Robot
/
blocklist-ipsets
mirror of https://github.com/firehol/blocklist-ipsets.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Wed Mar 17 11:29:33 UTC 2021 update

This commit is contained in:
Costa Tsaousis 2021-03-14 06:30:15 +00:00
commit e963b1b9b2
1466 changed files with 8222425 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

106
.gitignore vendored Normal file
View File

@ -0,0 +1,106 @@
bogons.netset
.cache
.cache.old
dragon_http.netset
dragon_*.ipset
dragon_*.netset
dragon_sshpauth.netset
dragon_vncprobe.netset
dronebl_anonymizers.netset
dronebl_auto_botnets.netset
dronebl_autorooting_worms.netset
dronebl_compromised.netset
dronebl_ddos_drones.netset
dronebl_dns_mx_on_irc.netset
dronebl_*.ipset
dronebl_irc_drones.netset
dronebl_*.netset
dronebl_unknown.netset
dronebl_worms_bots.netset
errors/
fullbogons.netset
history/
ib_*.ipset
iblocklist_ads.netset
iblocklist_ads.*set
iblocklist_badpeers.ipset
iblocklist_badpeers.*set
iblocklist_bogons.netset
iblocklist_bogons.*set
iblocklist_dshield.netset
iblocklist_dshield.*set
iblocklist_edu.netset
iblocklist_edu.*set
iblocklist_exclusions.netset
iblocklist_exclusions.*set
iblocklist_fornonlancomputers.netset
iblocklist_fornonlancomputers.*set
iblocklist_forumspam.netset
iblocklist_forumspam.*set
iblocklist_hijacked.netset
iblocklist_hijacked.*set
iblocklist_iana_multicast.netset
iblocklist_iana_multicast.*set
iblocklist_iana_private.netset
iblocklist_iana_private.*set
iblocklist_iana_reserved.netset
iblocklist_iana_reserved.*set
iblocklist_level1.netset
iblocklist_level1.*set
iblocklist_level2.netset
iblocklist_level2.*set
iblocklist_level3.netset
iblocklist_level3.*set
iblocklist_org_microsoft.netset
iblocklist_org_microsoft.*set
iblocklist_proxies.ipset
iblocklist_proxies.*set
iblocklist_rangetest.netset
iblocklist_rangetest.*set
iblocklist_spider.netset
iblocklist_spider.*set
iblocklist_spyware.netset
iblocklist_spyware.*set
iblocklist_webexploit.ipset
iblocklist_webexploit.*set
ib_*.netset
iprange*
ipv4_range_to_cidr.awk
*.lastchecked
*.setinfo
sorbs_anonymizers.netset
sorbs_dul.netset
sorbs_escalations.netset
sorbs_*.ipset
sorbs_*.netset
sorbs_new_spam.netset
sorbs_noserver.netset
sorbs_recent_spam.netset
sorbs_smtp.netset
sorbs_web.netset
sorbs_zombie.netset
*.source
*.tmp
update-ipsets*
.warn_if_last_downloaded_before_this
blueliv*.ipset
blueliv*.netset
blueliv_crimeserver_online.ipset
blueliv_crimeserver_recent.ipset
blueliv_crimeserver_last.ipset
blueliv_crimeserver_last_1d.ipset
blueliv_crimeserver_last_2d.ipset
blueliv_crimeserver_last_7d.ipset
blueliv_crimeserver_last_30d.ipset
iblocklist_badpeers.netset
dataplane_sipquery.ipset
dataplane_sshpwauth.ipset
dataplane_sshclient.ipset
dataplane_sipregistration.ipset
dataplane_sipinvitation.ipset
dataplane_vncrfb.ipset
dataplane_dnsrd.ipset
dataplane_dnsrdany.ipset
dataplane_dnsversion.ipset
shunlist.ipset
ip2proxy_px1lite.netset

228
README-EDIT.md Normal file
View File

@ -0,0 +1,228 @@
> Due to the amount of data and the frequency of the updates on this repo,
> github has requested to limit the number of updates.
