.134.225
185.38.92.101
185.42.129.20
185.46.217.88
185.52.142.112
185.56.80.65
185.83.214.69
185.97.16.251
185.100.87.192
185.102.11.54
185.111.157.170
185.130.44.108
185.142.95.250
185.142.239.49
185.152.198.19
185.165.120.41
185.165.120.42
185.165.120.46
185.185.162.246
185.191.34.215
185.209.29.239
185.213.21.133
185.213.21.134
185.220.100.245
185.220.101.1
185.220.101.141
185.220.101.146
185.220.101.248
185.220.102.243
185.220.102.248
185.220.102.249
185.220.102.250
185.230.5.146
185.233.217.123
185.237.74.112
185.247.224.14
185.247.225.49
185.250.46.49
185.253.162.11
186.18.197.60
186.57.200.191
186.58.154.47
186.82.228.65
186.84.22.201
186.115.240.218
186.139.224.143
186.143.197.181
186.179.1.161
186.179.6.181
186.179.18.253
186.179.34.44
186.179.36.44
186.183.65.54
186.222.79.230
186.241.9.180
187.19.18.86
187.61.124.31
187.66.226.104
187.160.13.119
187.223.121.127
187.229.96.181
187.254.110.39
188.26.215.114
188.35.131.246
188.39.161.218
188.119.65.21
188.119.76.81
188.122.82.146
188.163.46.170
188.189.155.140
188.207.19.121
188.246.182.154
188.255.7.88
189.31.223.5
189.131.3.54
189.151.159.27
189.180.146.84
190.3.35.41
190.5.185.36
190.11.89.72
190.18.239.124
190.85.200.242
190.114.54.31
190.123.219.182
190.189.193.158
190.248.94.246
191.5.255.128
191.13.241.200
191.39.42.138
191.96.227.112
191.101.31.40
191.101.31.59
191.102.181.19
191.102.189.16
191.106.151.104
191.187.41.213
191.218.121.169
191.253.17.78
192.3.197.102
192.31.234.3
192.42.116.17
192.92.0.135
192.99.4.163
192.99.10.170
192.99.13.228
192.99.116.137
192.169.139.161
192.176.49.167
192.207.67.190
192.210.167.223
192.227.220.146
192.241.111.54
193.0.137.30
193.36.183.228
193.142.146.138
193.189.100.196
193.239.232.102
193.253.242.26
194.26.29.195
194.36.19.2
194.36.97.166
194.48.181.252
194.50.170.82
194.76.192.14
194.87.38.74
194.113.106.106
194.124.248.50
194.156.120.32
194.223.73.33
195.2.93.87
195.8.44.1
195.19.29.207
195.25.24.30
195.78.247.193
195.154.60.148
195.154.172.103
195.154.183.25
195.154.183.28
195.154.183.76
195.154.185.168
195.188.181.2
195.208.168.138
195.234.125.254
195.238.119.154
195.246.120.32
195.246.120.72
195.246.120.113
196.20.145.181
196.41.57.194
196.74.216.82
196.170.51.209
196.185.85.162
196.189.88.93
196.192.176.146
196.196.47.197
196.196.246.248
196.240.109.201
196.240.237.99
196.240.237.138
196.242.57.112
196.242.84.109
196.242.114.59
196.242.114.159
196.242.115.138
196.242.115.152
196.242.131.8
196.242.178.140
196.244.48.156
196.245.186.112
196.245.186.133
196.245.186.168
196.247.18.154
196.247.213.246
196.251.11.251
197.155.162.201
197.162.220.148
197.185.98.30
197.185.119.112
197.210.54.138
197.237.150.228
198.12.80.157
198.20.187.233
198.23.167.19
198.23.207.237
198.53.252.197
198.84.220.209
198.98.60.97
198.99.32.5
198.144.149.253
198.144.159.124
199.21.115.21
199.30.228.135
199.58.146.90
199.102.185.37
199.167.138.22
199.188.45.16
199.249.230.83
199.249.230.154
200.3.219.60
200.46.16.148
200.59.126.29
200.201.188.45
200.229.253.226
201.31.193.150
201.47.228.254
201.54.162.227
201.82.48.25
201.204.168.66
201.254.159.33
202.77.108.242
202.88.38.147
202.94.175.162
202.180.99.134
203.100.218.202
204.15.208.41
204.89.74.135
204.116.209.10
204.195.110.73
205.141.6.206
205.174.150.229
206.248.184.153
206.255.75.230
207.6.169.209
207.148.102.42
207.180.247.214
207.210.254.146
207.246.240.117
208.38.236.22
208.91.99.5
208.107.194.236
208.108.138.95
209.18.48.26
209.107.196.52
209.127.98.198
209.141.54.7
209.141.56.96
209.159.150.78
209.169.79.202
209.203.45.130
212.31.245.194
212.80.86.116
212.86.102.106
212.115.112.131
212.182.141.125
213.1.7.194
213.6.227.38
213.14.170.109
213.32.84.13
213.33.240.206
213.87.159.106
213.89.57.165
213.108.2.215
213.136.92.122
213.139.204.132
213.180.169.78
213.206.252.57
213.230.67.170
213.230.110.57
213.230.110.86
213.246.57.242
216.129.226.11
216.131.74.8
216.131.82.17
216.134.185.1
216.211.241.190
216.211.255.242
216.244.66.195
216.244.66.201
217.23.5.236
217.100.40.18
217.138.209.68
217.164.195.226
218.4.62.141
218.26.159.82
218.146.177.233
218.214.190.49
219.93.93.146
219.161.70.10
220.73.7.227
220.175.146.238
220.245.215.11
223.91.0.243
223.104.107.28
223.181.25.106
223.204.11.10
223.204.220.118
223.225.14.196
223.228.241.59
223.230.143.157
223.238.203.156

970
cleantalk_1d.ipset Normal file
View File

@ -0,0 +1,970 @@
#
# cleantalk_1d
#
# ipv4 hash:ip ipset
#
# [CleanTalk] (https://cleantalk.org/) Today's HTTP Spammers
# (includes: cleantalk_new_1d cleantalk_updated_1d)
#
# Maintainer : CleanTalk
# Maintainer URL : https://cleantalk.org/
# List source URL :
# Source File Date: Thu Sep 2 13:44:10 UTC 2021
#
# Category : abuse
# Version : 22679
#
# This File Date : Thu Sep 2 13:44:11 UTC 2021
# Update Frequency: 1 min
# Aggregation : none
# Entries : 940 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=cleantalk_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
2.28.25.15
2.50.124.134
3.81.78.91
5.14.149.205
5.38.33.214
5.169.43.221
5.188.210.57
5.188.210.82
5.203.146.138
12.215.72.27
12.237.54.244
14.174.78.206
23.31.99.169
23.120.165.132
23.126.161.240
23.229.53.154
24.17.87.95
24.21.38.249
24.49.159.200
24.68.100.169
24.104.248.208
24.111.168.50
24.134.42.201
24.152.205.26
24.192.249.249
24.197.209.13
24.232.99.231
27.8.160.115
27.76.200.81
31.10.136.107
32.220.127.150
34.71.127.65
34.105.142.177
34.132.202.175
34.135.61.86
36.78.109.126
36.84.98.12
36.85.78.4
36.90.24.39
37.45.10.140
38.104.196.126
39.144.93.87
41.37.254.177
41.79.219.199
41.200.117.116
42.57.208.117
42.110.198.155
42.118.18.224
42.236.10.84
42.236.10.106
45.11.125.11
45.11.125.157
45.11.126.202
45.25.38.223
45.53.195.170
45.87.2.128
45.146.161.191
45.153.217.178
45.229.85.99
46.9.155.143
46.29.252.76
46.70.77.30
46.147.188.22
46.161.189.20
47.24.249.226
47.72.55.131
47.185.168.69
49.3.196.79
49.12.131.247
49.32.190.90
49.146.34.36
49.151.245.78
50.3.91.181
50.66.49.75
50.69.210.210
50.89.138.233
50.251.48.41
54.39.16.180
54.167.227.113
54.193.55.25
54.237.130.63
54.254.242.128
58.7.232.152
58.186.99.169
59.92.199.90
60.23.187.16
61.5.108.88
62.14.69.105
62.18.34.85
62.195.48.61
63.231.151.195
64.231.93.208
65.25.171.108
65.102.180.50
66.76.45.54
67.9.145.1
67.42.50.243
67.164.43.116
67.175.192.19
67.204.242.251
68.132.194.29
68.148.164.244
68.185.194.218
69.62.214.53
69.75.111.66
69.115.207.79
69.131.80.104
69.137.185.235
69.138.154.246
69.140.241.29
69.234.73.211
70.27.239.100
70.29.132.188
70.112.231.218
70.114.76.115
71.29.176.239
71.30.105.204
71.105.237.152
71.114.113.253
71.172.32.253
71.182.193.111
71.200.174.255
72.130.53.230
72.139.196.68
72.217.56.68
72.218.170.209
72.249.124.163
73.1.23.125
73.45.7.164
73.65.33.163
73.104.243.195
73.106.205.162
73.133.59.216
73.149.200.204
73.164.241.110
73.179.132.238
73.189.164.179
73.207.208.37
73.222.128.187
73.223.227.113
74.88.60.141
74.103.25.122
74.121.32.146
74.195.185.123
74.195.243.208
74.215.54.144
75.27.124.81
75.36.115.213
75.163.171.33
75.168.71.121
75.182.200.96
76.20.147.111
76.65.17.172
76.127.177.140
76.216.160.210
77.10.110.75
77.123.189.3
77.136.102.249
78.92.127.160
78.110.75.227
79.0.10.118
79.105.46.229
79.107.72.4
79.198.199.4
79.208.246.214
79.222.88.86
79.241.130.96
80.174.185.242
80.180.182.219
81.106.100.101
81.241.60.221
81.250.51.128
82.5.147.25
82.12.185.135
82.159.18.17
83.11.80.189
84.47.62.108
85.26.241.55
85.99.158.80
86.17.236.4
86.89.255.58
86.166.29.104
87.125.5.25
88.135.114.134
88.155.62.69
88.201.141.106
88.220.46.18
88.230.144.133
88.250.58.248
89.163.150.213
89.187.177.73
90.240.129.45
91.251.87.139
92.20.171.213
92.100.150.119
92.210.10.100
93.87.230.108
94.222.5.236
95.85.60.77
95.92.92.171
96.45.30.8
96.54.61.17
98.161.145.213
98.162.221.198
98.177.239.161
98.226.190.42
98.232.39.193
99.76.141.7
99.106.58.51
99.110.160.76
99.122.187.77
99.174.210.110
99.175.210.92
99.224.39.199
99.225.170.238
99.230.244.244
101.109.179.176
102.67.67.247
102.101.174.37
103.36.8.178
103.103.196.210
103.148.112.133
103.164.63.166
103.172.2.2
104.60.88.68
104.144.157.175
104.149.150.10
104.183.78.216
104.189.124.49
104.205.29.189
104.205.105.10
104.244.72.168
104.246.61.27
105.71.20.103
105.226.53.80
106.14.41.203
106.128.128.97
106.128.193.217
106.197.98.94
106.206.162.89
106.220.239.36
107.152.176.58
107.152.222.66
107.172.234.102
107.173.6.127
107.173.185.104
107.189.10.42
109.48.87.156
109.221.148.211
110.42.231.13
110.238.43.241
111.16.37.153
111.32.119.6
111.95.96.3
112.32.3.34
112.164.218.185
112.202.58.40
112.206.242.178
113.160.113.217
113.168.254.1
113.185.46.57
114.119.136.100
114.122.39.206
114.221.38.5
115.70.185.238
115.135.139.82
116.104.249.169
116.121.59.80
117.60.61.66
117.195.86.167
118.143.38.130
119.17.232.51
119.95.204.204
120.16.139.73
120.155.76.50
121.53.80.250
122.53.39.124
122.53.42.240
123.208.162.55
123.231.87.163
124.41.240.66
124.169.214.140
124.170.2.82
124.185.248.168
124.253.196.209
125.235.212.133
131.230.42.212
134.41.57.42
134.119.219.93
135.125.70.140
137.25.20.27
138.99.71.200
138.130.44.245
138.185.239.176
139.130.9.130
142.114.232.157
143.0.61.8
143.137.68.223
143.208.41.101
147.158.253.251
149.200.105.248
151.45.41.165
151.47.166.49
151.224.49.144
152.170.55.115
152.207.216.116
154.30.171.214
154.50.139.172
154.236.148.225
156.146.36.112
157.33.220.188
157.38.31.7
157.38.224.138
159.192.226.25
161.22.27.98
161.64.159.73
162.72.200.161
162.221.31.218
162.225.57.108
164.132.219.80
165.231.95.236
165.231.105.144
167.114.136.29
167.179.174.216
168.81.69.73
168.232.83.106
168.253.110.250
170.39.199.5
170.51.101.152
170.52.168.179
171.5.70.244
171.76.229.244
171.109.217.60
171.232.31.127
172.9.80.210
172.70.98.165
172.73.1.144
172.83.19.35
172.97.18.54
172.109.155.44
172.222.59.196
173.18.56.100
173.80.164.54
173.171.66.156
173.206.157.33
173.242.80.40
174.0.51.82
174.7.26.142
174.28.166.115
174.55.158.18
174.62.133.5
174.80.130.51
174.82.234.112
174.86.164.174
174.88.32.138
174.88.50.114
174.88.167.223
174.106.182.31
174.109.209.224
174.198.147.224
174.210.69.54
174.211.106.209
174.241.29.52
174.248.134.190
175.100.47.170
175.141.85.78
175.141.234.44
176.15.21.219
176.32.29.82
176.88.44.83
176.92.184.237
176.95.196.166
176.138.169.210
176.175.111.106
176.207.255.124
177.25.137.141
177.25.139.207
177.39.169.9
177.51.70.243
177.87.95.140
177.94.214.11
177.126.145.240
177.147.231.89
177.185.161.207
177.245.211.152
177.250.61.144
178.4.231.254
178.17.182.186
178.34.16.183
178.49.25.17
178.159.37.44
178.159.37.60
178.159.37.125
178.159.37.128
178.159.37.131
178.159.37.142
178.159.37.171
178.213.21.185
178.214.15.163
178.214.213.115
179.6.138.192
179.14.219.7
179.58.76.209
179.60.80.57
179.98.208.156
179.154.4.248
179.175.177.155
179.193.229.9
179.236.109.181
180.163.220.3
180.163.220.4
180.183.0.131
180.241.45.136
180.241.191.67
180.242.232.54
180.242.253.82
180.244.165.220
180.245.167.192
180.252.95.140
180.252.161.165
180.254.70.234
180.254.116.70
181.9.187.101
181.13.22.146
181.21.26.45
181.37.209.48
181.44.34.34
181.44.40.47
181.45.30.51
181.50.85.96
181.57.86.61
181.57.139.156
181.59.128.191
181.81.122.205
181.81.140.77
181.94.119.147
181.130.206.185
181.136.117.215
181.165.233.122
181.167.207.8
181.192.19.180
181.225.42.164
181.228.52.27
181.228.200.112
181.234.32.28
182.2.100.74
182.16.41.26
182.53.63.41
182.129.237.50
182.183.148.117
182.228.196.82
182.239.149.177
182.254.156.95
183.87.50.14
183.226.74.99
184.18.135.234
184.72.233.35
184.91.171.228
184.96.170.211
184.99.96.162
184.99.100.55
184.100.13.234
184.103.185.104
184.170.130.154
184.176.94.244
185.16.28.226
185.26.180.159
185.31.175.228
185.31.175.231
185.31.175.240
185.31.175.243
185.31.175.252
185.32.134.225
185.38.92.101
185.42.129.20
185.46.217.88
185.52.142.112
185.56.80.65
185.83.214.69
185.97.16.251
185.100.87.192
185.102.11.54
185.103.176.4
185.111.157.170
185.130.44.108
185.142.95.250
185.142.239.49
185.152.198.19
185.165.120.41
185.165.120.42
185.165.120.46
185.185.162.246
185.191.34.215
185.209.29.239
185.213.21.133
185.213.21.134
185.220.100.245
185.220.100.246
185.220.101.1
185.220.101.15
185.220.101.23
185.220.101.138
185.220.101.141
185.220.101.146
185.220.101.228
185.220.101.237
185.220.101.248
185.230.5.146
185.233.217.123
185.237.74.112
185.242.160.154
185.247.224.14
185.247.225.49
185.250.46.49
185.250.210.73
185.253.162.11
186.0.199.130
186.3.149.53
186.11.61.179
186.18.197.60
186.51.226.106
186.57.200.191
186.58.154.47
186.64.67.10
186.64.118.225
186.64.119.80
186.70.220.235
186.82.228.65
186.84.22.201
186.84.88.62
186.95.231.151
186.115.240.218
186.139.224.143
186.143.197.181
186.169.66.72
186.179.1.161
186.179.6.181
186.179.18.253
186.179.34.44
186.179.36.44
186.183.65.54
186.185.250.32
186.212.130.206
186.222.79.230
186.241.9.180
186.247.142.153
187.19.18.86
187.40.68.211
187.61.124.31
187.66.226.104
187.102.35.134
187.109.104.245
187.120.177.1
187.133.170.179
187.160.13.119
187.183.201.173
187.195.88.42
187.223.121.127
187.229.96.181
187.254.110.39
188.26.215.114
188.34.153.78
188.34.157.145
188.35.131.246
188.39.161.218
188.40.209.92
188.119.65.21
188.119.76.81
188.122.82.146
188.126.73.215
188.143.232.14
188.163.46.170
188.189.155.140
188.207.19.121
188.235.215.140
188.246.182.154
188.255.7.88
189.13.112.38
189.31.223.5
189.131.3.54
189.148.133.205
189.151.159.27
189.180.146.84
189.203.54.150
189.250.89.44
189.251.47.48
190.3.35.41
190.5.185.36
190.11.89.72
190.14.213.2
190.18.239.124
190.21.244.139
190.46.142.129
190.56.50.2
190.58.17.49
190.85.200.242
190.104.119.50
190.112.192.23
190.114.54.31
190.120.249.35
190.123.219.182
190.171.80.27
190.180.66.12
190.189.193.158
190.194.146.152
190.233.206.167
190.245.13.211
190.248.94.246
191.5.255.128
191.13.241.200
191.39.42.138
191.45.87.46
191.83.206.110
191.95.1.75
191.96.227.112
191.101.31.40
191.101.31.59
191.102.181.11
191.102.181.19
191.102.189.16
191.106.151.104
191.177.175.118
191.187.41.213
191.218.121.169
191.253.17.78
192.3.176.78
192.3.197.102
192.31.234.3
192.42.116.17
192.82.89.208
192.92.0.135
192.99.4.163
192.99.10.170
192.99.13.228
192.99.37.138
192.99.116.137
192.126.230.136
192.161.190.89
192.169.139.161
192.176.49.167
192.186.175.53
192.207.67.190
192.210.167.223
192.227.138.101
192.227.220.146
192.241.111.54
193.0.137.30
193.9.114.179
193.36.183.228
193.56.20.217
193.77.64.135
193.107.201.149
193.110.95.34
193.142.146.138
193.169.253.35
193.180.245.29
193.189.100.195
193.189.100.196
193.219.0.128
193.239.232.102
193.253.242.26
194.26.29.195
194.36.19.2
194.36.97.166
194.48.181.252
194.50.170.67
194.50.170.82
194.76.192.14
194.87.38.74
194.113.106.106
194.124.248.50
194.156.120.32
194.170.189.130
194.223.73.33
194.247.22.2
195.2.93.87
195.8.44.1
195.19.29.207
195.25.24.30
195.58.37.122
195.78.247.193
195.123.246.161
195.154.60.148
195.154.172.103
195.154.183.25
195.154.183.28
195.154.183.76
195.154.185.157
195.154.185.168
195.154.222.31
195.154.242.189
195.188.181.2
195.201.29.180
195.208.168.138
195.234.125.254
195.238.119.154
195.246.120.32
195.246.120.72
195.246.120.113
196.19.240.189
196.20.145.181
196.28.75.164
196.41.57.194
196.74.216.82
196.170.51.209
196.185.85.162
196.189.88.93
196.192.176.146
196.196.47.197
196.196.148.229
196.196.169.148
196.196.224.84
196.196.246.248
196.199.119.136
196.240.57.68
196.240.109.201
196.240.237.19
196.240.237.99
196.240.237.138
196.242.20.168
196.242.46.238
196.242.57.112
196.242.84.109
196.242.84.116
196.242.114.13
196.242.114.59
196.242.114.159
196.242.115.138
196.242.115.152
196.242.131.8
196.242.178.140
196.244.48.156
196.245.186.112
196.245.186.133
196.245.186.168
196.245.216.222
196.247.18.154
196.247.160.145
196.247.213.246
196.251.11.251
197.155.162.201
197.162.220.148
197.185.98.30
197.185.119.112
197.206.137.61
197.210.52.167
197.210.54.138
197.232.21.232
197.237.150.228
198.12.80.157
198.12.80.174
198.20.187.233
198.23.167.19
198.23.207.237
198.53.252.197
198.68.208.26
198.71.48.97
198.84.220.209
198.98.60.97
198.99.32.5
198.144.121.93
198.144.149.253
198.144.159.124
199.21.115.21
199.30.228.135
199.34.78.27
199.36.223.31
199.58.146.90
199.87.205.48
199.102.185.37
199.167.138.22
199.188.45.16
199.201.122.78
199.249.230.74
199.249.230.83
199.249.230.147
199.249.230.154
200.3.219.60
200.10.41.114
200.12.187.39
200.36.153.102
200.46.16.148
200.59.126.29
200.71.49.160
200.115.207.57
200.201.188.45
200.229.253.226
201.31.193.150
201.47.228.254
201.54.162.227
201.75.25.200
201.82.48.25
201.166.191.229
201.182.192.178
201.204.168.66
201.210.81.238
201.246.199.212
201.249.3.135
201.254.159.33
202.50.53.32
202.77.108.242
202.88.38.147
202.94.175.162
202.180.99.134
203.6.177.2
203.45.119.219
203.81.177.61
203.100.218.202
203.140.180.130
203.206.116.205
204.15.208.41
204.89.74.135
204.116.42.100
204.116.209.10
204.195.110.73
205.141.6.206
205.169.39.113
205.169.39.119
205.169.39.199
205.169.39.202
205.169.39.229
205.174.150.229
205.185.124.200
205.220.197.132
206.75.157.39
206.176.135.87
206.248.184.153
206.255.75.230
207.6.169.209
207.102.138.19
207.148.102.42
207.180.247.214
207.210.254.146
207.241.234.15
207.246.240.117
208.38.236.22
208.91.99.5
208.107.194.236
208.108.138.95
208.115.199.20
209.18.48.26
209.45.66.242
209.107.196.52
209.126.122.122
209.127.33.63
209.127.98.198
209.127.164.130
209.140.37.18
209.141.33.77
209.141.51.252
209.141.54.7
209.141.56.96
209.159.150.78
209.169.79.202
209.203.45.130
211.29.188.47
212.19.30.239
212.31.245.194
212.80.86.116
212.86.102.106
212.102.57.144
212.103.77.246
212.115.112.131
212.182.141.125
212.214.255.229
212.237.122.183
213.1.7.194
213.6.227.38
213.14.170.109
213.32.84.13
213.33.240.206
213.74.197.115
213.87.159.106
213.89.57.165
213.108.2.215
213.136.92.122
213.139.204.132
213.180.169.78
213.200.15.42
213.206.252.57
213.230.67.170
213.230.110.57
213.230.110.86
213.246.57.88
213.246.57.242
216.106.231.38
216.129.226.11
216.131.74.8
216.131.81.11
216.131.82.17
216.131.114.103
216.131.114.108
216.131.114.115
216.131.114.127
216.131.114.133
216.131.116.70
216.134.185.1
216.198.190.43
216.211.241.190
216.211.255.242
216.244.66.195
216.244.66.201
216.244.66.234
216.244.66.244
217.23.5.236
217.100.40.18
217.138.209.68
217.141.179.178
217.164.195.226
217.218.234.221
217.219.245.26
218.4.62.141
218.26.159.82
218.146.177.233
218.214.190.49
218.221.90.201
218.250.207.81
219.93.93.146
219.161.70.10
220.73.7.227
220.175.146.238
220.240.56.212
220.240.174.41
220.245.215.11
220.247.174.42
222.155.202.221
223.38.94.155
223.72.54.237
223.91.0.156
223.91.0.243
223.104.107.28
223.181.25.106
223.187.219.119
223.204.11.10
223.204.220.118
223.205.238.214
223.225.14.196
223.228.241.59
223.230.143.157
223.238.203.156