> The site [https://iplists.firehol.org](https://iplists.firehol.org) has direct links
> to all the files in this repo. **This repo is now updated once per day.**
---
### Contents
- [About this repo](#about-this-repo)
- [Using these ipsets](#using-these-ipsets)
- [Which ones to use?](#which-ones-to-use)
- [Why are open proxy lists included](#why-are-open-proxy-lists-included)
- [Using them in FireHOL](#using-them-in-firehol)
* [Adding the ipsets in your firehol.conf](#adding-the-ipsets-in-your-fireholconf)
* [Updating the ipsets while the firewall is running](#updating-the-ipsets-while-the-firewall-is-running)
- [Dynamic List of ipsets included](#list-of-ipsets-included)
- [Comparison of ipsets](#comparison-of-ipsets)
---
# About this repo
This repository includes a list of ipsets dynamically updated with
[FireHOL](https://github.com/firehol/firehol)'s `update-ipsets.sh`
[documented in this wiki](https://github.com/firehol/blocklist-ipsets/wiki).
This repo is self maintained. It it updated automatically from the script via a cron job.
This repo has a site: [http://iplists.firehol.org](http://iplists.firehol.org).
## Why do we need blocklists?
As time passes and the internet matures in our life, cybercrime is becoming increasingly sophisticated.
Although there are many tools (detection of malware, viruses, intrusion detection and prevention systems,
etc) to help us isolate the bad guys, there are now a lot more than just such attacks.
What is more interesting is that the fraudsters or attackers in many cases are not going to do a direct
damage to you or your systems. They will use you and your systems to gain something else, possibly not
related or indirectly related to your business. Nowadays the attacks cannot be identified easily. They are
distributed and come to our systems from a vast amount of IPs around the world.
To get an idea, check for example the [XRumer](http://en.wikipedia.org/wiki/XRumer) software. This thing
mimics human behavior to post ads, it creates email accounts, responds to emails it receives, bypasses
captchas, it goes gently to stay unnoticed, etc.
To increase our effectiveness we need to complement our security solutions with our shared knowledge, our
shared experience in this fight.
Hopefully, there are many teams out there that do their best to identify the attacks and pinpoint the
attackers. These teams release blocklists. Blocklists of IPs (for use in firewalls), domains & URLs
(for use in proxies), etc.
What we are interested here is IPs.
Using IP blocklists at the internet side of your firewall is a key component of internet security. These
lists share key knowledge between us, allowing us to learn from each other and effectively isolate
fraudsters and attackers from our services.
I decided to upload these lists to a github repo because:
1. They are freely available on the internet. The intention of their creators is to help internet security.
Keep in mind though that a few of these lists may have special licences attached. Before using them, please check their source site for any information regarding proper use.
2. Github provides (via `git pull`) a unified way of updating all the lists together.
Pulling this repo regularly on your machines, you will update all the IP lists at once.
3. Github also provides a unified version control. Using it we can have a history of what each list has
done, which IPs or subnets were added and which were removed.
## DNSBLs
Check also another tool included in FireHOL v3+, called `dnsbl-ipset.sh`.
This tool is capable of creating an ipset based on your traffic by looking up information on DNSBLs and
scoring it according to your preferences.
More information [here](https://github.com/firehol/firehol/wiki/dnsbl-ipset.sh).
---
# Using these ipsets
Please be very careful what you choose to use and how you use it. If you blacklist traffic using these
lists you may end up blocking your users, your customers, even yourself (!) from accessing your services.
1. Go to to the site of each list and read how each list is maintained. You are going to trust these guys for doing their job right.
2. Most sites have either a donation system or commercial lists of higher quality. Try to support them.
3. I have included the TOR network in these lists (`bm_tor`, `dm_tor`, `et_tor`). The TOR network is not necessarily bad and you should not block it if you want to allow your users be anonymous. I have included it because for certain cases, allowing an anonymity network might be a risky thing (such as eCommerce).
4. Apply any blacklist at the internet side of your firewall. Be very careful. The `bogons` and `fullbogons` lists contain private, unrouteable IPs that should not be routed on the internet. If you apply such a blocklist on your DMZ or LAN side, you will be blocked out of your firewall.