27504
cleantalk_30d.ipset Normal file

File diff suppressed because it is too large Load Diff

11371
cleantalk_7d.ipset Normal file

File diff suppressed because it is too large Load Diff

279
cleantalk_new.ipset Normal file
View File

@ -0,0 +1,279 @@
#
# cleantalk_new
#
# ipv4 hash:ip ipset
#
# [CleanTalk] (https://cleantalk.org/) Recent HTTP Spammers
#
# Maintainer : CleanTalk
# Maintainer URL : https://cleantalk.org/
# List source URL : https://cleantalk.org/blacklists/submited_today
# Source File Date: Thu Sep 2 13:44:09 UTC 2021
#
# Category : abuse
# Version : 21117
#
# This File Date : Thu Sep 2 13:44:09 UTC 2021
# Update Frequency: 15 mins
# Aggregation : none
# Entries : 250 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=cleantalk_new
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
2.28.25.15
5.14.149.205
5.169.43.221
12.215.72.27
23.31.99.169
24.21.38.249
24.134.42.201
31.10.136.107
32.220.127.150
34.71.127.65
34.105.142.177
36.84.98.12
37.45.10.140
38.104.196.126
39.144.93.87
42.118.18.224
45.53.195.170
46.70.77.30
49.146.34.36
50.251.48.41
54.167.227.113
59.92.199.90
61.5.108.88
62.14.69.105
62.18.34.85
62.195.48.61
66.76.45.54
68.132.194.29
69.75.111.66
69.115.207.79
69.131.80.104
69.234.73.211
70.27.239.100
70.29.132.188
70.114.76.115
71.172.32.253
72.218.170.209
73.1.23.125
73.45.7.164
73.106.205.162
73.149.200.204
73.164.241.110
74.103.25.122
74.215.54.144
77.10.110.75
78.92.127.160
79.0.10.118
79.107.72.4
79.198.199.4
79.208.246.214
79.222.88.86
79.241.130.96
80.174.185.242
80.180.182.219
81.250.51.128
82.12.185.135
82.159.18.17
84.47.62.108
86.17.236.4
86.89.255.58
86.166.29.104
87.125.5.25
88.155.62.69
88.220.46.18
88.230.144.133
90.240.129.45
91.251.87.139
93.87.230.108
94.222.5.236
95.92.92.171
99.224.39.199
102.67.67.247
102.101.174.37
105.71.20.103
105.226.53.80
106.128.193.217
109.221.148.211
110.42.231.13
110.238.43.241
111.95.96.3
112.202.58.40
115.135.139.82
124.253.196.209
125.235.212.133
135.125.70.140
142.114.232.157
151.45.41.165
151.47.166.49
151.224.49.144
157.38.31.7
161.22.27.98
162.221.31.218
162.225.57.108
167.179.174.216
168.232.83.106
168.253.110.250
171.5.70.244
172.73.1.144
172.83.19.35
172.97.18.54
172.109.155.44
173.18.56.100
173.206.157.33
173.242.80.40
174.55.158.18
174.62.133.5
174.80.130.51
174.82.234.112
174.86.164.174
174.88.50.114
174.109.209.224
174.198.147.224
174.210.69.54
174.248.134.190
175.141.234.44
176.88.44.83
176.92.184.237
176.95.196.166
176.138.169.210
176.175.111.106
176.207.255.124
177.39.169.9
177.87.95.140
177.94.214.11
177.126.145.240
177.245.211.152
178.4.231.254
178.34.16.183
178.49.25.17
178.214.15.163
179.58.76.209
179.154.4.248
179.175.177.155
179.193.229.9
179.236.109.181
180.241.191.67
180.242.253.82
180.252.95.140
180.254.116.70
181.9.187.101
181.13.22.146
181.21.26.45
181.44.40.47
181.45.30.51
181.57.139.156
181.81.140.77
181.136.117.215
181.165.233.122
181.167.207.8
181.192.19.180
181.228.52.27
181.228.200.112
182.2.100.74
182.183.148.117
182.228.196.82
184.72.233.35
184.99.100.55
184.176.94.244
185.42.129.20
185.97.16.251
185.102.11.54
185.152.198.19
185.185.162.246
185.233.217.123
186.57.200.191
186.58.154.47
186.82.228.65
186.115.240.218
186.139.224.143
186.143.197.181
186.183.65.54
186.222.79.230
186.241.9.180
187.19.18.86
187.61.124.31
187.66.226.104
187.223.121.127
187.229.96.181
187.254.110.39
188.39.161.218
188.189.155.140
188.207.19.121
188.246.182.154
188.255.7.88
189.31.223.5
189.131.3.54
189.151.159.27
189.180.146.84
190.5.185.36
190.11.89.72
190.18.239.124
190.114.54.31
190.189.193.158
190.248.94.246
191.13.241.200
191.39.42.138
191.106.151.104
191.187.41.213
191.218.121.169
192.92.0.135
192.176.49.167
193.0.137.30
193.36.183.228
193.253.242.26
194.48.181.252
194.223.73.33
195.238.119.154
196.20.145.181
196.74.216.82
196.192.176.146
197.155.162.201
197.185.119.112
197.237.150.228
198.53.252.197
198.84.220.209
199.58.146.90
200.59.126.29
201.47.228.254
201.82.48.25
201.204.168.66
201.254.159.33
203.100.218.202
204.195.110.73
205.174.150.229
206.248.184.153
206.255.75.230
207.6.169.209
208.107.194.236
209.169.79.202
209.203.45.130
212.182.141.125
213.1.7.194
213.14.170.109
213.89.57.165
213.180.169.78
217.23.5.236
217.100.40.18
217.164.195.226
218.26.159.82
218.214.190.49
219.93.93.146
220.73.7.227
220.175.146.238
220.245.215.11
223.104.107.28
223.181.25.106
223.204.220.118
223.225.14.196
223.228.241.59
223.238.203.156

529
cleantalk_new_1d.ipset Normal file
View File

@ -0,0 +1,529 @@
#
# cleantalk_new_1d
#
# ipv4 hash:ip ipset
#
# [CleanTalk] (https://cleantalk.org/) Recent HTTP Spammers
#
# Maintainer : CleanTalk
# Maintainer URL : https://cleantalk.org/
# List source URL : https://cleantalk.org/blacklists/submited_today
# Source File Date: Thu Sep 2 13:44:09 UTC 2021
#
# Category : abuse
# Version : 21076
#
# This File Date : Thu Sep 2 13:44:09 UTC 2021
# Update Frequency: 15 mins
# Aggregation : 1 day
# Entries : 500 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=cleantalk_new_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
2.28.25.15
2.50.124.134
5.14.149.205
5.38.33.214
5.169.43.221
5.203.146.138
12.215.72.27
12.237.54.244
14.174.78.206
23.31.99.169
23.120.165.132
23.126.161.240
24.21.38.249
24.49.159.200
24.68.100.169
24.104.248.208
24.111.168.50
24.134.42.201
24.152.205.26
24.192.249.249
24.197.209.13
24.232.99.231
27.8.160.115
27.76.200.81
31.10.136.107
32.220.127.150
34.71.127.65
34.105.142.177
34.135.61.86
36.78.109.126
36.84.98.12
36.85.78.4
36.90.24.39
37.45.10.140
38.104.196.126
39.144.93.87
41.37.254.177
41.200.117.116
42.57.208.117
42.110.198.155
42.118.18.224
45.25.38.223
45.53.195.170
45.229.85.99
46.9.155.143
46.70.77.30
46.161.189.20
47.24.249.226
47.72.55.131
47.185.168.69
49.3.196.79
49.32.190.90
49.146.34.36
49.151.245.78
50.66.49.75
50.69.210.210
50.89.138.233
50.251.48.41
54.167.227.113
54.237.130.63
54.254.242.128
58.7.232.152
58.186.99.169
59.92.199.90
61.5.108.88
62.14.69.105
62.18.34.85
62.195.48.61
64.231.93.208
65.102.180.50
66.76.45.54
67.9.145.1
67.42.50.243
67.164.43.116
67.175.192.19
67.204.242.251
68.132.194.29
68.148.164.244
68.185.194.218
69.62.214.53
69.75.111.66
69.115.207.79
69.131.80.104
69.137.185.235
69.138.154.246
69.140.241.29
69.234.73.211
70.27.239.100
70.29.132.188
70.112.231.218
70.114.76.115
71.29.176.239
71.30.105.204
71.105.237.152
71.114.113.253
71.172.32.253
71.182.193.111
71.200.174.255
72.130.53.230
72.139.196.68
72.217.56.68
72.218.170.209
73.1.23.125
73.45.7.164
73.65.33.163
73.104.243.195
73.106.205.162
73.133.59.216
73.149.200.204
73.164.241.110
73.179.132.238
73.189.164.179
73.207.208.37
73.222.128.187
73.223.227.113
74.88.60.141
74.103.25.122
74.121.32.146
74.195.185.123
74.195.243.208
74.215.54.144
75.27.124.81
75.36.115.213
75.163.171.33
75.168.71.121
76.20.147.111
76.65.17.172
76.127.177.140
76.216.160.210
77.10.110.75
77.136.102.249
78.92.127.160
78.110.75.227
79.0.10.118
79.107.72.4
79.198.199.4
79.208.246.214
79.222.88.86
79.241.130.96
80.174.185.242
80.180.182.219
81.106.100.101
81.241.60.221
81.250.51.128
82.5.147.25
82.12.185.135
82.159.18.17
83.11.80.189
84.47.62.108
85.99.158.80
86.17.236.4
86.89.255.58
86.166.29.104
87.125.5.25
88.155.62.69
88.220.46.18
88.230.144.133
88.250.58.248
90.240.129.45
91.251.87.139
92.20.171.213
92.210.10.100
93.87.230.108
94.222.5.236
95.92.92.171
96.45.30.8
96.54.61.17
98.161.145.213
98.162.221.198
98.177.239.161
98.226.190.42
98.232.39.193
99.76.141.7
99.106.58.51
99.110.160.76
99.122.187.77
99.174.210.110
99.175.210.92
99.224.39.199
99.225.170.238
99.230.244.244
101.109.179.176
102.67.67.247
102.101.174.37
103.103.196.210
103.172.2.2
104.60.88.68
104.183.78.216
104.189.124.49
104.205.29.189
104.205.105.10
104.246.61.27
105.71.20.103
105.226.53.80
106.128.128.97
106.128.193.217
106.197.98.94
106.206.162.89
109.48.87.156
109.221.148.211
110.42.231.13
110.238.43.241
111.16.37.153
111.32.119.6
111.95.96.3
112.32.3.34
112.164.218.185
112.202.58.40
113.160.113.217
113.168.254.1
113.185.46.57
114.221.38.5
115.70.185.238
115.135.139.82
116.104.249.169
116.121.59.80
117.195.86.167
118.143.38.130
119.17.232.51
120.16.139.73
120.155.76.50
121.53.80.250
122.53.39.124
122.53.42.240
123.208.162.55
123.231.87.163
124.169.214.140
124.170.2.82
124.185.248.168
124.253.196.209
125.235.212.133
131.230.42.212
134.41.57.42
135.125.70.140
138.99.71.200
138.185.239.176
139.130.9.130
142.114.232.157
143.0.61.8
143.137.68.223
143.208.41.101
147.158.253.251
149.200.105.248
151.45.41.165
151.47.166.49
151.224.49.144
152.170.55.115
152.207.216.116
154.236.148.225
157.33.220.188
157.38.31.7
157.38.224.138
159.192.226.25
161.22.27.98
161.64.159.73
162.72.200.161
162.221.31.218
162.225.57.108
167.179.174.216
168.232.83.106
168.253.110.250
170.52.168.179
171.5.70.244
171.76.229.244
171.232.31.127
172.9.80.210
172.73.1.144
172.83.19.35
172.97.18.54
172.109.155.44
172.222.59.196
173.18.56.100
173.80.164.54
173.171.66.156
173.206.157.33
173.242.80.40
174.0.51.82
174.7.26.142
174.28.166.115
174.55.158.18
174.62.133.5
174.80.130.51
174.82.234.112
174.86.164.174
174.88.32.138
174.88.50.114
174.88.167.223
174.106.182.31
174.109.209.224
174.198.147.224
174.210.69.54
174.211.106.209
174.248.134.190
175.141.234.44
176.32.29.82
176.88.44.83
176.92.184.237
176.95.196.166
176.138.169.210
176.175.111.106
176.207.255.124
177.25.137.141
177.25.139.207
177.39.169.9
177.51.70.243
177.87.95.140
177.94.214.11
177.126.145.240
177.147.231.89
177.185.161.207
177.245.211.152
177.250.61.144
178.4.231.254
178.34.16.183
178.49.25.17
178.214.15.163
179.6.138.192
179.14.219.7
179.58.76.209
179.98.208.156
179.154.4.248
179.175.177.155
179.193.229.9
179.236.109.181
180.241.191.67
180.242.253.82
180.244.165.220
180.245.167.192
180.252.95.140
180.254.116.70
181.9.187.101
181.13.22.146
181.21.26.45
181.37.209.48
181.44.34.34
181.44.40.47
181.45.30.51
181.50.85.96
181.57.86.61
181.57.139.156
181.59.128.191
181.81.122.205
181.81.140.77
181.94.119.147
181.130.206.185
181.136.117.215
181.165.233.122
181.167.207.8
181.192.19.180
181.228.52.27
181.228.200.112
181.234.32.28
182.2.100.74
182.53.63.41
182.129.237.50
182.183.148.117
182.228.196.82
182.239.149.177
183.226.74.99
184.18.135.234
184.72.233.35
184.91.171.228
184.96.170.211
184.99.96.162
184.99.100.55
184.103.185.104
184.176.94.244
185.42.129.20
185.97.16.251
185.102.11.54
185.103.176.4
185.152.198.19
185.185.162.246
185.233.217.123
186.57.200.191
186.58.154.47
186.70.220.235
186.82.228.65
186.95.231.151
186.115.240.218
186.139.224.143
186.143.197.181
186.169.66.72
186.183.65.54
186.212.130.206
186.222.79.230
186.241.9.180
186.247.142.153
187.19.18.86
187.61.124.31
187.66.226.104
187.109.104.245
187.120.177.1
187.133.170.179
187.195.88.42
187.223.121.127
187.229.96.181
187.254.110.39
188.39.161.218
188.189.155.140
188.207.19.121
188.246.182.154
188.255.7.88
189.31.223.5
189.131.3.54
189.151.159.27
189.180.146.84
189.203.54.150
190.5.185.36
190.11.89.72
190.18.239.124
190.114.54.31
190.189.193.158
190.245.13.211
190.248.94.246
191.13.241.200
191.39.42.138
191.83.206.110
191.102.181.11
191.106.151.104
191.187.41.213
191.218.121.169
192.82.89.208
192.92.0.135
192.176.49.167
193.0.137.30
193.36.183.228
193.253.242.26
194.48.181.252
194.223.73.33
195.238.119.154
196.20.145.181
196.74.216.82
196.192.176.146
197.155.162.201
197.185.119.112
197.206.137.61
197.237.150.228
198.53.252.197
198.68.208.26
198.84.220.209
199.34.78.27
199.58.146.90
199.201.122.78
200.12.187.39
200.36.153.102
200.59.126.29
200.115.207.57
201.47.228.254
201.82.48.25
201.204.168.66
201.210.81.238
201.249.3.135
201.254.159.33
203.45.119.219
203.100.218.202
203.140.180.130
203.206.116.205
204.116.42.100
204.195.110.73
205.174.150.229
205.220.197.132
206.248.184.153
206.255.75.230
207.6.169.209
208.107.194.236
209.140.37.18
209.169.79.202
209.203.45.130
211.29.188.47
212.182.141.125
213.1.7.194
213.14.170.109
213.74.197.115
213.89.57.165
213.180.169.78
216.198.190.43
217.23.5.236
217.100.40.18
217.164.195.226
218.26.159.82
218.214.190.49
218.221.90.201
218.250.207.81
219.93.93.146
220.73.7.227
220.175.146.238
220.240.56.212
220.240.174.41
220.245.215.11
222.155.202.221
223.38.94.155
223.72.54.237
223.104.107.28
223.181.25.106
223.187.219.119
223.204.220.118
223.225.14.196
223.228.241.59
223.238.203.156

16300
cleantalk_new_30d.ipset Normal file

File diff suppressed because it is too large Load Diff

6301
cleantalk_new_7d.ipset Normal file

File diff suppressed because it is too large Load Diff

49
cleantalk_top20.ipset Normal file
View File

@ -0,0 +1,49 @@
#
# cleantalk_top20
#
# ipv4 hash:ip ipset
#
# [CleanTalk] (https://cleantalk.org/) Top 20 HTTP Spammers
#
# Maintainer : CleanTalk
# Maintainer URL : https://cleantalk.org/
# List source URL : https://cleantalk.org/blacklists/top20
# Source File Date: Wed Sep 1 01:17:00 UTC 2021
#
# Category : abuse
# Version : 884
#
# This File Date : Wed Sep 1 01:17:00 UTC 2021
# Update Frequency: 1 day
# Aggregation : none
# Entries : 20 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=cleantalk_top20
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.48.5
37.120.143.152
46.161.15.40
85.159.237.75
92.38.136.69
185.104.184.119
185.130.184.204
185.130.184.206
185.206.224.198
185.206.224.211
185.255.96.99
188.122.82.146
188.163.47.9
191.101.217.24
195.154.171.54
198.144.149.253
199.167.138.22
212.102.57.2
212.102.57.164
217.171.147.164

279
cleantalk_updated.ipset Normal file
View File

@ -0,0 +1,279 @@
#
# cleantalk_updated
#
# ipv4 hash:ip ipset
#
# [CleanTalk] (https://cleantalk.org/) Recurring HTTP Spammers
#
# Maintainer : CleanTalk
# Maintainer URL : https://cleantalk.org/
# List source URL : https://cleantalk.org/blacklists/updated_today
# Source File Date: Thu Sep 2 13:44:10 UTC 2021
#
# Category : abuse
# Version : 21033
#
# This File Date : Thu Sep 2 13:44:10 UTC 2021
# Update Frequency: 15 mins
# Aggregation : none
# Entries : 250 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=cleantalk_updated
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
178.159.37.44
178.159.37.60
178.159.37.125
178.159.37.128
178.159.37.131
178.159.37.142
178.213.21.185
178.214.213.115
179.60.80.57
179.175.177.155
179.193.229.9
180.163.220.3
180.163.220.4
180.241.45.136
180.241.191.67
180.242.232.54
180.252.161.165
180.254.70.234
181.136.117.215
181.165.233.122
181.225.42.164
182.16.41.26
182.183.148.117
182.254.156.95
183.87.50.14
184.100.13.234
184.170.130.154
185.16.28.226
185.26.180.159
185.31.175.228
185.31.175.231
185.31.175.240
185.31.175.252
185.32.134.225
185.38.92.101
185.42.129.20
185.46.217.88
185.52.142.112
185.56.80.65
185.83.214.69
185.97.16.251
185.100.87.192
185.111.157.170
185.130.44.108
185.142.95.250
185.142.239.49
185.152.198.19
185.165.120.41
185.165.120.42
185.165.120.46
185.191.34.215
185.209.29.239
185.213.21.133
185.213.21.134
185.220.100.245
185.220.101.1
185.220.101.141
185.220.101.146
185.220.101.248
185.220.102.243
185.220.102.248
185.220.102.249
185.220.102.250
185.230.5.146
185.237.74.112
185.247.224.14
185.247.225.49
185.250.46.49
185.253.162.11
186.18.197.60
186.84.22.201
186.139.224.143
186.179.1.161
186.179.6.181
186.179.18.253
186.179.34.44
186.179.36.44
187.160.13.119
188.26.215.114
188.35.131.246
188.39.161.218
188.119.65.21
188.119.76.81
188.122.82.146
188.163.46.170
188.207.19.121
189.131.3.54
190.3.35.41
190.5.185.36
190.85.200.242
190.123.219.182
190.189.193.158
191.5.255.128
191.39.42.138
191.96.227.112
191.101.31.40
191.101.31.59
191.102.181.19
191.102.189.16
191.218.121.169
191.253.17.78
192.3.197.102
192.31.234.3
192.42.116.17
192.99.4.163
192.99.10.170
192.99.13.228
192.99.116.137
192.169.139.161
192.207.67.190
192.210.167.223
192.227.220.146
192.241.111.54
193.142.146.138
193.189.100.196
193.239.232.102
193.253.242.26
194.26.29.195
194.36.19.2
194.36.97.166
194.50.170.82
194.76.192.14
194.87.38.74
194.113.106.106
194.124.248.50
194.156.120.32
194.223.73.33
195.2.93.87
195.8.44.1
195.19.29.207
195.25.24.30
195.78.247.193
195.154.60.148
195.154.172.103
195.154.183.25
195.154.183.28
195.154.183.76
195.154.185.168
195.188.181.2
195.208.168.138
195.234.125.254
195.246.120.32
195.246.120.72
195.246.120.113
196.41.57.194
196.170.51.209
196.185.85.162
196.189.88.93
196.192.176.146
196.196.47.197
196.196.246.248
196.240.109.201
196.240.237.99
196.240.237.138
196.242.57.112
196.242.84.109
196.242.114.59
196.242.114.159
196.242.115.138
196.242.115.152
196.242.131.8
196.242.178.140
196.244.48.156
196.245.186.112
196.245.186.133
196.245.186.168
196.247.18.154
196.247.213.246
196.251.11.251
197.162.220.148
197.185.98.30
197.210.54.138
198.12.80.157
198.20.187.233
198.23.167.19
198.23.207.237
198.53.252.197
198.98.60.97
198.99.32.5
198.144.149.253
198.144.159.124
199.21.115.21
199.30.228.135
199.102.185.37
199.167.138.22
199.188.45.16
199.249.230.83
199.249.230.154
200.3.219.60
200.46.16.148
200.201.188.45
200.229.253.226
201.31.193.150
201.54.162.227
202.77.108.242
202.88.38.147
202.94.175.162
202.180.99.134
204.15.208.41
204.89.74.135
204.116.209.10
205.141.6.206
207.6.169.209
207.148.102.42
207.180.247.214
207.210.254.146
207.246.240.117
208.38.236.22
208.91.99.5
208.108.138.95
209.18.48.26
209.107.196.52
209.127.98.198
209.141.54.7
209.141.56.96
209.159.150.78
212.31.245.194
212.80.86.116
212.86.102.106
212.115.112.131
213.6.227.38
213.32.84.13
213.33.240.206
213.87.159.106
213.108.2.215
213.136.92.122
213.139.204.132
213.206.252.57
213.230.67.170
213.230.110.57
213.230.110.86
213.246.57.242
216.129.226.11
216.131.74.8
216.131.82.17
216.134.185.1
216.211.241.190
216.211.255.242
216.244.66.195
216.244.66.201
217.138.209.68
217.164.195.226
218.4.62.141
218.146.177.233
219.161.70.10
220.73.7.227
223.91.0.243
223.204.11.10
223.230.143.157
223.238.203.156

496
cleantalk_updated_1d.ipset Normal file
View File

@ -0,0 +1,496 @@
#
# cleantalk_updated_1d
#
# ipv4 hash:ip ipset
#
# [CleanTalk] (https://cleantalk.org/) Recurring HTTP Spammers
#
# Maintainer : CleanTalk
# Maintainer URL : https://cleantalk.org/
# List source URL : https://cleantalk.org/blacklists/updated_today
# Source File Date: Thu Sep 2 13:44:10 UTC 2021
#
# Category : abuse
# Version : 21150
#
# This File Date : Thu Sep 2 13:44:10 UTC 2021
# Update Frequency: 15 mins
# Aggregation : 1 day
# Entries : 471 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=cleantalk_updated_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
3.81.78.91
5.188.210.57
5.188.210.82
23.229.53.154
24.17.87.95
34.132.202.175
41.79.219.199
42.236.10.84
42.236.10.106
45.11.125.11
45.11.125.157
45.11.126.202
45.87.2.128
45.146.161.191
45.153.217.178
46.29.252.76
46.147.188.22
49.12.131.247
50.3.91.181
54.39.16.180
54.193.55.25
60.23.187.16
63.231.151.195
65.25.171.108
72.249.124.163
75.182.200.96
77.123.189.3
79.105.46.229
85.26.241.55
88.135.114.134
88.201.141.106
89.163.150.213
89.187.177.73
92.100.150.119
95.85.60.77
103.36.8.178
103.148.112.133
103.164.63.166
104.144.157.175
104.149.150.10
104.244.72.168
106.14.41.203
106.220.239.36
107.152.176.58
107.152.222.66
107.172.234.102
107.173.6.127
107.173.185.104
107.189.10.42
112.206.242.178
114.119.136.100
114.122.39.206
117.60.61.66
119.95.204.204
124.41.240.66
134.119.219.93
137.25.20.27
138.130.44.245
154.30.171.214
154.50.139.172
156.146.36.112
164.132.219.80
165.231.95.236
165.231.105.144
167.114.136.29
168.81.69.73
170.39.199.5
170.51.101.152
171.109.217.60
172.70.98.165
174.241.29.52
175.100.47.170
175.141.85.78
176.15.21.219
178.17.182.186
178.159.37.44
178.159.37.60
178.159.37.125
178.159.37.128
178.159.37.131
178.159.37.142
178.159.37.171
178.213.21.185
178.214.213.115
179.60.80.57
179.175.177.155
179.193.229.9
180.163.220.3
180.163.220.4
180.183.0.131
180.241.45.136
180.241.191.67
180.242.232.54
180.252.161.165
180.254.70.234
181.136.117.215
181.165.233.122
181.225.42.164
182.16.41.26
182.183.148.117
182.254.156.95
183.87.50.14
184.100.13.234
184.170.130.154
185.16.28.226
185.26.180.159
185.31.175.228
185.31.175.231
185.31.175.240
185.31.175.243
185.31.175.252
185.32.134.225
185.38.92.101
185.42.129.20
185.46.217.88
185.52.142.112
185.56.80.65
185.83.214.69
185.97.16.251
185.100.87.192
185.111.157.170
185.130.44.108
185.142.95.250
185.142.239.49
185.152.198.19
185.165.120.41
185.165.120.42
185.165.120.46
185.191.34.215
185.209.29.239
185.213.21.133
185.213.21.134
185.220.100.245
185.220.100.246
185.220.101.1
185.220.101.15
185.220.101.23
185.220.101.138
185.220.101.141
185.220.101.146
185.220.101.228
185.220.101.237
185.220.101.248
185.220.102.242/31
185.220.102.248/30
185.230.5.146
185.237.74.112
185.242.160.154
185.247.224.14
185.247.225.49
185.250.46.49
185.250.210.73
185.253.162.11
186.0.199.130
186.3.149.53
186.11.61.179
186.18.197.60
186.51.226.106
186.64.67.10
186.64.118.225
186.64.119.80
186.84.22.201
186.84.88.62
186.139.224.143
186.179.1.161
186.179.6.181
186.179.18.253
186.179.34.44
186.179.36.44
186.185.250.32
187.40.68.211
187.102.35.134
187.160.13.119
187.183.201.173
188.26.215.114
188.34.153.78
188.34.157.145
188.35.131.246
188.39.161.218
188.40.209.92
188.119.65.21
188.119.76.81
188.122.82.146
188.126.73.215
188.143.232.14
188.163.46.170
188.207.19.121
188.235.215.140
189.13.112.38
189.131.3.54
189.148.133.205
189.250.89.44
189.251.47.48
190.3.35.41
190.5.185.36
190.14.213.2
190.21.244.139
190.46.142.129
190.56.50.2
190.58.17.49
190.85.200.242
190.104.119.50
190.112.192.23
190.120.249.35
190.123.219.182
190.171.80.27
190.180.66.12
190.189.193.158
190.194.146.152
190.233.206.167
191.5.255.128
191.39.42.138
191.45.87.46
191.95.1.75
191.96.227.112
191.101.31.40
191.101.31.59
191.102.181.19
191.102.189.16
191.177.175.118
191.218.121.169
191.253.17.78
192.3.176.78
192.3.197.102
192.31.234.3
192.42.116.17
192.99.4.163
192.99.10.170
192.99.13.228
192.99.37.138
192.99.116.137
192.126.230.136
192.161.190.89
192.169.139.161
192.186.175.53
192.207.67.190
192.210.167.223
192.227.138.101
192.227.220.146
192.241.111.54
193.9.114.179
193.56.20.217
193.77.64.135
193.107.201.149
193.110.95.34
193.142.146.138
193.169.253.35
193.180.245.29
193.189.100.195
193.189.100.196
193.219.0.128
193.239.232.102
193.253.242.26
194.26.29.195
194.36.19.2
194.36.97.166
194.50.170.67
194.50.170.82
194.76.192.14
194.87.38.74
194.113.106.106
194.124.248.50
194.156.120.32
194.170.189.130
194.223.73.33
194.247.22.2
195.2.93.87
195.8.44.1
195.19.29.207
195.25.24.30
195.58.37.122
195.78.247.193
195.123.246.161
195.154.60.148
195.154.172.103
195.154.183.25
195.154.183.28
195.154.183.76
195.154.185.157
195.154.185.168
195.154.222.31
195.154.242.189
195.188.181.2
195.201.29.180
195.208.168.138
195.234.125.254
195.246.120.32
195.246.120.72
195.246.120.113
196.19.240.189
196.28.75.164
196.41.57.194
196.170.51.209
196.185.85.162
196.189.88.93
196.192.176.146
196.196.47.197
196.196.148.229
196.196.169.148
196.196.224.84
196.196.246.248
196.199.119.136
196.240.57.68
196.240.109.201
196.240.237.19
196.240.237.99
196.240.237.138
196.242.20.168
196.242.46.238
196.242.57.112
196.242.84.109
196.242.84.116
196.242.114.13
196.242.114.59
196.242.114.159
196.242.115.138
196.242.115.152
196.242.131.8
196.242.178.140
196.244.48.156
196.245.186.112
196.245.186.133
196.245.186.168
196.245.216.222
196.247.18.154
196.247.160.145
196.247.213.246
196.251.11.251
197.162.220.148
197.185.98.30
197.210.52.167
197.210.54.138
197.232.21.232
198.12.80.157
198.12.80.174
198.20.187.233
198.23.167.19
198.23.207.237
198.53.252.197
198.71.48.97
198.98.60.97
198.99.32.5
198.144.121.93
198.144.149.253
198.144.159.124
199.21.115.21
199.30.228.135
199.36.223.31
199.87.205.48
199.102.185.37
199.167.138.22
199.188.45.16
199.249.230.74
199.249.230.83
199.249.230.147
199.249.230.154
200.3.219.60
200.10.41.114
200.46.16.148
200.71.49.160
200.201.188.45
200.229.253.226
201.31.193.150
201.54.162.227
201.75.25.200
201.166.191.229
201.182.192.178
201.246.199.212
202.50.53.32
202.77.108.242
202.88.38.147
202.94.175.162
202.180.99.134
203.6.177.2
203.81.177.61
204.15.208.41
204.89.74.135
204.116.209.10
205.141.6.206
205.169.39.113
205.169.39.119
205.169.39.199
205.169.39.202
205.169.39.229
205.185.124.200
206.75.157.39
206.176.135.87
207.6.169.209
207.102.138.19
207.148.102.42
207.180.247.214
207.210.254.146
207.241.234.15
207.246.240.117
208.38.236.22
208.91.99.5
208.108.138.95
208.115.199.20
209.18.48.26
209.45.66.242
209.107.196.52
209.126.122.122
209.127.33.63
209.127.98.198
209.127.164.130
209.141.33.77
209.141.51.252
209.141.54.7
209.141.56.96
209.159.150.78
212.19.30.239
212.31.245.194
212.80.86.116
212.86.102.106
212.102.57.144
212.103.77.246
212.115.112.131
212.214.255.229
212.237.122.183
213.6.227.38
213.32.84.13
213.33.240.206
213.87.159.106
213.108.2.215
213.136.92.122
213.139.204.132
213.200.15.42
213.206.252.57
213.230.67.170
213.230.110.57
213.230.110.86
213.246.57.88
213.246.57.242
216.106.231.38
216.129.226.11
216.131.74.8
216.131.81.11
216.131.82.17
216.131.114.103
216.131.114.108
216.131.114.115
216.131.114.127
216.131.114.133
216.131.116.70
216.134.185.1
216.211.241.190
216.211.255.242
216.244.66.195
216.244.66.201
216.244.66.234
216.244.66.244
217.138.209.68
217.141.179.178
217.164.195.226
217.218.234.221
217.219.245.26
218.4.62.141
218.146.177.233
219.161.70.10
220.73.7.227
220.247.174.42
223.91.0.156
223.91.0.243
223.204.11.10
223.205.238.214
223.230.143.157
223.238.203.156