5. Always have a whitelist too, containing the IP addresses or subnets you trust. Try to build the rules in such a way that if an IP is in the whitelist, it should not be blocked by these blocklists.
## Which ones to use
### Level 1 - Basic
These are the ones I trust. **Level 1** provides basic security against the most well-known attackers, with the minimum of false positives.
1. **Abuse.ch** lists `feodo`, `palevo`, `sslbl`, `zeus`, `zeus_badips`
These folks are doing a great job tracking crime ware. Their blocklists are very focused.
Keep in mind `zeus` may include some false positives. You can use `zeus_badips` instead.
2. **DShield.org** list `dshield`
It contains the top 20 attacking class C (/24) subnets, over the last three days.
3. **Spamhaus.org** lists `spamhaus_drop`, `spamhaus_edrop`
DROP (Don't Route Or Peer) and EDROP are advisory "drop all traffic" lists, consisting of netblocks that are "hijacked" or leased by professional spam or cyber-crime operations (used for dissemination of malware, trojan downloaders, botnet controllers).
According to Spamhaus.org:
> When implemented at a network or ISP's 'core routers', DROP and EDROP will help protect the network's users from spamming, scanning, harvesting, DNS-hijacking and DDoS attacks originating on rogue netblocks.
>
> Spamhaus strongly encourages the use of DROP and EDROP by tier-1s and backbones.
Spamhaus is very responsive to adapt these lists when a network owner updates them that the issue has been solved (I had one such incident with one of my users).
4. **Team-Cymru.org** list `bogons` or `fullbogons`
These are lists of IPs that should not be routed on the internet. No one should be using them.
Be very careful to apply either of the two on the internet side of your network.
### Level 2 - Essentials
**Level 2** provide protection against current brute force attacks. This level may have a small percentage of false positives, mainly due to dynamic IPs being re-used by other users.
1. **OpenBL.org** lists `openbl*`
The team of OpenBL tracks brute force attacks on their hosts. They have a very short list for hosts, under their own control, collecting this information, to eliminate false positives.
They suggest to use the default blacklist which has a retention policy of 90 days (`openbl`), but they also provide lists with different retention policies (from 1 day to 1 year).
Their goal is to report abuse to the responsible provider so that the infection is disabled.
2. **Blocklist.de** lists `blocklist_de*`
Is a network of users reporting abuse mainly using `fail2ban`. They eliminate false positives using other lists available. Since they collect information from their users, their lists may be subject to poisoning, or false positives.
I asked them about poisoning. [Here](https://forum.blocklist.de/viewtopic.php?f=4&t=244&sid=847d00d26b0735add3518ff515242cad) you can find their answer. In short, they track it down so that they have an ignorable rate of false positives.
Also, they only include individual IPs (no subnets) which have attacked their users the last 48 hours and their list contains 20.000 to 40.000 IPs (which is small enough considering the size of the internet).
Like `openbl`, their goal is to report abuse back, so that the infection is disabled.
They also provide their blocklist per type of attack (mail, web, etc).
Of course, there are more lists included. You can check them and decide if they fit for your needs.
## Why are open proxy lists included
Of course, I haven't included them for you to use the open proxies. The port the proxy is listening, or the type of proxy, are not included (although most of them use the standard proxy ports and do serve web requests).
If you check the comparisons for the open proxy lists (`ri_connect_proxies`, `ri_web_proxies`, `xroxy`, `proxz`, `proxyrss`, etc)
you will find that they overlap to a great degree with other blocklists, like `blocklist_de`, `stopforumspam`, etc.
> This means the attackers also use open proxies to execute attacks.
So, if you are under attack, blocking the open proxies may help isolate a large part of the attack.
I don't suggest to permanently block IPs using the proxy lists. Their purpose of existence is questionable.
Their quality though may be acceptable, since lot of these sites advertise that they test open proxies before including them in their lists, so that there are no false positives, at least at the time they tested them.
---
## Using them in FireHOL
`update-ipsets.sh` itself does not alter your firewall. It can be used to update ipsets both on disk and in the kernel for any firewall solution you use.
The information below, shows you how to configure FireHOL to use the provides ipsets.