12470
cleantalk_updated_30d.ipset Normal file

File diff suppressed because it is too large Load Diff

5591
cleantalk_updated_7d.ipset Normal file

File diff suppressed because it is too large Load Diff

9962
coinbl_hosts.ipset Normal file

File diff suppressed because it is too large Load Diff

710
coinbl_hosts_browser.ipset Normal file
View File

@ -0,0 +1,710 @@
#
# coinbl_hosts_browser
#
# ipv4 hash:ip ipset
#
# [CoinBlockerLists]
# (https://gitlab.com/ZeroDot1/CoinBlockerLists) Simple lists
# that can help prevent cryptomining in the browser or other
# applications. A hosts list to prevent browser mining only.
# The maintainer's file contains hostnames, which have been
# DNS resolved to IP addresses.
#
# Maintainer : CoinBlockerLists
# Maintainer URL : https://gitlab.com/ZeroDot1/CoinBlockerLists
# List source URL : https://zerodot1.gitlab.io/CoinBlockerLists/hosts_browser
# Source File Date: Mon Jul 5 13:08:21 UTC 2021
#
# Category : organizations
# Version : 51
#
# This File Date : Mon Jul 5 13:08:33 UTC 2021
# Update Frequency: 1 day
# Aggregation : none
# Entries : 676 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=coinbl_hosts_browser
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
3.67.153.12
3.67.234.155
3.87.114.154
3.125.10.23
3.125.252.47
3.209.171.250
3.210.21.33
3.219.126.122
3.223.115.185
3.224.183.135
5.135.131.112
10.30.65.254
13.58.215.234
13.227.172.26
13.227.172.28
13.227.172.121
13.227.172.129
15.188.66.177
15.236.100.141
18.158.149.223
18.159.128.50
18.205.93.9
18.205.93.10
18.205.93.11
18.213.250.117
18.215.128.143
18.220.2.62
23.22.180.24
23.236.55.104
23.236.62.147
23.253.58.227
31.7.62.117
34.98.99.30
34.202.122.77
34.203.33.230
34.230.212.197
34.231.44.95
34.242.136.100
34.249.160.71
35.157.241.235
35.169.225.248
35.181.159.169
35.184.126.39
35.186.238.101
35.187.160.226
35.192.89.115
35.197.8.113
35.198.107.58
35.199.54.100
35.205.61.67
35.229.196.203
35.231.101.114
37.48.65.136
37.48.65.143
37.48.65.144
37.48.65.148
37.48.76.140
37.120.165.226
37.187.95.110
43.255.154.24
44.230.85.241
45.33.2.79
45.33.18.44
45.33.20.235
45.33.23.183
45.33.28.34
45.33.30.197
45.33.110.230
45.38.1.243
45.56.79.23
45.56.81.204
45.77.192.33
45.79.0.55
45.79.19.196
45.79.70.13
45.79.73.145
45.79.81.15
45.79.81.196
45.79.97.218
45.79.163.250
45.79.199.14
45.79.203.37
45.79.218.212
45.79.244.14
45.88.202.115
45.114.109.249
45.126.210.34
45.129.98.233
45.129.98.234
45.132.246.208
45.199.117.168
46.4.34.174
46.8.8.100
46.16.58.53
46.105.88.234
47.254.33.193
50.116.24.178
51.68.21.186
51.68.21.188
51.83.128.155
51.159.95.151
51.222.149.40
51.222.149.99
51.222.193.76
51.254.84.37
52.0.7.30
52.4.209.250
52.20.84.62
52.29.9.68
52.47.187.175
52.55.40.16
52.57.47.41
52.57.140.222
52.58.3.82
52.58.78.16
52.59.100.80
52.59.171.33
52.59.174.115
52.72.20.188
52.128.23.153
52.211.241.216
54.36.108.36
54.36.108.37
54.36.108.38
54.36.108.39
54.36.168.61
54.36.168.211
54.36.168.213
54.36.175.162
54.36.175.163
54.37.83.70
54.37.206.58
54.38.192.132
54.38.192.133
54.38.226.140
54.39.52.205
54.85.205.155
54.89.241.211
54.93.168.205
54.156.27.150
54.156.72.145
54.188.223.206
62.149.142.205
63.250.43.15
63.250.43.16
64.70.19.203
64.225.55.34
66.254.114.210
67.172.72.61
67.227.226.240
69.16.230.42
69.16.231.61
69.85.85.20
72.5.161.12
72.14.178.174
72.14.185.43
72.14.191.74
72.52.178.23
72.52.179.174
72.52.179.175
74.119.239.234
74.206.228.78
74.207.247.136
75.2.18.233
75.2.26.18
75.2.115.196
76.76.21.21
77.55.234.94
77.111.240.180
78.46.5.205
78.47.161.84
79.98.25.1
80.209.230.221
81.17.18.194
81.17.18.197
81.88.57.70
81.171.8.143
81.171.22.5
81.171.22.6
83.97.20.121
83.136.216.197
83.242.236.76
84.22.115.32
84.255.204.158
84.255.242.136
85.17.26.67
85.17.54.13
85.94.194.169
85.209.50.24
88.80.191.137
88.86.123.38
88.99.193.240
88.191.185.113
88.198.231.1
88.218.92.239
89.46.102.6
89.187.167.2
89.187.167.6
91.121.37.64
91.121.140.167
91.134.146.191
91.195.240.12
91.195.240.68
91.195.240.136
91.211.91.56
91.211.91.57
92.43.203.128
92.123.196.183
92.204.53.70
93.170.55.30
93.190.139.217
93.190.235.135
94.23.23.52
94.23.29.144
94.23.161.19
94.23.247.226
94.23.253.149
94.124.10.66
94.130.12.27
94.130.12.30
94.130.138.161
94.130.164.163
94.130.165.85
94.130.165.87
94.229.72.118
94.229.72.122
95.46.98.63
95.168.216.7
95.168.216.9
95.216.77.205
95.216.161.60
95.217.57.182
96.45.82.32
96.45.82.215
96.45.83.19
96.45.83.223
96.47.230.70
96.126.123.244
99.83.153.108
99.83.154.118
99.86.249.28
99.86.249.124
99.86.249.209
99.86.249.210
103.15.186.68
103.102.44.182
103.224.182.208
103.224.182.210
103.224.182.238
103.224.182.250
103.224.182.251
103.224.182.252
103.224.182.253
103.224.212.219
103.224.212.220
103.224.212.221
104.16.164.101
104.17.151.12
104.21.1.146
104.21.3.187
104.21.5.136
104.21.8.86
104.21.10.83
104.21.11.28
104.21.11.121
104.21.12.139
104.21.13.6
104.21.14.49
104.21.17.66
104.21.19.99
104.21.20.128
104.21.24.48
104.21.25.21
104.21.25.59
104.21.25.70
104.21.27.60
104.21.27.195
104.21.28.242
104.21.29.225
104.21.30.41
104.21.30.115
104.21.31.35
104.21.32.63
104.21.32.92
104.21.33.241
104.21.34.75
104.21.34.227
104.21.38.18
104.21.38.104
104.21.39.244
104.21.45.44
104.21.47.157
104.21.48.22
104.21.48.175
104.21.53.92
104.21.56.113
104.21.57.186
104.21.60.32
104.21.60.132
104.21.69.125
104.21.70.6
104.21.72.157
104.21.75.51
104.21.75.140
104.21.81.117
104.21.81.207
104.21.82.45
104.21.83.5
104.21.83.65
104.21.83.69
104.21.83.174
104.21.86.88
104.21.86.100
104.21.86.217
104.21.86.228
104.21.88.26
104.21.93.72
104.21.235.143
104.21.235.144
104.22.6.169
104.22.7.169
104.22.32.225
104.22.33.225
104.22.38.100
104.22.39.100
104.26.0.139
104.26.1.139
104.26.2.140
104.26.3.140
104.26.14.33
104.26.15.33
104.165.12.232
104.198.14.52
104.198.108.234
104.207.158.220
104.236.180.162
104.243.45.179
104.248.84.141
107.6.169.59
107.167.93.58
107.187.49.37
107.191.52.215
116.93.119.79
116.203.64.136
116.203.144.63
119.81.87.9
127.0.0.1
127.0.0.2
130.211.161.97
132.148.90.118
136.243.49.177
136.243.80.170
138.197.188.142
139.45.197.250
139.45.197.251
139.99.121.222
139.162.223.125
141.8.224.221
142.44.138.161
143.204.194.4
143.204.194.36
143.204.194.59
143.204.194.136
143.204.194.144
143.204.194.153
143.204.194.162
143.204.194.179
143.204.194.183
143.204.194.184
143.204.194.210
143.204.194.217
144.76.35.207
144.76.113.157
144.76.121.181
145.239.0.218
145.239.7.163
145.239.70.127
145.239.70.128
145.239.70.129
145.239.141.5
145.239.206.122
145.239.244.5
145.239.244.9
145.239.244.13
145.239.244.74
145.239.253.103
145.239.253.125
146.59.26.8
146.59.176.223
147.135.253.210
148.251.139.94
148.251.178.132
149.56.19.3
149.56.19.43
149.56.20.201
149.56.89.160
149.202.83.171
149.202.83.240
149.202.84.228
151.80.145.68
151.101.1.195
151.101.65.195
151.106.15.10
151.106.15.11
151.139.128.10
151.139.128.11
154.85.135.242
155.138.235.68
156.242.144.38
157.90.26.72
157.90.152.31
157.230.168.89
157.245.174.176
159.69.42.212
159.69.83.207
159.69.112.37
159.69.144.179
159.69.186.9
159.89.24.58
159.203.117.185
162.55.36.41
162.55.172.212
162.210.196.173
162.222.213.196
162.242.150.89
163.172.226.137
164.132.95.126
165.227.196.39
165.232.142.149
167.99.168.162
167.99.246.105
168.119.38.182
169.47.130.72
172.67.6.49
172.67.7.48
172.67.29.231
172.67.68.60
172.67.70.11
172.67.72.158
172.67.129.109
172.67.131.25
172.67.133.127
172.67.133.197
172.67.137.60
172.67.137.109
172.67.139.13
172.67.146.209
172.67.147.232
172.67.148.223
172.67.150.137
172.67.152.116
172.67.153.103
172.67.154.20
172.67.156.28
172.67.157.200
172.67.159.208
172.67.162.166
172.67.165.22
172.67.165.117
172.67.165.240
172.67.166.4
172.67.169.7
172.67.169.161
172.67.171.223
172.67.171.251
172.67.172.43
172.67.172.224
172.67.174.236
172.67.176.30
172.67.177.121
172.67.179.175
172.67.184.61
172.67.184.223
172.67.185.81
172.67.185.189
172.67.187.107
172.67.191.29
172.67.192.230
172.67.193.250
172.67.194.228
172.67.196.217
172.67.206.103
172.67.208.80
172.67.209.176
172.67.210.52
172.67.211.53
172.67.214.108
172.67.215.161
172.67.216.92
172.67.216.212
172.67.217.49
172.67.217.69
172.67.217.211
172.67.218.4
172.67.221.252
172.67.222.7
172.67.223.2
172.67.223.49
172.104.11.229
172.104.21.26
172.104.31.133
172.104.153.105
172.104.184.165
172.121.14.176
172.217.16.225
172.217.16.244
172.247.135.76
173.212.235.172
173.239.5.6
173.239.8.164
173.255.194.134
173.255.255.22
176.9.147.178
176.34.241.253
176.58.111.142
178.32.120.127
178.62.227.52
178.63.8.69
178.63.40.224
178.63.45.29
178.63.45.142
178.63.100.197
178.79.150.219
178.210.89.119
182.61.201.50
182.61.201.90
182.61.201.91
182.61.201.92
183.181.90.33
184.168.131.241
185.52.251.2
185.53.177.11
185.53.177.14
185.53.177.20
185.53.177.52
185.53.177.54
185.53.177.70
185.53.178.50
185.59.221.22
185.59.221.25
185.81.129.82
185.107.56.52
185.107.56.195
185.107.56.198
185.107.56.208
185.107.56.210
185.173.160.140
185.173.160.141
185.199.108.153
185.199.109.153
185.199.110.153
185.199.111.153
185.216.177.48
188.40.2.4
188.40.87.121
188.127.241.203
188.165.36.206
188.165.223.152
188.166.132.94
190.2.134.114
190.2.139.23
192.64.119.20
192.64.119.58
192.64.119.254
192.64.147.228
192.102.6.73
192.102.6.94
192.110.160.146
192.134.5.38
192.157.56.141
192.169.69.26
192.171.18.197
192.185.4.93
192.187.111.219
192.187.111.222
193.29.105.150
193.38.54.170
193.70.35.46
193.238.27.24
194.36.145.196
194.48.152.103
194.67.71.52
194.67.71.63
194.67.71.112
194.67.71.142
194.190.130.86
195.20.44.14
195.20.45.221
195.20.45.236
195.20.47.169
195.20.48.1
195.20.48.155
195.20.49.16
195.20.50.85
195.20.50.156
195.20.50.221
195.20.51.116
195.20.53.49
195.20.54.13
195.20.54.237
195.20.55.30
195.20.55.113
195.20.55.194
195.154.222.63
195.154.243.212
195.181.164.18
195.181.164.19
195.201.12.107
195.201.12.110
195.201.74.132
195.201.83.239
195.201.105.119
195.201.162.222
195.201.162.223
195.201.162.224
195.201.162.225
195.201.162.226
195.201.162.227
195.201.162.228
195.201.162.229
195.201.162.230
195.201.162.231
198.54.117.210
198.54.117.211
198.54.117.212
198.54.117.215
198.54.117.216
198.54.117.217
198.54.117.218
198.58.118.167
198.58.126.31
199.59.242.153
199.115.115.119
199.231.85.122
199.231.85.124
202.61.241.56
202.61.242.56
202.61.254.211
204.11.56.48
206.81.5.96
206.188.193.177
206.189.50.60
206.189.50.215
206.189.52.23
206.189.58.26
207.148.10.239
207.244.67.214
207.244.67.215
208.91.197.27
208.91.197.46
208.100.26.245
209.17.116.160
209.97.140.241
209.99.40.222
209.126.123.12
212.32.255.4
212.32.255.5
212.32.255.6
212.32.255.12
212.32.255.13
212.32.255.72
212.32.255.137
212.32.255.139
212.32.255.141
212.32.255.148
212.32.255.198
212.32.255.212
212.83.168.39
212.129.44.155
212.129.44.156
212.129.44.157
213.186.33.5
216.155.158.140
216.189.56.129
217.70.184.38
217.160.0.229

489
coinbl_hosts_optional.ipset Normal file
View File

@ -0,0 +1,489 @@
#
# coinbl_hosts_optional
#
# ipv4 hash:ip ipset
#
# [CoinBlockerLists]
# (https://gitlab.com/ZeroDot1/CoinBlockerLists) Simple lists
# that can help prevent cryptomining in the browser or other
# applications. This list contains additional domains, for
# administrators to prevent mining in networks. The
# maintainer's file contains hostnames, which have been DNS
# resolved to IP addresses.
#
# Maintainer : CoinBlockerLists
# Maintainer URL : https://gitlab.com/ZeroDot1/CoinBlockerLists
# List source URL : https://zerodot1.gitlab.io/CoinBlockerLists/hosts_optional
# Source File Date: Mon Jul 5 13:08:09 UTC 2021
#
# Category : organizations
# Version : 34
#
# This File Date : Mon Jul 5 13:08:20 UTC 2021
# Update Frequency: 1 day
# Aggregation : none
# Entries : 454 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=coinbl_hosts_optional
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
3.36.178.17
3.81.178.167
3.208.77.48
3.215.41.112
3.223.115.185
3.226.182.14
8.131.77.234
13.35.199.20
13.35.199.59
13.35.199.65
13.35.199.104
13.224.221.17
13.224.221.24
13.224.221.28
13.224.221.33
13.224.221.35
13.224.221.73
13.224.221.77
13.224.221.121
13.227.172.3
13.227.172.9
13.227.172.11
13.227.172.16
13.227.172.18
13.227.172.23
13.227.172.27
13.227.172.28
13.227.172.29
13.227.172.30
13.227.172.32
13.227.172.35
13.227.172.46
13.227.172.55
13.227.172.60
13.227.172.63
13.227.172.72
13.227.172.73
13.227.172.76
13.227.172.79
13.227.172.81
13.227.172.84
13.227.172.86
13.227.172.108
13.227.172.109
13.227.172.115
13.227.172.120
13.227.172.123
13.227.172.126
13.227.172.127
13.227.172.128
13.229.36.104
13.248.216.40
13.250.251.254
15.164.29.179
15.197.189.240
18.139.16.229
18.180.160.128
18.182.97.138
18.208.24.77
18.209.127.4
18.215.28.204
23.20.11.15
23.22.5.68
23.227.38.74
34.194.144.71
34.197.120.222
34.234.229.56
34.244.67.113
34.245.84.181
34.251.42.170
34.253.133.165
34.255.53.167
35.173.176.69
35.214.196.109
35.234.86.61
37.48.65.144
37.60.226.111
37.187.140.170
39.99.229.144
45.60.12.106
45.60.14.106
45.60.102.106
47.91.167.174
49.50.108.71
49.50.108.72
49.50.108.73
50.16.249.145
50.116.13.149
52.3.66.20
52.4.1.113
52.5.97.222
52.6.197.107
52.21.227.162
52.44.138.87
52.44.246.37
52.48.160.204
52.68.174.232
52.74.200.64
52.79.99.118
52.84.150.4
52.84.150.16
52.84.150.20
52.84.150.33
52.84.150.34
52.97.146.136
52.97.179.232
52.97.211.136
52.97.211.248
52.112.193.206
52.193.194.11
52.194.29.200
52.194.156.8
52.198.111.126
52.198.202.252
52.198.240.103
52.199.209.139
52.199.252.215
52.205.51.26
52.209.122.234
52.214.9.165
52.215.192.131
52.218.63.12
52.219.1.112
54.39.92.109
54.64.8.206
54.65.60.186
54.73.26.109
54.77.119.238
54.92.29.195
54.156.151.20
54.178.242.159
54.204.89.179
54.216.252.255
54.237.137.88
54.237.159.171
54.238.248.209
54.249.46.201
58.228.236.210
58.228.236.211
58.228.236.212
58.228.236.213
58.228.236.214
58.228.236.215
62.138.1.181
63.32.16.204
64.32.14.200
64.32.14.201
64.32.14.202
64.32.14.203
64.32.14.204
64.32.14.205
64.32.14.206
64.32.14.207
64.32.14.208
64.32.14.209
66.235.200.146
67.20.76.196
67.225.138.42
67.227.226.240
72.14.191.28
75.2.60.5
76.76.21.21
76.223.65.111
88.198.54.148
88.214.207.96
88.221.16.198
89.187.189.233
90.219.129.207
90.219.142.111
93.84.114.212
94.23.50.33
94.237.85.33
95.217.117.42
99.86.118.4
99.86.118.37
99.86.118.65
99.86.118.109
99.86.255.6
99.86.255.7
99.86.255.8
99.86.255.18
99.86.255.21
99.86.255.23
99.86.255.24
99.86.255.25
99.86.255.27
99.86.255.28
99.86.255.29
99.86.255.30
99.86.255.52
99.86.255.64
99.86.255.70
99.86.255.80
99.86.255.81
99.86.255.82
99.86.255.85
99.86.255.87
99.86.255.98
99.86.255.103
99.86.255.106
99.86.255.108
99.86.255.109
99.86.255.113
99.86.255.117
99.86.255.124
99.86.255.126
104.16.36.84
104.16.37.84
104.16.51.111
104.16.53.111
104.16.137.22
104.16.171.181
104.16.172.181
104.16.173.181
104.16.174.181
104.16.175.181
104.16.230.51
104.16.247.71
104.16.248.71
104.17.70.206
104.17.71.206
104.17.72.206
104.17.73.206
104.17.74.206
104.17.137.178
104.17.138.178
104.17.139.178
104.17.140.178
104.17.141.178
104.18.0.64
104.18.0.209
104.18.1.64
104.18.1.209
104.18.6.10
104.18.7.10
104.18.8.157
104.18.9.157
104.18.12.68
104.18.13.68
104.18.14.237
104.18.15.237
104.18.16.48
104.18.16.131
104.18.17.48
104.18.17.131
104.18.18.70
104.18.19.70
104.18.20.159
104.18.21.159
104.18.26.69
104.18.26.71
104.18.27.69
104.18.27.71
104.18.28.122
104.18.28.131
104.18.29.122
104.18.29.131
104.18.30.151
104.18.31.151
104.18.122.47
104.18.123.47
104.18.124.47
104.18.125.47
104.18.126.47
104.18.210.56
104.18.211.56
104.20.147.108
104.20.148.108
104.20.165.102
104.20.166.102
104.21.3.84
104.21.6.108
104.21.12.149
104.21.21.133
104.21.21.232
104.21.27.47
104.21.29.40
104.21.29.125
104.21.33.32
104.21.40.202
104.21.46.128
104.21.48.5
104.21.53.146
104.21.54.180
104.21.57.91
104.21.58.139
104.21.58.172
104.21.61.229
104.21.62.33
104.21.76.57
104.21.83.5
104.21.84.244
104.21.85.241
104.21.89.144
104.21.89.253
104.21.96.110
104.22.6.128
104.22.7.128
104.22.10.221
104.22.11.221
104.22.28.145
104.22.29.145
104.22.60.73
104.22.61.73
104.22.78.208
104.22.79.208
104.24.20.66
104.24.21.66
104.26.2.224
104.26.3.224
104.26.4.19
104.26.5.19
104.26.8.106
104.26.9.106
104.26.12.88
104.26.12.174
104.26.13.88
104.26.13.174
104.26.14.247
104.26.15.247
104.78.176.94
104.160.191.70
104.160.191.71
104.160.191.72
104.160.191.73
104.160.191.74
104.160.191.75
104.160.191.76
104.160.191.77
104.160.191.78
104.160.191.79
104.160.191.80
104.244.98.64
107.21.138.182
107.180.124.16
108.128.72.146
110.10.90.180
116.203.46.114
116.203.78.40
121.242.224.82
121.242.224.83
121.242.224.84
121.242.224.85
121.242.224.86
121.242.224.87
121.242.224.88
121.242.224.89
121.242.224.90
121.242.224.91
129.226.173.23
134.122.6.5
138.68.141.151
138.68.248.245
139.59.81.153
143.204.198.3
143.204.198.30
143.204.198.37
143.204.198.79
143.204.198.101
143.204.198.105
143.204.198.108
143.204.198.110
145.14.145.212
148.251.53.118
149.28.208.216
151.101.2.133
151.101.66.133
151.101.130.133
151.101.194.133
160.121.232.59
161.35.100.86
161.71.26.44
162.241.218.88
163.171.128.148
163.171.129.134
163.171.133.124
163.171.138.116
167.89.118.52
167.89.118.83
167.89.123.54
167.89.123.124
172.67.14.95
172.67.21.61
172.67.22.110
172.67.28.167
172.67.30.8
172.67.68.82
172.67.69.76
172.67.69.167
172.67.70.52
172.67.73.151
172.67.74.154
172.67.82.203
172.67.130.128
172.67.134.189
172.67.139.6
172.67.141.5
172.67.148.91
172.67.149.1
172.67.150.125
172.67.157.5
172.67.158.126
172.67.160.221
172.67.162.79
172.67.168.233
172.67.175.39
172.67.177.24
172.67.188.178
172.67.190.13
172.67.194.235
172.67.198.213
172.67.199.106
172.67.200.245
172.67.204.125
172.67.210.52
172.67.212.138
172.67.213.139
172.67.216.10
172.67.219.105
172.104.233.20
172.106.88.242
176.32.79.19
178.63.62.94
184.168.131.241
185.26.156.18
185.53.177.14
185.85.241.244
185.85.241.246
185.122.58.37
185.180.14.233
185.189.56.92
185.199.108.153
185.199.109.153
185.199.110.153
185.199.111.153
190.210.186.207
192.3.11.20
192.64.119.92
192.99.12.221
192.124.249.52
192.254.232.90
193.70.122.58
193.160.66.104
195.39.222.84
198.23.50.77
198.37.155.136
199.16.172.126
204.11.56.48
206.189.144.244
207.246.103.64
211.180.1.66
216.58.212.211
221.122.37.76
255.255.255.255