### Adding the ipsets in your firehol.conf
I use something like this:
```sh
# our wan interface
wan="dsl0"
# our whitelist
ipset4 create whitelist hash:net
ipset4 add whitelist A.B.C.D/E # A.B.C.D/E is whitelisted
# subnets - netsets
for x in fullbogons dshield spamhaus_drop spamhaus_edrop
do
ipset4 create ${x} hash:net
ipset4 addfile ${x} ipsets/${x}.netset
blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} \
except src ipset:whitelist
done
# individual IPs - ipsets
for x in feodo palevo sslbl zeus openbl blocklist_de
do
ipset4 create ${x} hash:ip
ipset4 addfile ${x} ipsets/${x}.ipset
blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} \
except src ipset:whitelist
done
... rest of firehol.conf ...
```
If you are concerned about iptables performance, change the `blacklist4` keyword `full` to `input`.
This will block only inbound NEW connections, i.e. only the first packet for every NEW inbound connection will be checked.
All other traffic passes through unchecked.
> Before adding these rules to your `firehol.conf` you should run `update-ipsets.sh` to enable them.
### Updating the ipsets while the firewall is running
Just use the `update-ipsets.sh` script from the firehol distribution.
This script will update each ipset and call firehol to update the ipset while the firewall is running.
> You can add `update-ipsets.sh` to cron, to run every 10 mins. `update-ipsets.sh` is smart enough to download
> a list only when it needs to.
---
# List of ipsets included

736
README.md Normal file
View File

@ -0,0 +1,736 @@
> Due to the amount of data and the frequency of the updates on this repo,
> github has requested to limit the number of updates.
> The site [https://iplists.firehol.org](https://iplists.firehol.org) has direct links
> to all the files in this repo. **This repo is now updated once per day.**
---
### Contents
- [About this repo](#about-this-repo)
- [Using these ipsets](#using-these-ipsets)
- [Which ones to use?](#which-ones-to-use)
- [Why are open proxy lists included](#why-are-open-proxy-lists-included)
- [Using them in FireHOL](#using-them-in-firehol)
* [Adding the ipsets in your firehol.conf](#adding-the-ipsets-in-your-fireholconf)
* [Updating the ipsets while the firewall is running](#updating-the-ipsets-while-the-firewall-is-running)
- [Dynamic List of ipsets included](#list-of-ipsets-included)
- [Comparison of ipsets](#comparison-of-ipsets)
---
# About this repo
This repository includes a list of ipsets dynamically updated with
[FireHOL](https://github.com/firehol/firehol)'s `update-ipsets.sh`
[documented in this wiki](https://github.com/firehol/blocklist-ipsets/wiki).
This repo is self maintained. It it updated automatically from the script via a cron job.
This repo has a site: [http://iplists.firehol.org](http://iplists.firehol.org).
## Why do we need blocklists?
As time passes and the internet matures in our life, cybercrime is becoming increasingly sophisticated.
Although there are many tools (detection of malware, viruses, intrusion detection and prevention systems,
etc) to help us isolate the bad guys, there are now a lot more than just such attacks.
What is more interesting is that the fraudsters or attackers in many cases are not going to do a direct
damage to you or your systems. They will use you and your systems to gain something else, possibly not
related or indirectly related to your business. Nowadays the attacks cannot be identified easily. They are
distributed and come to our systems from a vast amount of IPs around the world.
To get an idea, check for example the [XRumer](http://en.wikipedia.org/wiki/XRumer) software. This thing
mimics human behavior to post ads, it creates email accounts, responds to emails it receives, bypasses
captchas, it goes gently to stay unnoticed, etc.
To increase our effectiveness we need to complement our security solutions with our shared knowledge, our
shared experience in this fight.
Hopefully, there are many teams out there that do their best to identify the attacks and pinpoint the
attackers. These teams release blocklists. Blocklists of IPs (for use in firewalls), domains & URLs
(for use in proxies), etc.
What we are interested here is IPs.
Using IP blocklists at the internet side of your firewall is a key component of internet security. These
lists share key knowledge between us, allowing us to learn from each other and effectively isolate
fraudsters and attackers from our services.
I decided to upload these lists to a github repo because:
1. They are freely available on the internet. The intention of their creators is to help internet security.
Keep in mind though that a few of these lists may have special licences attached. Before using them, please check their source site for any information regarding proper use.
2. Github provides (via `git pull`) a unified way of updating all the lists together.
Pulling this repo regularly on your machines, you will update all the IP lists at once.
3. Github also provides a unified version control. Using it we can have a history of what each list has
done, which IPs or subnets were added and which were removed.
## DNSBLs
Check also another tool included in FireHOL v3+, called `dnsbl-ipset.sh`.
This tool is capable of creating an ipset based on your traffic by looking up information on DNSBLs and
scoring it according to your preferences.
More information [here](https://github.com/firehol/firehol/wiki/dnsbl-ipset.sh).
---
# Using these ipsets
Please be very careful what you choose to use and how you use it. If you blacklist traffic using these
lists you may end up blocking your users, your customers, even yourself (!) from accessing your services.
1. Go to to the site of each list and read how each list is maintained. You are going to trust these guys for doing their job right.
2. Most sites have either a donation system or commercial lists of higher quality. Try to support them.
3. I have included the TOR network in these lists (`bm_tor`, `dm_tor`, `et_tor`). The TOR network is not necessarily bad and you should not block it if you want to allow your users be anonymous. I have included it because for certain cases, allowing an anonymity network might be a risky thing (such as eCommerce).
4. Apply any blacklist at the internet side of your firewall. Be very careful. The `bogons` and `fullbogons` lists contain private, unrouteable IPs that should not be routed on the internet. If you apply such a blocklist on your DMZ or LAN side, you will be blocked out of your firewall.
5. Always have a whitelist too, containing the IP addresses or subnets you trust. Try to build the rules in such a way that if an IP is in the whitelist, it should not be blocked by these blocklists.
## Which ones to use
### Level 1 - Basic
These are the ones I trust. **Level 1** provides basic security against the most well-known attackers, with the minimum of false positives.
1. **Abuse.ch** lists `feodo`, `palevo`, `sslbl`, `zeus`, `zeus_badips`
These folks are doing a great job tracking crime ware. Their blocklists are very focused.
Keep in mind `zeus` may include some false positives. You can use `zeus_badips` instead.
2. **DShield.org** list `dshield`
It contains the top 20 attacking class C (/24) subnets, over the last three days.
3. **Spamhaus.org** lists `spamhaus_drop`, `spamhaus_edrop`
DROP (Don't Route Or Peer) and EDROP are advisory "drop all traffic" lists, consisting of netblocks that are "hijacked" or leased by professional spam or cyber-crime operations (used for dissemination of malware, trojan downloaders, botnet controllers).
According to Spamhaus.org:
> When implemented at a network or ISP's 'core routers', DROP and EDROP will help protect the network's users from spamming, scanning, harvesting, DNS-hijacking and DDoS attacks originating on rogue netblocks.
>
> Spamhaus strongly encourages the use of DROP and EDROP by tier-1s and backbones.
Spamhaus is very responsive to adapt these lists when a network owner updates them that the issue has been solved (I had one such incident with one of my users).
4. **Team-Cymru.org** list `bogons` or `fullbogons`
These are lists of IPs that should not be routed on the internet. No one should be using them.
Be very careful to apply either of the two on the internet side of your network.
### Level 2 - Essentials
**Level 2** provide protection against current brute force attacks. This level may have a small percentage of false positives, mainly due to dynamic IPs being re-used by other users.
1. **OpenBL.org** lists `openbl*`
The team of OpenBL tracks brute force attacks on their hosts. They have a very short list for hosts, under their own control, collecting this information, to eliminate false positives.
They suggest to use the default blacklist which has a retention policy of 90 days (`openbl`), but they also provide lists with different retention policies (from 1 day to 1 year).
Their goal is to report abuse to the responsible provider so that the infection is disabled.
2. **Blocklist.de** lists `blocklist_de*`
Is a network of users reporting abuse mainly using `fail2ban`. They eliminate false positives using other lists available. Since they collect information from their users, their lists may be subject to poisoning, or false positives.