1425
coinbl_ips.ipset Normal file

File diff suppressed because it is too large Load Diff

11839
cruzit_web_attacks.ipset Normal file

File diff suppressed because it is too large Load Diff

1396
cta_cryptowall.ipset Normal file

File diff suppressed because it is too large Load Diff

631
cybercrime.ipset Normal file
View File

@ -0,0 +1,631 @@
#
# cybercrime
#
# ipv4 hash:ip ipset
#
# [CyberCrime] (http://cybercrime-tracker.net/) A project
# tracking Command and Control.
#
# Maintainer : CyberCrime
# Maintainer URL : http://cybercrime-tracker.net/
# List source URL : http://cybercrime-tracker.net/fuckerz.php
# Source File Date: Fri Sep 3 00:44:07 UTC 2021
#
# Category : malware
# Version : 1825
#
# This File Date : Fri Sep 3 00:44:07 UTC 2021
# Update Frequency: 12 hours
# Aggregation : none
# Entries : 601 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=cybercrime
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
2.56.59.248
2.56.213.134
3.15.137.158
3.18.106.188
3.88.177.89
3.220.230.15
3.237.80.14
5.39.93.167
5.62.56.249
5.62.58.233
5.62.60.17
5.62.63.145
5.172.235.115
5.181.235.74
5.188.62.214
5.188.203.23
5.188.210.4
5.199.138.97
5.255.174.141
8.3.29.102
13.58.177.122
13.58.219.59
13.68.190.191
13.82.138.133
13.82.208.125
13.90.242.32
13.92.126.72
13.92.139.68
14.161.19.71
14.162.98.177
14.180.68.159
14.232.231.118
14.239.104.150
14.244.149.245
18.139.110.93
18.195.116.136
18.217.59.153
18.217.89.38
18.217.251.100
18.218.173.127
18.221.206.237
20.38.9.162
20.63.219.178
20.64.82.250
20.97.28.47
20.97.171.13
20.98.97.93
20.98.105.198
20.109.25.130
20.185.68.103
20.199.80.146
20.199.110.4
23.88.42.188
23.95.24.36
23.96.106.213
23.228.109.147
24.225.29.61
27.57.175.39
27.72.170.18
27.114.141.162
27.123.255.239
31.202.101.40
34.71.43.219
34.74.243.222
34.136.169.255
34.139.223.144
34.140.62.71
34.140.240.144
34.145.96.237
34.146.227.181
34.209.223.243
34.213.25.84
35.75.4.158
35.174.242.184
35.188.209.27
35.190.131.209
35.193.217.247
35.202.157.217
35.229.64.18
36.82.123.221
36.83.191.52
36.85.223.94
36.85.241.138
36.85.251.215
36.92.208.81
37.0.8.34
37.0.8.128
37.0.8.176
37.0.10.46
37.0.10.159
37.0.11.84
37.24.85.119
37.58.63.169
37.59.48.36
37.59.222.30
37.120.193.232
37.186.40.54
39.36.203.27
39.41.187.139
39.53.98.129
39.53.175.116
40.78.136.54
40.78.150.214
40.84.148.87
40.89.174.27
40.112.161.81
40.114.104.110
40.121.247.195
40.124.139.158
41.13.120.248
41.33.199.10
41.106.176.175
41.139.211.118
41.140.53.196
41.142.30.120
41.142.46.109
41.142.198.174
41.222.209.14
41.227.152.154
41.233.104.180
41.242.138.54
41.249.47.245
41.249.55.176
41.249.56.126
41.249.106.20
41.249.110.197
41.249.237.99
41.249.243.210
41.249.246.50
43.224.249.139
43.224.249.172
43.243.222.116
43.251.17.62
43.252.230.164
45.7.155.19
45.9.20.200
45.40.165.15
45.43.18.140
45.64.112.78
45.79.4.85
45.129.137.249
45.146.14.14
45.146.167.57
45.153.241.68
45.164.203.215
45.188.121.234
45.231.154.227
45.232.91.205
46.4.55.140
46.5.228.174
46.101.191.225
46.150.254.52
46.183.218.132
46.246.36.17
46.246.37.180
47.114.3.145
49.36.235.183
49.37.146.89
49.37.149.60
49.37.221.69
49.228.224.153
50.6.77.96
50.21.189.251
50.62.161.77
50.63.14.158
50.87.144.129
51.15.16.15
51.15.212.200
51.38.32.107
51.79.157.202
51.81.249.29
51.141.40.247
51.179.109.124
51.254.204.117
52.15.230.57
52.23.192.29
52.40.17.212
52.165.151.191
52.168.82.114
52.170.75.174
52.173.248.83
52.191.64.108
52.207.144.229
52.234.151.4
52.255.140.181
54.39.17.10
54.39.78.71
54.242.226.31
58.137.148.231
58.186.98.73
59.103.139.245
59.173.13.235
62.109.25.31
62.122.95.211
62.122.199.251
62.149.20.51
64.71.32.17
64.71.32.30
64.225.3.93
65.255.38.126
66.23.229.197
67.209.131.131
68.168.223.29
68.183.62.241
68.183.122.95
68.183.157.57
69.167.24.24
70.37.165.145
72.27.75.83
73.4.94.213
74.208.16.5
74.208.75.207
74.208.85.44
74.208.182.178
74.208.217.47
76.26.217.25
77.32.42.99
78.46.77.244
79.101.43.164
79.155.253.170
81.16.251.250
82.102.19.136
82.118.4.69
82.165.185.18
82.165.224.70
82.165.224.234
82.211.187.110
83.57.212.74
85.25.35.25
85.95.241.138
85.201.235.74
85.214.228.194
85.214.244.174
85.215.229.75
85.254.72.27
86.123.29.69
87.98.220.90
87.98.251.172
87.106.65.242
87.106.193.188
87.117.229.53
88.150.230.191
88.150.241.126
89.26.241.81
89.26.241.101
89.40.182.9
89.42.216.240
89.108.88.240
89.144.12.17
89.163.251.184
89.172.241.26
90.40.252.109
91.121.52.201
91.149.252.144
91.200.12.67
91.226.252.19
91.227.68.139
93.158.205.116
94.19.172.76
94.23.35.129
94.23.250.140
94.65.115.50
94.66.8.192
94.177.172.36
95.168.183.69
95.178.179.209
96.89.96.197
97.74.24.104
98.130.2.64
102.53.13.104
102.186.197.16
102.218.244.74
103.10.228.24
103.17.36.141
103.52.135.150
103.56.112.85
103.56.115.68
103.56.115.142
103.73.162.156
103.78.237.123
103.80.31.214
103.94.120.227
103.121.148.95
103.141.109.46
103.165.28.121
103.199.182.15
103.213.213.22
103.229.124.198
104.153.59.141
104.154.77.58
104.198.240.157
104.199.31.76
104.200.135.11
105.104.92.96
105.109.242.52
105.112.184.63
105.141.206.226
105.159.224.58
106.250.228.145
107.181.189.148
109.9.102.66
109.201.130.12
109.233.121.43
110.86.178.9
110.136.218.9
110.137.80.250
111.95.128.88
112.74.185.67
112.197.54.205
112.200.206.193
112.252.227.219
113.161.81.233
113.162.168.245
113.195.166.220
114.125.184.165
115.37.25.18
115.96.216.177
115.133.100.160
115.186.130.104
115.192.122.160
115.196.218.133
115.206.124.87
116.97.54.176
116.203.198.16
117.98.206.237
119.28.61.225
119.29.65.233
119.93.81.67
121.42.152.155
122.53.60.199
122.114.252.123
122.129.118.115
122.161.242.169
122.169.63.193
122.174.154.79
122.233.152.11
123.206.197.121
123.249.79.212
124.106.176.178
124.121.93.130
125.167.203.126
128.90.187.133
128.90.198.37
128.90.198.154
129.121.176.193
131.72.69.32
134.209.122.60
134.236.170.54
135.125.21.40
136.244.82.181
137.74.201.8
137.135.112.13
138.94.123.233
138.255.232.78
139.5.133.98
139.194.35.122
140.227.28.39
141.94.65.157
141.255.146.81
141.255.148.130
142.252.251.149
143.110.153.171
143.198.137.138
143.198.175.237
143.244.162.202
143.244.186.99
143.244.188.129
144.48.243.69
144.126.139.121
145.239.225.54
146.185.223.5
147.96.4.108
147.182.215.209
147.236.144.246
148.0.19.1
148.0.43.209
148.66.128.80
148.66.145.23
149.113.52.179
149.202.33.10
150.136.244.52
151.80.5.131
151.236.51.83
151.252.210.231
154.126.55.200
154.182.43.237
156.146.56.108
156.201.226.122
157.90.127.115
158.69.170.61
158.181.74.251
159.65.255.70
159.89.1.35
159.89.1.139
159.89.1.205
159.89.5.170
159.89.6.145
159.89.18.84
159.203.83.245
160.116.244.183
160.155.230.98
160.177.24.7
160.177.68.173
160.177.74.150
160.178.193.25
161.22.55.196
161.35.131.220
161.35.133.31
162.208.51.173
163.172.207.190
163.172.255.139
164.132.177.1
165.227.29.96
165.227.165.44
167.71.183.56
167.71.249.173
167.172.24.96
168.61.156.253
168.119.115.245
168.181.50.108
171.94.245.251
172.83.47.92
172.83.47.151
172.98.80.81
172.98.80.111
172.104.45.180
172.241.214.244
173.201.196.32
173.212.243.152
173.255.252.45
174.138.16.88
175.107.213.213
175.138.119.162
175.139.119.2
175.139.167.184
176.28.169.124
176.88.14.7
176.88.92.110
176.113.115.10
176.153.46.249
176.232.220.19
177.0.148.14
177.16.164.174
177.18.197.109
177.201.72.236
178.18.255.175
178.80.69.98
178.221.33.254
178.248.114.64
179.61.228.172
179.61.240.51
179.70.193.101
179.223.144.216
180.244.96.85
180.245.135.144
181.61.208.127
181.129.55.234
182.45.229.75
182.45.229.231
182.190.243.207
182.255.63.166
183.88.20.80
183.129.43.77
183.129.46.57
184.22.116.110
184.168.27.3
184.170.241.192
185.38.249.225
185.43.188.52
185.81.157.242
185.84.172.196
185.86.93.18
185.86.93.49
185.86.93.61
185.86.93.64
185.95.109.71
185.158.113.28
185.161.200.10
185.161.200.11
185.161.200.12
185.161.200.13
185.161.201.11
185.191.34.223
185.193.36.55
185.206.224.212
185.209.21.71
185.212.131.92
185.212.131.93
185.217.68.206
185.220.101.131
185.252.146.157
185.253.97.235
186.86.32.217
186.210.164.197
186.219.142.149
186.223.175.65
186.244.114.48
187.59.10.159
187.102.215.198
187.214.132.157
188.121.57.4
188.213.143.10
188.214.125.70
188.214.125.78
189.144.80.13
189.144.105.198
189.144.130.244
189.200.144.66
189.254.171.186
190.3.79.254
190.77.124.245
190.89.38.4
190.110.98.50
190.238.248.117
191.92.153.44
191.96.100.20
191.96.100.54
191.217.236.62
192.145.125.36
192.186.22.35
193.23.3.9
193.37.32.162
193.56.255.196
193.124.191.145
193.176.85.112
193.201.224.28
194.61.24.99
194.67.223.115
194.233.69.90
195.20.240.196
195.133.40.19
195.154.48.192
195.154.168.130
195.154.187.58
195.201.61.51
195.201.125.228
196.18.251.243
196.179.224.38
196.217.71.66
196.234.180.45
196.235.244.20
197.26.104.249
197.37.131.148
197.207.118.185
197.253.147.220
198.1.119.72
198.1.228.192
198.12.90.238
198.23.111.83
198.23.174.117
198.57.228.205
198.71.228.70
198.181.163.105
200.97.106.75
200.149.132.154
200.225.176.126
201.71.217.45
201.153.171.45
201.183.162.55
201.184.133.220
202.133.49.194
202.137.123.212
202.164.137.47
203.76.98.2
203.159.80.102
203.159.80.189
203.213.34.114
203.215.166.6
204.48.21.80
204.152.252.35
205.214.204.100
206.84.140.138
206.84.142.4
208.110.65.69
209.127.186.240
209.159.148.142
210.187.139.173
210.209.123.81
210.224.185.23
212.58.103.21
212.81.39.16
212.102.38.162
212.102.46.221
212.102.57.142
212.112.122.153
212.192.241.169
212.227.24.51
212.227.29.211
212.227.216.70
212.227.216.156
213.202.230.209
213.230.77.103
213.251.182.110
216.21.18.193
217.160.28.101
219.94.128.34
219.129.237.218
223.27.212.187
223.86.233.163
223.185.2.153
223.199.161.140

7291
darklist_de.netset Normal file

File diff suppressed because it is too large Load Diff

4257
datacenters.netset Normal file

File diff suppressed because it is too large Load Diff

6599
dm_tor.ipset Normal file

File diff suppressed because it is too large Load Diff

49
dshield.netset Normal file
View File

@ -0,0 +1,49 @@
#
# dshield
#
# ipv4 hash:net ipset
#
# [DShield.org] (https://dshield.org/) top 20 attacking class
# C (/24) subnets over the last three days
#
# Maintainer : DShield.org
# Maintainer URL : https://dshield.org/
# List source URL : http://feeds.dshield.org/block.txt
# Source File Date: Fri Sep 3 05:42:29 UTC 2021
#
# Category : attacks
# Version : 6814
#
# This File Date : Fri Sep 3 06:24:02 UTC 2021
# Update Frequency: 10 mins
# Aggregation : none
# Entries : 19 subnets, 5120 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=dshield
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
45.71.217.0/24
45.95.147.0/24
45.143.200.0/24
45.146.164.0/23
45.155.205.0/24
71.6.233.0/24
79.124.62.0/24
89.248.165.0/24
92.63.197.0/24
103.145.13.0/24
107.189.29.0/24
167.248.133.0/24
185.200.118.0/24
193.27.228.0/24
193.46.255.0/24
193.163.125.0/24
194.61.25.0/24
205.185.126.0/24
209.141.59.0/24

63
dshield_1d.netset Normal file
View File

@ -0,0 +1,63 @@
#
# dshield_1d
#
# ipv4 hash:net ipset
#
# [DShield.org] (https://dshield.org/) top 20 attacking class
# C (/24) subnets over the last three days
#
# Maintainer : DShield.org
# Maintainer URL : https://dshield.org/
# List source URL : http://feeds.dshield.org/block.txt
# Source File Date: Fri Sep 3 03:42:29 UTC 2021
#
# Category : attacks
# Version : 6039
#
# This File Date : Fri Sep 3 04:08:02 UTC 2021
# Update Frequency: 10 mins
# Aggregation : 1 day
# Entries : 33 subnets, 8960 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=dshield_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
45.71.217.0/24
45.95.147.0/24
45.135.232.0/24
45.143.200.0/24
45.146.164.0/23
45.155.205.0/24
71.6.233.0/24
78.128.113.0/24
79.124.62.0/24
80.82.77.0/24
89.248.165.0/24
91.132.58.0/24
92.63.197.0/24
103.145.13.0/24
107.189.13.0/24
107.189.29.0/24
141.98.10.0/24
146.88.240.0/24
167.248.133.0/24
183.136.225.0/24
185.200.118.0/24
192.241.213.0/24
192.241.214.0/24
192.241.220.0/23
193.27.228.0/24
193.46.255.0/24
193.163.125.0/24
193.242.145.0/24
194.61.25.0/24
205.185.126.0/24
208.100.26.0/24
209.141.50.0/24
209.141.59.0/24

98
dshield_30d.netset Normal file
View File

@ -0,0 +1,98 @@
#
# dshield_30d
#
# ipv4 hash:net ipset
#
# [DShield.org] (https://dshield.org/) top 20 attacking class
# C (/24) subnets over the last three days
#
# Maintainer : DShield.org
# Maintainer URL : https://dshield.org/
# List source URL : http://feeds.dshield.org/block.txt
# Source File Date: Fri Sep 3 03:42:29 UTC 2021
#
# Category : attacks
# Version : 2131
#
# This File Date : Fri Sep 3 04:08:03 UTC 2021
# Update Frequency: 10 mins
# Aggregation : 30 days
# Entries : 68 subnets, 18944 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=dshield_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.62.0/24
23.148.145.0/24
45.61.184.0/24
45.71.217.0/24
45.95.147.0/24
45.135.232.0/24
45.137.20.0/24
45.143.200.0/24
45.143.203.0/24
45.146.164.0/23
45.155.205.0/24
45.227.255.0/24
69.55.59.0/24
71.6.233.0/24
78.128.113.0/24
79.124.62.0/24
80.82.65.0/24
80.82.77.0/24
89.248.165.0/24
89.248.168.0/24
91.132.58.0/24
91.191.209.0/24
91.218.115.0/24
92.63.197.0/24
94.232.45.0/24
103.125.191.0/24
103.145.13.0/24
107.189.13.0/24
107.189.14.0/24
107.189.29.0/24
111.7.96.0/24
123.160.221.0/24
141.98.10.0/24
146.88.240.0/24
157.230.114.0/24
158.255.7.0/24
167.248.133.0/24
170.106.115.0/24
174.138.188.0/24
176.113.115.0/24
180.149.126.0/24
183.136.225.0/24
183.136.226.0/24
185.53.90.0/24
185.156.73.0/24
185.200.118.0/24
192.241.206.0/24
192.241.213.0/24
192.241.214.0/23
192.241.216.0/22
192.241.220.0/23
193.27.228.0/24
193.46.255.0/24
193.163.125.0/24
193.242.145.0/24
194.61.25.0/24
199.19.224.0/24
199.19.226.0/24
199.195.252.0/24
203.159.80.0/24
205.185.116.0/24
205.185.126.0/24
208.100.26.0/24
209.141.41.0/24
209.141.50.0/24
209.141.55.0/24
209.141.56.0/24
209.141.59.0/24

77
dshield_7d.netset Normal file
View File

@ -0,0 +1,77 @@
#
# dshield_7d
#
# ipv4 hash:net ipset
#
# [DShield.org] (https://dshield.org/) top 20 attacking class
# C (/24) subnets over the last three days
#
# Maintainer : DShield.org
# Maintainer URL : https://dshield.org/
# List source URL : http://feeds.dshield.org/block.txt
# Source File Date: Fri Sep 3 09:27:29 UTC 2021
#
# Category : attacks
# Version : 3422
#
# This File Date : Fri Sep 3 09:56:01 UTC 2021
# Update Frequency: 10 mins
# Aggregation : 7 days
# Entries : 47 subnets, 12544 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=dshield_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
23.148.145.0/24
45.71.217.0/24
45.95.147.0/24
45.135.232.0/24
45.143.200.0/24
45.143.203.0/24
45.146.164.0/23
45.155.205.0/24
71.6.233.0/24
78.128.113.0/24
79.124.62.0/24
80.82.77.0/24
89.248.165.0/24
91.132.58.0/24
92.63.197.0/24
103.145.13.0/24
107.189.13.0/24
107.189.14.0/24
107.189.29.0/24
111.7.96.0/24
123.160.221.0/24
141.98.10.0/24
146.88.240.0/24
167.248.133.0/24
174.138.188.0/24
180.149.126.0/24
183.136.225.0/24
183.136.226.0/24
185.156.73.0/24
185.200.118.0/24
192.241.206.0/24
192.241.213.0/24
192.241.214.0/24
192.241.216.0/24
192.241.220.0/23
193.27.228.0/24
193.46.255.0/24
193.163.125.0/24
193.242.145.0/24
194.61.25.0/24
199.195.252.0/24
205.185.116.0/24
205.185.126.0/24
208.100.26.0/24
209.141.50.0/24
209.141.56.0/24
209.141.59.0/24

1030
dshield_top_1000.ipset Normal file

File diff suppressed because it is too large Load Diff

87
dyndns_ponmocup.ipset Normal file
View File

@ -0,0 +1,87 @@
#
# dyndns_ponmocup
#
# ipv4 hash:ip ipset
#
# [DynDNS.org]
# (http://security-research.dyndns.org/pub/malware-feeds/)
# Ponmocup. The malware powering the botnet has been around
# since 2006 and its known under various names, including
# Ponmocup, Vundo, Virtumonde, Milicenso and Swisyn. It has
# been used for ad fraud, data theft and downloading
# additional threats to infected systems. Ponmocup is one of
# the largest currently active and, with nine consecutive
# years, also one of the longest running, but it is rarely
# noticed as the operators take care to keep it operating
# under the radar.
#
# Maintainer : DynDNS.org
# Maintainer URL : http://security-research.dyndns.org/pub/malware-feeds/
# List source URL : http://security-research.dyndns.org/pub/malware-feeds/ponmocup-infected-domains-shadowserver.csv
# Source File Date: Fri Sep 3 07:26:46 UTC 2021
#
# Category : malware
# Version : 1123
#
# This File Date : Fri Sep 3 07:40:26 UTC 2021
# Update Frequency: 1 day
# Aggregation : none
# Entries : 48 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=dyndns_ponmocup
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
46.30.215.23
46.30.215.160
54.153.111.129
62.149.140.104
63.247.141.235
64.70.19.52
66.96.149.32
67.20.112.11
69.12.64.226
69.61.26.162
72.172.132.43
74.208.236.248
77.55.157.78
77.92.75.4
77.105.36.251
79.124.76.10
80.94.98.99
82.118.24.217
85.13.140.101
87.98.239.19
89.221.250.12
94.130.190.96
94.152.142.131
95.142.65.77
107.155.71.6
136.243.80.165
144.76.45.43
156.54.179.186
157.7.144.5
159.69.61.92
162.241.224.245
162.255.166.188
173.209.47.104
173.254.30.178
176.31.222.193
192.99.161.26
199.67.250.59
200.170.151.200
202.28.24.105
203.174.34.49
208.113.213.71
213.186.33.18
213.186.33.19
217.76.132.246
217.160.0.152
217.160.0.225
217.160.0.237
217.160.0.240