I asked them about poisoning. [Here](https://forum.blocklist.de/viewtopic.php?f=4&t=244&sid=847d00d26b0735add3518ff515242cad) you can find their answer. In short, they track it down so that they have an ignorable rate of false positives.
Also, they only include individual IPs (no subnets) which have attacked their users the last 48 hours and their list contains 20.000 to 40.000 IPs (which is small enough considering the size of the internet).
Like `openbl`, their goal is to report abuse back, so that the infection is disabled.
They also provide their blocklist per type of attack (mail, web, etc).
Of course, there are more lists included. You can check them and decide if they fit for your needs.
## Why are open proxy lists included
Of course, I haven't included them for you to use the open proxies. The port the proxy is listening, or the type of proxy, are not included (although most of them use the standard proxy ports and do serve web requests).
If you check the comparisons for the open proxy lists (`ri_connect_proxies`, `ri_web_proxies`, `xroxy`, `proxz`, `proxyrss`, etc)
you will find that they overlap to a great degree with other blocklists, like `blocklist_de`, `stopforumspam`, etc.
> This means the attackers also use open proxies to execute attacks.
So, if you are under attack, blocking the open proxies may help isolate a large part of the attack.
I don't suggest to permanently block IPs using the proxy lists. Their purpose of existence is questionable.
Their quality though may be acceptable, since lot of these sites advertise that they test open proxies before including them in their lists, so that there are no false positives, at least at the time they tested them.
---
## Using them in FireHOL
`update-ipsets.sh` itself does not alter your firewall. It can be used to update ipsets both on disk and in the kernel for any firewall solution you use.
The information below, shows you how to configure FireHOL to use the provides ipsets.
### Adding the ipsets in your firehol.conf
I use something like this:
```sh
# our wan interface
wan="dsl0"
# our whitelist
ipset4 create whitelist hash:net
ipset4 add whitelist A.B.C.D/E # A.B.C.D/E is whitelisted
# subnets - netsets
for x in fullbogons dshield spamhaus_drop spamhaus_edrop
do
ipset4 create ${x} hash:net
ipset4 addfile ${x} ipsets/${x}.netset
blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} \
except src ipset:whitelist
done
# individual IPs - ipsets
for x in feodo palevo sslbl zeus openbl blocklist_de
do
ipset4 create ${x} hash:ip
ipset4 addfile ${x} ipsets/${x}.ipset
blacklist4 full inface "${wan}" log "BLACKLIST ${x^^}" ipset:${x} \
except src ipset:whitelist
done
... rest of firehol.conf ...
```
If you are concerned about iptables performance, change the `blacklist4` keyword `full` to `input`.
This will block only inbound NEW connections, i.e. only the first packet for every NEW inbound connection will be checked.
All other traffic passes through unchecked.
> Before adding these rules to your `firehol.conf` you should run `update-ipsets.sh` to enable them.
### Updating the ipsets while the firewall is running
Just use the `update-ipsets.sh` script from the firehol distribution.
This script will update each ipset and call firehol to update the ipset while the firewall is running.
> You can add `update-ipsets.sh` to cron, to run every 10 mins. `update-ipsets.sh` is smart enough to download
> a list only when it needs to.
---
# List of ipsets included
The following list was automatically generated on Wed Mar 17 11:29:33 UTC 2021.
The update frequency is the maximum allowed by internal configuration. A list will never be downloaded sooner than the update frequency stated. A list may also not be downloaded, after this frequency expired, if it has not been modified on the server (as reported by HTTP `IF_MODIFIED_SINCE` method).
name|info|type|entries|update|
:--:|:--:|:--:|:-----:|:----:|
[alienvault_reputation](http://iplists.firehol.org/?ipset=alienvault_reputation)|[AlienVault.com](https://www.alienvault.com/) IP reputation database|ipv4 hash:ip|1582 unique IPs|updated every 6 hours from [this link](https://reputation.alienvault.com/reputation.generic)
[asprox_c2](http://iplists.firehol.org/?ipset=asprox_c2)|[h3x.eu](http://atrack.h3x.eu/) ASPROX Tracker - Asprox C&C Sites|ipv4 hash:ip|0 unique IPs|updated every 1 day from [this link](http://atrack.h3x.eu/c2)
[bambenek_banjori](http://iplists.firehol.org/?ipset=bambenek_banjori)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of banjori C&Cs with 90 minute lookback|ipv4 hash:ip|136 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/banjori-iplist.txt)
[bambenek_bebloh](http://iplists.firehol.org/?ipset=bambenek_bebloh)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of bebloh C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/bebloh-iplist.txt)
[bambenek_c2](http://iplists.firehol.org/?ipset=bambenek_c2)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) master feed of known, active and non-sinkholed C&Cs IP addresses|ipv4 hash:ip|486 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/c2-ipmasterlist.txt)
[bambenek_cl](http://iplists.firehol.org/?ipset=bambenek_cl)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of cl C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/cl-iplist.txt)
[bambenek_cryptowall](http://iplists.firehol.org/?ipset=bambenek_cryptowall)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of cryptowall C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/cryptowall-iplist.txt)
[bambenek_dircrypt](http://iplists.firehol.org/?ipset=bambenek_dircrypt)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of dircrypt C&Cs with 90 minute lookback|ipv4 hash:ip|2 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/dircrypt-iplist.txt)
[bambenek_dyre](http://iplists.firehol.org/?ipset=bambenek_dyre)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of dyre C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/dyre-iplist.txt)
[bambenek_geodo](http://iplists.firehol.org/?ipset=bambenek_geodo)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of geodo C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/geodo-iplist.txt)
[bambenek_hesperbot](http://iplists.firehol.org/?ipset=bambenek_hesperbot)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of hesperbot C&Cs with 90 minute lookback|ipv4 hash:ip|2 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/hesperbot-iplist.txt)
[bambenek_matsnu](http://iplists.firehol.org/?ipset=bambenek_matsnu)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of matsnu C&Cs with 90 minute lookback|ipv4 hash:ip|1 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/matsnu-iplist.txt)
[bambenek_necurs](http://iplists.firehol.org/?ipset=bambenek_necurs)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of necurs C&Cs with 90 minute lookback|ipv4 hash:ip|13 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/necurs-iplist.txt)
[bambenek_p2pgoz](http://iplists.firehol.org/?ipset=bambenek_p2pgoz)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of p2pgoz C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/p2pgoz-iplist.txt)
[bambenek_pushdo](http://iplists.firehol.org/?ipset=bambenek_pushdo)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of pushdo C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/pushdo-iplist.txt)
[bambenek_pykspa](http://iplists.firehol.org/?ipset=bambenek_pykspa)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of pykspa C&Cs with 90 minute lookback|ipv4 hash:ip|5 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/pykspa-iplist.txt)
[bambenek_qakbot](http://iplists.firehol.org/?ipset=bambenek_qakbot)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of qakbot C&Cs with 90 minute lookback|ipv4 hash:ip|2 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/qakbot-iplist.txt)
[bambenek_ramnit](http://iplists.firehol.org/?ipset=bambenek_ramnit)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of ramnit C&Cs with 90 minute lookback|ipv4 hash:ip|98 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/ramnit-iplist.txt)
[bambenek_ranbyus](http://iplists.firehol.org/?ipset=bambenek_ranbyus)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of ranbyus C&Cs with 90 minute lookback|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/ranbyus-iplist.txt)
[bambenek_simda](http://iplists.firehol.org/?ipset=bambenek_simda)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of simda C&Cs with 90 minute lookback|ipv4 hash:ip|131 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/simda-iplist.txt)
[bambenek_suppobox](http://iplists.firehol.org/?ipset=bambenek_suppobox)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of suppobox C&Cs with 90 minute lookback|ipv4 hash:ip|108 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/suppobox-iplist.txt)