608
esentire_14072015_com.ipset Normal file
View File

@ -0,0 +1,608 @@
#
# esentire_14072015_com
#
# ipv4 hash:ip ipset
#
# Malicious Botnet Serving Various Malware Families
#
# Maintainer : eSentire
# Maintainer URL : https://github.com/eSentire/malfeed
# List source URL : https://raw.githubusercontent.com/eSentire/malfeed/master/14072015.com_watch_ip.lst
# Source File Date: Wed Jun 6 11:52:14 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:50 UTC 2018
# Update Frequency: 1 day
# Aggregation : none
# Entries : 579 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=esentire_14072015_com
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.175.3.90
2.133.85.150
5.1.2.227
5.56.25.29
5.105.50.179
5.105.52.34
5.105.130.241
5.140.106.180
5.143.150.71
5.149.216.46
5.248.99.180
5.248.124.161
5.248.140.201
5.248.141.34
5.248.144.87
5.248.165.65
5.248.194.148
5.248.196.203
5.248.254.4
10.1.120.31
10.1.120.34
23.243.180.132
24.193.190.169
24.214.18.167
31.41.116.88
31.43.4.212
31.43.28.113
31.43.61.73
31.43.82.41
31.43.102.34
31.43.132.156
31.128.74.100
31.128.104.215
31.129.94.180
31.129.95.173
31.129.109.172
31.129.110.6
31.131.101.222
31.131.108.202
31.131.115.55
31.133.66.75
31.133.68.81
31.135.130.27
31.170.130.120
31.170.152.131
31.170.178.179
31.202.176.54
31.207.167.5
36.237.101.56
37.1.58.55
37.25.119.138
37.25.123.252
37.25.126.4
37.54.161.154
37.57.27.184
37.57.37.69
37.57.240.152
37.57.246.121
37.115.15.172
37.115.20.149
37.115.93.155
37.139.165.201
37.143.88.42
37.221.142.213
37.229.13.98
37.229.24.30
46.33.225.80
46.37.197.144
46.46.79.62
46.46.90.65
46.46.96.199
46.63.35.252
46.63.59.44
46.98.1.8
46.98.75.118
46.98.78.188
46.98.97.89
46.98.97.130
46.98.100.46
46.98.113.153
46.98.132.170
46.98.152.107
46.98.203.70
46.98.204.117
46.98.204.188
46.98.213.95
46.98.220.186
46.98.247.222
46.98.254.210
46.118.23.179
46.118.51.117
46.118.54.10
46.118.69.177
46.118.81.195
46.118.84.37
46.118.147.106
46.118.149.108
46.118.158.172
46.118.178.113
46.118.253.204
46.119.0.170
46.119.11.137
46.119.16.18
46.119.17.234
46.119.76.220
46.119.105.213
46.119.173.111
46.119.179.81
46.119.195.170
46.119.209.176
46.146.132.76
46.148.180.102
46.150.8.215
46.150.91.176
46.151.248.27
46.151.253.25
46.160.99.66
46.160.113.116
46.164.188.85
46.172.192.160
46.172.209.208
46.172.212.54
46.173.77.180
46.173.84.239
46.174.240.33
46.174.246.197
46.175.77.227
46.175.137.124
46.185.81.27
46.185.107.224
46.200.44.135
46.201.77.153
46.211.18.203
46.211.27.11
46.211.28.176
46.211.53.116
46.211.74.218
46.211.88.32
46.211.195.139
46.211.217.205
46.211.235.48
46.211.235.195
46.211.238.141
46.250.4.228
46.250.15.111
46.250.17.227
46.250.120.231
54.83.4.26
54.235.166.93
62.16.38.131
62.84.253.186
62.122.93.147
69.84.107.186
70.51.44.188
71.3.191.208
71.61.172.133
71.182.234.109
71.226.78.56
72.53.89.52
73.36.213.39
73.128.180.27
73.172.10.82
74.134.99.228
77.89.226.21
77.91.184.71
77.109.58.50
77.109.58.246
77.120.153.195
77.120.155.24
77.121.59.193
77.121.83.134
77.121.172.23
77.121.186.193
77.121.214.247
77.121.248.109
77.121.248.142
77.122.27.116
77.122.48.50
77.122.50.141
77.122.117.112
77.122.121.122
77.122.150.135
77.122.153.68
77.122.184.9
77.122.184.233
77.122.225.133
77.122.225.173
77.122.232.43
77.123.33.194
77.123.73.204
77.123.222.54
77.247.21.163
77.247.23.79
78.30.226.103
78.111.243.83
78.137.16.80
78.137.21.217
78.137.42.84
78.137.45.30
78.137.45.113
78.162.208.223
78.169.94.241
79.112.62.143
79.113.160.90
79.132.3.138
79.135.222.84
79.142.207.184
79.171.124.211
80.245.117.198
80.252.249.153
80.252.250.121
80.252.253.160
81.9.24.250
81.22.139.55
81.22.141.34
83.99.245.186
83.167.28.121
83.218.228.46
85.114.216.12
85.198.166.158
85.237.34.129
85.238.101.24
86.125.251.15
87.76.36.212
87.76.53.178
87.76.57.222
87.110.28.220
87.244.34.238
88.135.94.164
88.135.238.111
88.135.251.129
88.156.84.155
88.222.173.33
89.65.63.95
89.66.136.116
89.185.15.235
89.185.21.82
89.185.29.54
91.124.201.223
91.196.81.167
91.198.143.44
91.201.71.41
91.202.133.86
91.209.96.67
91.215.55.41
91.218.74.89
91.219.199.248
91.221.29.181
91.224.253.6
91.225.57.30
91.229.54.147
91.237.14.8
91.243.200.132
91.244.8.216
91.244.24.5
91.244.29.60
91.244.36.90
91.244.37.3
92.52.177.95
92.52.186.215
92.112.58.245
92.113.69.127
92.243.113.105
92.244.103.244
92.244.116.165
92.249.119.9
93.76.66.62
93.76.104.167
93.76.104.241
93.76.164.173
93.77.104.109
93.77.204.131
93.77.220.9
93.78.19.128
93.78.67.85
93.78.163.201
93.78.181.144
93.79.34.155
93.79.111.83
93.79.168.251
93.79.241.161
93.114.246.153
93.118.90.170
93.118.202.150
93.127.3.177
93.127.16.170
93.127.119.6
93.170.50.15
93.170.50.91
93.170.51.47
93.170.152.201
93.170.153.170
93.170.155.207
93.181.197.194
93.181.211.186
93.183.243.116
93.185.211.46
94.45.73.242
94.45.92.6
94.45.140.60
94.76.65.93
94.76.121.245
94.76.127.113
94.154.35.51
94.158.43.155
94.178.84.198
94.178.129.75
94.178.230.215
94.181.80.232
94.181.160.141
94.231.70.97
94.231.71.95
94.231.184.85
94.232.76.137
94.232.78.220
94.244.48.229
94.244.141.40
95.47.28.117
95.47.128.209
95.57.228.161
95.67.46.154
95.67.75.154
95.77.219.240
95.81.247.208
95.87.84.203
95.105.11.115
95.105.249.36
95.132.207.171
95.134.158.152
95.135.17.8
95.135.69.19
95.135.213.151
95.164.40.91
95.173.33.100
95.215.118.45
97.75.107.134
98.27.145.224
100.3.73.52
100.6.61.161
104.162.93.136
107.4.129.77
107.15.99.91
108.29.104.102
108.54.179.254
109.72.120.184
109.86.147.39
109.86.206.111
109.86.210.227
109.86.230.210
109.86.234.51
109.87.3.16
109.87.68.203
109.87.120.8
109.87.165.28
109.87.187.170
109.87.205.126
109.87.209.171
109.87.249.48
109.104.177.13
109.104.189.67
109.108.233.47
109.122.19.239
109.162.68.86
109.162.91.114
109.185.112.235
109.200.141.15
109.200.230.5
109.200.240.83
109.200.248.30
109.207.205.3
109.227.67.70
109.227.117.230
109.227.120.202
109.229.19.28
109.229.19.84
109.237.47.9
109.251.77.14
109.251.107.244
109.251.126.134
109.254.33.29
109.254.108.51
113.252.179.249
119.246.242.148
123.110.207.41
134.249.12.41
134.249.17.76
134.249.24.249
134.249.40.43
134.249.42.37
134.249.73.124
134.249.78.208
134.249.149.69
134.249.238.140
141.101.3.36
141.101.19.13
141.138.115.144
151.0.12.101
151.0.57.159
159.224.247.95
173.51.221.110
173.71.98.228
173.224.248.55
176.8.33.121
176.8.51.96
176.8.140.178
176.8.209.58
176.8.253.189
176.36.17.197
176.36.186.138
176.37.147.11
176.37.234.30
176.38.40.16
176.38.95.43
176.38.106.4
176.38.125.64
176.73.13.72
176.73.173.163
176.98.20.110
176.99.112.249
176.99.126.224
176.103.202.65
176.104.10.54
176.104.46.61
176.104.171.139
176.106.31.227
176.107.198.34
176.109.75.175
176.109.238.102
176.109.238.201
176.110.22.247
176.111.36.66
176.111.41.206
176.111.184.13
176.113.149.167
176.113.249.15
176.113.251.172
176.113.255.207
176.114.37.72
176.114.45.237
176.117.64.103
176.118.146.15
176.122.107.41
176.122.107.221
176.124.8.118
176.124.12.180
176.124.13.103
176.124.239.170
176.195.156.193
176.212.209.85
176.241.155.43
178.54.238.73
178.74.194.82
178.74.214.9
178.74.228.191
178.94.49.166
178.94.52.156
178.136.122.47
178.136.130.171
178.136.131.30
178.136.229.208
178.137.11.129
178.137.66.0
178.137.82.42
178.137.140.96
178.137.224.117
178.137.242.146
178.137.243.182
178.137.251.70
178.150.112.132
178.150.114.140
178.150.153.18
178.150.184.9
178.150.195.215
178.150.196.136
178.150.213.134
178.151.11.33
178.151.23.241
178.151.24.112
178.151.34.85
178.151.73.157
178.151.105.24
178.151.116.140
178.151.144.68
178.151.161.143
178.151.175.121
178.151.194.16
178.151.197.61
178.158.131.20
178.158.148.195
178.158.203.91
178.159.113.114
178.164.145.39
178.165.6.62
178.165.44.250
178.165.83.3
178.165.113.39
178.213.169.171
178.213.190.164
178.215.185.23
178.215.191.156
178.216.2.64
178.216.225.249
181.165.34.50
184.144.198.231
185.6.184.146
185.10.3.232
185.28.193.193
185.28.193.195
185.35.102.6
188.0.122.38
188.0.125.41
188.26.120.193
188.43.105.49
188.122.2.225
188.130.192.163
188.190.65.214
188.190.76.247
188.190.90.148
188.190.200.145
188.190.203.178
188.190.213.100
188.190.214.24
188.230.15.191
188.230.31.190
188.230.65.72
188.230.75.141
188.230.84.45
188.231.147.199
188.239.2.247
188.239.91.46
189.219.75.244
190.137.215.190
192.168.114.199
193.93.216.149
193.107.135.125
193.107.227.46
193.108.49.57
193.111.188.230
193.189.127.121
194.8.156.226
194.8.159.12
194.44.2.22
194.44.2.75
194.44.37.3
194.44.113.79
194.44.250.92
194.116.195.132
195.58.254.206
195.64.143.36
195.114.149.110
195.114.157.81
195.135.236.138
195.191.247.98
195.225.228.156
200.116.20.61
212.15.151.42
212.22.192.224
212.28.84.202
212.80.56.118
212.92.246.198
212.115.243.25
212.142.90.46
213.111.137.90
213.111.138.73
213.111.151.140
213.111.161.210
213.111.163.0
213.111.184.48
213.111.203.203
213.111.248.124
213.130.8.151
213.142.49.167
213.231.22.235
213.231.39.31
217.24.64.168
217.30.203.39
217.67.67.229
217.73.85.49
217.73.85.156

View File

@ -0,0 +1,604 @@
#
# esentire_14072015q_com
#
# ipv4 hash:ip ipset
#
# Malicious Botnet Serving Various Malware Families
#
# Maintainer : eSentire
# Maintainer URL : https://github.com/eSentire/malfeed
# List source URL : https://raw.githubusercontent.com/eSentire/malfeed/master/14072015q.com_watch_ip.lst
# Source File Date: Wed Jun 6 11:52:14 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:50 UTC 2018
# Update Frequency: 1 day
# Aggregation : none
# Entries : 575 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=esentire_14072015q_com
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.175.3.90
2.133.85.150
5.1.2.227
5.56.25.29
5.105.50.179
5.105.52.34
5.105.130.241
5.140.106.180
5.143.150.71
5.149.216.46
5.248.99.180
5.248.124.161
5.248.140.201
5.248.141.34
5.248.144.87
5.248.194.148
5.248.196.203
5.248.254.4
10.1.120.31
10.1.120.34
23.243.180.132
24.193.190.169
24.214.18.167
31.41.116.88
31.43.4.212
31.43.28.113
31.43.61.73
31.43.82.41
31.43.102.34
31.43.132.156
31.128.74.100
31.128.104.215
31.129.94.180
31.129.95.173
31.129.109.172
31.129.110.6
31.131.101.222
31.131.108.202
31.131.115.55
31.133.66.75
31.133.68.81
31.135.130.27
31.170.130.120
31.170.152.131
31.170.178.179
31.202.176.54
31.207.167.5
36.237.101.56
37.1.58.55
37.25.119.138
37.25.123.252
37.25.126.4
37.54.161.154
37.57.27.184
37.57.37.69
37.57.240.152
37.57.246.121
37.115.15.172
37.115.20.149
37.115.93.155
37.139.165.201
37.143.88.42
37.221.142.213
37.229.13.98
37.229.24.30
46.33.225.80
46.37.197.144
46.46.79.62
46.46.90.65
46.46.96.199
46.63.35.252
46.63.59.44
46.98.1.8
46.98.75.118
46.98.78.188
46.98.97.89
46.98.97.130
46.98.100.46
46.98.113.153
46.98.132.170
46.98.152.107
46.98.203.70
46.98.204.188
46.98.213.95
46.98.220.186
46.98.247.222
46.98.254.210
46.118.23.179
46.118.51.117
46.118.54.10
46.118.69.177
46.118.81.195
46.118.84.37
46.118.147.106
46.118.149.108
46.118.158.172
46.118.178.113
46.118.253.204
46.119.0.170
46.119.11.137
46.119.16.18
46.119.17.234
46.119.76.220
46.119.105.213
46.119.173.111
46.119.179.81
46.119.195.170
46.119.209.176
46.146.132.76
46.148.180.102
46.150.8.215
46.150.91.176
46.151.248.27
46.151.253.25
46.160.99.66
46.160.113.116
46.164.188.85
46.172.192.160
46.172.209.208
46.172.212.54
46.173.77.180
46.173.84.239
46.174.240.33
46.174.246.197
46.175.77.227
46.175.137.124
46.185.81.27
46.185.107.224
46.200.44.135
46.201.77.153
46.211.18.203
46.211.27.11
46.211.28.176
46.211.53.116
46.211.74.218
46.211.88.32
46.211.195.139
46.211.217.205
46.211.235.48
46.211.238.141
46.250.4.228
46.250.15.111
46.250.17.227
46.250.120.231
54.83.4.26
54.235.166.93
62.16.38.131
62.84.253.186
62.122.93.147
69.84.107.186
70.51.44.188
71.3.191.208
71.61.172.133
71.182.234.109
71.226.78.56
72.53.89.52
73.36.213.39
73.128.180.27
73.172.10.82
74.134.99.228
77.89.226.21
77.91.184.71
77.109.58.50
77.109.58.246
77.120.153.195
77.120.155.24
77.121.59.193
77.121.83.134
77.121.172.23
77.121.186.193
77.121.214.247
77.121.248.109
77.121.248.142
77.122.27.116
77.122.48.50
77.122.50.141
77.122.117.112
77.122.121.122
77.122.150.135
77.122.153.68
77.122.184.9
77.122.184.233
77.122.225.133
77.122.225.173
77.122.232.43
77.123.33.194
77.123.73.204
77.123.222.54
77.247.21.163
77.247.23.79
78.30.226.103
78.111.243.83
78.137.16.80
78.137.21.217
78.137.42.84
78.137.45.30
78.137.45.113
78.162.208.223
78.169.94.241
79.112.62.143
79.113.160.90
79.132.3.138
79.135.222.84
79.142.207.184
79.171.124.211
80.245.117.198
80.252.249.153
80.252.250.121
80.252.253.160
81.9.24.250
81.22.139.55
81.22.141.34
83.99.245.186
83.167.28.121
83.218.228.46
85.114.216.12
85.198.166.158
85.237.34.129
85.238.101.24
86.125.251.15
87.76.36.212
87.76.53.178
87.76.57.222
87.110.28.220
87.244.34.238
88.135.94.164
88.135.238.111
88.135.251.129
88.156.84.155
88.222.173.33
89.65.63.95
89.66.136.116
89.185.15.235
89.185.21.82
89.185.29.54
91.124.201.223
91.196.81.167
91.198.143.44
91.201.71.41
91.202.133.86
91.209.96.67
91.215.55.41
91.218.74.89
91.219.199.248
91.221.29.181
91.224.253.6
91.225.57.30
91.229.54.147
91.237.14.8
91.243.200.132
91.244.8.216
91.244.24.5
91.244.29.60
91.244.36.90
91.244.37.3
92.52.177.95
92.52.186.215
92.112.58.245
92.113.69.127
92.243.113.105
92.244.103.244
92.244.116.165
92.249.119.9
93.76.66.62
93.76.104.167
93.76.104.241
93.76.164.173
93.77.104.109
93.77.204.131
93.77.220.9
93.78.19.128
93.78.67.85
93.78.163.201
93.78.181.144
93.79.34.155
93.79.111.83
93.79.168.251
93.79.241.161
93.114.246.153
93.118.90.170
93.118.202.150
93.127.3.177
93.127.16.170
93.127.119.6
93.170.50.15
93.170.50.91
93.170.51.47
93.170.152.201
93.170.153.170
93.170.155.207
93.181.197.194
93.181.211.186
93.183.243.116
93.185.211.46
94.45.73.242
94.45.140.60
94.76.65.93
94.76.121.245
94.76.127.113
94.154.35.51
94.158.43.155
94.178.84.198
94.178.129.75
94.178.230.215
94.181.80.232
94.181.160.141
94.231.70.97
94.231.71.95
94.231.184.85
94.232.76.137
94.232.78.220
94.244.48.229
94.244.141.40
95.47.28.117
95.47.128.209
95.57.228.161
95.67.46.154
95.67.75.154
95.77.219.240
95.81.247.208
95.87.84.203
95.105.11.115
95.105.249.36
95.132.207.171
95.134.158.152
95.135.17.8
95.135.69.19
95.135.213.151
95.164.40.91
95.173.33.100
95.215.118.45
97.75.107.134
98.27.145.224
100.3.73.52
100.6.61.161
104.162.93.136
107.4.129.77
107.15.99.91
108.29.104.102
108.54.179.254
109.72.120.184
109.86.147.39
109.86.206.111
109.86.210.227
109.86.230.210
109.86.234.51
109.87.3.16
109.87.68.203
109.87.120.8
109.87.165.28
109.87.187.170
109.87.205.126
109.87.209.171
109.87.249.48
109.104.177.13
109.104.189.67
109.108.233.47
109.122.19.239
109.162.68.86
109.162.91.114
109.185.112.235
109.200.141.15
109.200.230.5
109.200.240.83
109.200.248.30
109.207.205.3
109.227.67.70
109.227.117.230
109.227.120.202
109.229.19.28
109.229.19.84
109.237.47.9
109.251.77.14
109.251.107.244
109.251.126.134
109.254.33.29
109.254.108.51
113.252.179.249
119.246.242.148
123.110.207.41
134.249.12.41
134.249.17.76
134.249.24.249
134.249.40.43
134.249.42.37
134.249.73.124
134.249.78.208
134.249.149.69
134.249.238.140
141.101.3.36
141.101.19.13
141.138.115.144
151.0.12.101
151.0.57.159
159.224.247.95
173.51.221.110
173.71.98.228
173.224.248.55
176.8.33.121
176.8.51.96
176.8.140.178
176.8.209.58
176.8.253.189
176.36.17.197
176.36.186.138
176.37.147.11
176.37.234.30
176.38.40.16
176.38.95.43
176.38.106.4
176.38.125.64
176.73.13.72
176.73.173.163
176.98.20.110
176.99.112.249
176.99.126.224
176.103.202.65
176.104.10.54
176.104.46.61
176.104.171.139
176.106.31.227
176.107.198.34
176.109.75.175
176.109.238.102
176.109.238.201
176.110.22.247
176.111.36.66
176.111.41.206
176.111.184.13
176.113.149.167
176.113.249.15
176.113.251.172
176.113.255.207
176.114.37.72
176.114.45.237
176.117.64.103
176.118.146.15
176.122.107.41
176.122.107.221
176.124.8.118
176.124.12.180
176.124.13.103
176.124.239.170
176.195.156.193
176.212.209.85
176.241.155.43
178.54.238.73
178.74.194.82
178.74.214.9
178.74.228.191
178.94.49.166
178.94.52.156
178.136.122.47
178.136.130.171
178.136.131.30
178.136.229.208
178.137.11.129
178.137.66.0
178.137.82.42
178.137.140.96
178.137.224.117
178.137.242.146
178.137.243.182
178.137.251.70
178.150.112.132
178.150.114.140
178.150.153.18
178.150.184.9
178.150.195.215
178.150.196.136
178.150.213.134
178.151.11.33
178.151.23.241
178.151.24.112
178.151.34.85
178.151.73.157
178.151.105.24
178.151.116.140
178.151.144.68
178.151.161.143
178.151.175.121
178.151.194.16
178.151.197.61
178.158.131.20
178.158.148.195
178.158.203.91
178.159.113.114
178.164.145.39
178.165.6.62
178.165.44.250
178.165.83.3
178.165.113.39
178.213.169.171
178.213.190.164
178.215.185.23
178.215.191.156
178.216.2.64
178.216.225.249
181.165.34.50
184.144.198.231
185.6.184.146
185.10.3.232
185.28.193.193
185.28.193.195
185.35.102.6
188.0.122.38
188.0.125.41
188.26.120.193
188.43.105.49
188.122.2.225
188.130.192.163
188.190.65.214
188.190.76.247
188.190.90.148
188.190.200.145
188.190.203.178
188.190.213.100
188.190.214.24
188.230.15.191
188.230.31.190
188.230.65.72
188.230.75.141
188.230.84.45
188.231.147.199
188.239.2.247
188.239.91.46
189.219.75.244
190.137.215.190
192.168.114.199
193.93.216.149
193.107.135.125
193.107.227.46
193.108.49.57
193.111.188.230
193.189.127.121
194.8.156.226
194.8.159.12
194.44.2.22
194.44.2.75
194.44.37.3
194.44.113.79
194.44.250.92
194.116.195.132
195.58.254.206
195.64.143.36
195.114.149.110
195.114.157.81
195.135.236.138
195.191.247.98
195.225.228.156
200.116.20.61
212.15.151.42
212.22.192.224
212.28.84.202
212.80.56.118
212.92.246.198
212.115.243.25
212.142.90.46
213.111.137.90
213.111.138.73
213.111.151.140
213.111.161.210
213.111.163.0
213.111.184.48
213.111.203.203
213.111.248.124
213.130.8.151
213.142.49.167
213.231.22.235
213.231.39.31
217.24.64.168
217.30.203.39
217.67.67.229
217.73.85.49
217.73.85.156

1319
esentire_22072014a_com.ipset Normal file

File diff suppressed because it is too large Load Diff

1317
esentire_22072014b_com.ipset Normal file

File diff suppressed because it is too large Load Diff

1318
esentire_22072014c_com.ipset Normal file

File diff suppressed because it is too large Load Diff

View File

@ -0,0 +1,36 @@
#
# esentire_atomictrivia_ru
#
# ipv4 hash:ip ipset
#
# Andromeda/Gamarue Checkin
#
# Maintainer : eSentire
# Maintainer URL : https://github.com/eSentire/malfeed
# List source URL : https://raw.githubusercontent.com/eSentire/malfeed/master/atomictrivia.ru_watch_ip.lst
# Source File Date: Wed Jun 6 11:52:13 UTC 2018
#
# Category : malware
# Version : 11
#
# This File Date : Thu Jun 7 00:08:51 UTC 2018
# Update Frequency: 1 day
# Aggregation : none
# Entries : 7 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=esentire_atomictrivia_ru
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
46.4.114.61
54.83.4.26
54.235.166.93
95.213.192.71
176.9.48.86
176.9.82.215
178.63.12.207

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

18642
esentire_crazyerror_su.ipset Normal file

File diff suppressed because it is too large Load Diff

View File

@ -0,0 +1,546 @@
#
# esentire_dagestanskiiviskis_ru
#
# ipv4 hash:ip ipset
#
# Ursnif Variant CnC
#
# Maintainer : eSentire
# Maintainer URL : https://github.com/eSentire/malfeed
# List source URL : https://raw.githubusercontent.com/eSentire/malfeed/master/dagestanskiiviskis.ru_watch_ip.lst
# Source File Date: Wed Jun 6 11:52:15 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:51 UTC 2018
# Update Frequency: 1 day
# Aggregation : none
# Entries : 517 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=esentire_dagestanskiiviskis_ru
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
2.62.23.234
5.2.216.120
5.12.168.83
5.14.69.38
5.14.172.95
5.79.191.198
5.105.98.241
5.105.130.241
5.136.100.50
5.143.140.236
5.143.166.83
5.153.129.193
5.164.66.183
5.164.207.221
5.165.232.191
5.167.9.135
5.189.221.99
5.199.233.176
5.228.106.212
5.248.51.11
5.248.58.154
5.248.106.201
5.248.124.161
5.248.126.218
5.248.175.139
5.248.186.248
5.248.198.111
5.248.235.69
5.248.242.211
5.255.161.252
14.42.158.45
24.70.124.49
24.96.222.4
24.136.95.254
31.6.123.150
31.6.125.172
31.8.144.14
31.8.161.217
31.8.175.111
31.23.21.219
31.41.116.88
31.42.125.15
31.43.75.153
31.44.11.217
31.47.122.245
31.47.167.142
31.128.44.20
31.128.74.100
31.128.104.215
31.129.95.173
31.131.101.222
31.131.137.63
31.133.77.119
31.134.21.170
31.134.69.230
31.135.38.197
31.135.48.147
31.135.114.203
31.135.133.237
31.135.136.176
31.162.8.8
31.170.130.120
31.170.152.131
31.202.223.141
31.207.178.78
31.207.228.197
31.207.229.67
37.1.128.96
37.19.78.212
37.21.23.21
37.25.109.92
37.25.114.125
37.25.116.19
37.25.117.182
37.46.249.235
37.54.230.239
37.57.28.153
37.57.37.69
37.57.240.187
37.113.204.90
37.115.24.106
37.115.90.157
37.115.134.56
37.115.171.164
37.115.231.247
37.194.118.106
37.221.142.213
37.229.43.110
37.229.247.52
37.229.249.54
37.235.161.13
46.0.18.88
46.0.105.75
46.33.240.159
46.33.251.145
46.35.240.81
46.37.197.134
46.43.224.57
46.48.147.97
46.50.179.195
46.63.1.192
46.63.6.16
46.98.18.231
46.98.37.161
46.98.73.53
46.98.86.240
46.98.105.164
46.98.117.134
46.98.202.20
46.98.202.163
46.98.219.38
46.118.29.25
46.118.84.22
46.118.130.60
46.118.155.53
46.118.239.72
46.118.252.166
46.119.35.231
46.119.89.198
46.119.94.122
46.119.155.141
46.119.173.111
46.146.3.235
46.147.179.93
46.148.182.219
46.148.183.5
46.150.91.176
46.162.36.98
46.164.164.200
46.164.170.15
46.164.189.238
46.172.207.21
46.172.232.202
46.172.238.213
46.172.252.79
46.173.74.179
46.175.77.186
46.175.98.254
46.181.215.20
46.185.9.53
46.185.18.158
46.185.51.76
46.185.73.44
46.185.94.136
46.185.119.82
46.211.60.80
46.237.30.185
50.83.33.15
50.161.246.210
61.244.34.238
62.80.161.74
62.84.253.186
62.84.255.35
62.244.60.154
67.161.171.204
73.143.88.158
73.182.13.78
73.209.189.206
74.139.176.131
77.52.183.30
77.75.135.92
77.78.210.179
77.91.184.71
77.93.62.84
77.120.25.214
77.120.159.89
77.120.170.83
77.121.47.43
77.121.58.49
77.121.114.54
77.121.161.66
77.122.125.49
77.122.152.5
77.122.154.230
77.122.189.45
77.122.226.163
77.122.235.183
77.232.214.172
77.239.190.247
78.27.183.113
78.29.101.224
78.96.153.47
78.97.195.40
79.114.76.25
79.116.111.187
79.117.27.88
79.119.76.40
79.119.81.24
79.119.192.205
79.142.200.140
79.171.124.211
80.240.40.174
80.243.155.25
80.252.252.7
80.252.252.171
80.252.255.128
81.9.24.250
81.22.135.82
81.163.46.209
81.163.54.83
81.163.93.101
82.76.65.108
82.77.43.35
82.79.21.91
82.209.117.176
83.234.253.227
84.53.214.22
84.117.156.67
84.232.210.248
85.237.35.122
86.100.133.94
86.121.248.49
86.124.111.205
86.125.184.115
86.125.231.223
88.85.206.166
88.135.121.221
88.203.3.130
88.233.78.205
89.32.218.56
89.42.87.41
89.121.205.190
89.185.10.36
89.252.7.39
89.252.8.138
89.252.41.9
91.104.21.62
91.190.235.194
91.198.143.44
91.204.250.227
91.211.175.7
91.218.89.197
91.219.251.28
91.221.179.42
91.225.161.106
91.225.161.207
91.237.14.19
91.241.227.106
91.243.218.240
91.244.12.138
91.246.7.211
92.52.165.90
92.52.181.125
92.52.188.52
92.113.29.192
92.113.143.87
92.248.135.141
92.248.136.100
92.248.216.12
92.248.242.249
92.249.212.75
93.76.72.58
93.76.104.226
93.76.164.173
93.76.181.42
93.76.205.64
93.77.115.10
93.77.204.131
93.77.221.41
93.78.54.197
93.78.96.225
93.78.217.148
93.79.24.199
93.79.65.222
93.79.168.251
93.79.199.156
93.79.200.105
93.88.57.78
93.113.90.28
93.113.176.105
93.118.209.118
93.119.139.39
93.119.155.220
93.124.44.131
93.127.89.112
93.170.153.170
93.171.21.27
93.171.253.155
93.183.246.105
94.28.137.173
94.45.92.6
94.45.140.60
94.76.65.93
94.76.127.113
94.125.51.117
94.179.47.27
94.181.97.145
94.240.165.141
94.243.14.31
94.244.141.40
94.253.13.174
95.67.46.154
95.67.75.154
95.79.217.131
95.105.249.36
95.106.203.206
95.106.214.42
95.110.24.171
95.139.66.62
95.139.212.72
95.139.253.60
95.190.15.238
95.190.16.138
95.215.209.73
96.50.181.81
98.116.11.226
100.6.61.161
104.162.93.136
107.15.99.91
108.7.231.42
108.183.203.14
109.63.193.84
109.86.76.58
109.86.143.188
109.86.230.210
109.86.234.51
109.87.131.54
109.87.148.237
109.87.165.28
109.87.204.143
109.87.249.48
109.104.189.67
109.105.78.238
109.120.5.115
109.161.41.46
109.162.118.190
109.184.213.234
109.196.71.193
109.200.230.148
109.200.232.184
109.201.76.89
109.201.198.206
109.227.200.151
109.236.217.151
109.251.77.14
109.251.148.252
109.254.58.99
109.254.108.51
109.254.116.68
113.252.180.74
119.247.219.135
123.202.249.155
130.204.240.145
134.249.30.72
134.249.31.13
134.249.81.148
136.169.169.63
136.169.169.197
145.249.167.167
146.120.25.65
151.0.61.118
151.249.101.99
159.224.62.162
159.224.101.52
159.224.140.219
159.224.253.208
176.36.23.31
176.36.68.13
176.36.174.59
176.36.202.68
176.37.109.5
176.37.122.224
176.37.172.33
176.49.142.86
176.77.24.129
176.77.111.200
176.98.2.232
176.99.106.204
176.99.176.112
176.101.193.179
176.101.207.64
176.102.211.159
176.103.205.207
176.104.41.120
176.104.102.59
176.104.185.139
176.105.131.208
176.106.31.227
176.113.246.139
176.113.251.1
176.114.44.50
176.116.221.106
176.116.221.246
176.116.222.84
176.117.72.184
176.118.113.253
176.124.13.36
176.195.253.219
176.210.68.73
176.212.97.227
176.212.185.229
176.213.67.155
176.213.75.210
176.213.239.205
176.213.253.173
176.226.147.109
178.34.19.159
178.35.161.136
178.45.197.114
178.46.96.169
178.54.167.147
178.54.182.27
178.74.203.125
178.93.163.70
178.136.222.214
178.136.241.135
178.137.11.129
178.137.61.90
178.137.80.252
178.137.82.42
178.137.115.109
178.137.156.59
178.137.158.86
178.137.186.180
178.137.213.13
178.137.224.117
178.150.172.207
178.150.213.134
178.151.11.33
178.151.73.157
178.151.114.33
178.151.139.25
178.151.144.68
178.151.241.177
178.158.148.195
178.158.201.252
178.158.228.24
178.159.113.246
178.165.36.80
178.165.98.17
178.165.106.161
178.165.107.138
178.206.127.150
178.207.168.102
178.211.185.203
178.217.163.77
178.219.253.37
178.234.243.161
178.234.247.85
181.45.0.138
185.17.17.111
185.22.17.85
185.27.103.79
185.86.3.171
187.240.23.29
188.0.122.38
188.0.125.41
188.18.80.50
188.24.15.92
188.24.182.130
188.25.68.106
188.25.185.202
188.27.58.58
188.27.224.223
188.27.236.220
188.75.198.19
188.75.240.44
188.75.243.36
188.123.45.117
188.168.146.203
188.190.66.19
188.190.67.242
188.190.195.238
188.191.235.161
188.191.238.171
188.191.239.79
188.209.109.154
188.212.158.206
188.230.84.45
188.231.147.199
188.231.244.193
188.234.116.93
188.234.119.59
188.239.6.96
188.239.21.192
188.240.0.34
188.241.106.118
188.241.131.14
188.242.4.131
188.255.93.37
190.19.48.93
190.190.179.2
192.162.232.198
192.166.113.83
193.111.188.230
193.242.156.56
193.254.233.26
195.18.43.216
195.160.220.110
197.7.101.165
197.9.198.102
204.195.156.186
212.2.142.108
212.3.107.202
212.21.7.79
212.22.192.224
212.34.126.162
212.91.214.42
212.92.225.115
212.92.240.222
212.92.254.38
212.115.239.200
212.115.250.13
213.111.140.203
213.111.155.155
213.111.167.62
213.111.168.163
213.111.232.28
213.111.251.240
213.154.205.150
213.231.10.126
213.231.15.11
213.231.28.245
213.231.61.231
217.73.81.60
217.73.85.49
217.73.93.154

View File

@ -0,0 +1,41 @@
#
# esentire_differentia_ru
#
# ipv4 hash:ip ipset
#
# Malicious Botnet Serving Various Malware Families
#
# Maintainer : eSentire
# Maintainer URL : https://github.com/eSentire/malfeed
# List source URL : https://raw.githubusercontent.com/eSentire/malfeed/master/differentia.ru_watch_ip.lst
# Source File Date: Wed Jun 6 11:52:10 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:49 UTC 2018
# Update Frequency: 1 day
# Aggregation : none
# Entries : 12 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=esentire_differentia_ru
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
46.4.114.61
54.83.4.26
54.235.166.93
95.213.186.51
95.213.192.71
109.70.26.37
109.206.186.164
176.9.48.86
176.9.82.215
176.9.174.220
178.63.12.207
194.85.61.76

View File

@ -0,0 +1,36 @@
#
# esentire_disorderstatus_ru
#
# ipv4 hash:ip ipset
#
# Malicious Botnet Serving Various Malware Families
#
# Maintainer : eSentire
# Maintainer URL : https://github.com/eSentire/malfeed
# List source URL : https://raw.githubusercontent.com/eSentire/malfeed/master/disorderstatus.ru_watch_ip.lst
# Source File Date: Wed Jun 6 11:52:13 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:50 UTC 2018
# Update Frequency: 1 day
# Aggregation : none
# Entries : 7 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=esentire_disorderstatus_ru
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
46.4.114.61
54.83.4.26
54.235.166.93
95.213.192.71
109.206.186.164
176.9.48.86
176.9.82.215

Some files were not shown because too many files have changed in this diff Show More