[bambenek_symmi](http://iplists.firehol.org/?ipset=bambenek_symmi)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of symmi C&Cs with 90 minute lookback|ipv4 hash:ip|1 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/symmi-iplist.txt)
[bambenek_tinba](http://iplists.firehol.org/?ipset=bambenek_tinba)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of tinba C&Cs with 90 minute lookback|ipv4 hash:ip|4 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/tinba-iplist.txt)
[bambenek_volatile](http://iplists.firehol.org/?ipset=bambenek_volatile)|[Bambenek Consulting](http://osint.bambenekconsulting.com/feeds/) feed of current IPs of volatile C&Cs with 90 minute lookback|ipv4 hash:ip|1 unique IPs|updated every 30 mins from [this link](http://osint.bambenekconsulting.com/feeds/volatile-iplist.txt)
[bbcan177_ms1](http://iplists.firehol.org/?ipset=bbcan177_ms1)|pfBlockerNG Malicious Threats|ipv4 hash:net|2688 subnets, 5269973 unique IPs|updated every 1 day from [this link](https://gist.githubusercontent.com/BBcan177/bf29d47ea04391cb3eb0/raw)
[bbcan177_ms3](http://iplists.firehol.org/?ipset=bbcan177_ms3)|pfBlockerNG Malicious Threats|ipv4 hash:net|1146 subnets, 30151694 unique IPs|updated every 1 day from [this link](https://gist.githubusercontent.com/BBcan177/d7105c242f17f4498f81/raw)
[bds_atif](http://iplists.firehol.org/?ipset=bds_atif)|Artillery Threat Intelligence Feed and Banlist Feed|ipv4 hash:ip|329 unique IPs|updated every 1 day from [this link](https://www.binarydefense.com/banlist.txt)
[bi_any_0_1d](http://iplists.firehol.org/?ipset=bi_any_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category any with score above 0 and age less than 1d|ipv4 hash:ip|19343 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/any/0?age=1d)
[bi_any_1_7d](http://iplists.firehol.org/?ipset=bi_any_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category any with score above 1 and age less than 7d|ipv4 hash:ip|1181 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/any/1?age=7d)
[bi_any_2_1d](http://iplists.firehol.org/?ipset=bi_any_2_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category any with score above 2 and age less than 1d|ipv4 hash:ip|195 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/any/2?age=1d)
[bi_any_2_30d](http://iplists.firehol.org/?ipset=bi_any_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category any with score above 2 and age less than 30d|ipv4 hash:ip|1159 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/any/2?age=30d)
[bi_any_2_7d](http://iplists.firehol.org/?ipset=bi_any_2_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category any with score above 2 and age less than 7d|ipv4 hash:ip|976 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/any/2?age=7d)
[bi_apache-404_0_1d](http://iplists.firehol.org/?ipset=bi_apache-404_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category apache-404 with score above 0 and age less than 1d|ipv4 hash:ip|9 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/apache-404/0?age=1d)
[bi_apache-modsec_0_1d](http://iplists.firehol.org/?ipset=bi_apache-modsec_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category apache-modsec with score above 0 and age less than 1d|ipv4 hash:ip|2 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/apache-modsec/0?age=1d)
[bi_apache-noscript_0_1d](http://iplists.firehol.org/?ipset=bi_apache-noscript_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category apache-noscript with score above 0 and age less than 1d|ipv4 hash:ip|54 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/apache-noscript/0?age=1d)
[bi_apache-noscript_2_30d](http://iplists.firehol.org/?ipset=bi_apache-noscript_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category apache-noscript with score above 2 and age less than 30d|ipv4 hash:ip|3 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/apache-noscript/2?age=30d)
[bi_apache-phpmyadmin_0_1d](http://iplists.firehol.org/?ipset=bi_apache-phpmyadmin_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category apache-phpmyadmin with score above 0 and age less than 1d|ipv4 hash:ip|1 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/apache-phpmyadmin/0?age=1d)
[bi_apache-scriddies_0_1d](http://iplists.firehol.org/?ipset=bi_apache-scriddies_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category apache-scriddies with score above 0 and age less than 1d|ipv4 hash:ip|397 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/apache-scriddies/0?age=1d)
[bi_apache_0_1d](http://iplists.firehol.org/?ipset=bi_apache_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category apache with score above 0 and age less than 1d|ipv4 hash:ip|191 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/apache/0?age=1d)
[bi_apache_1_7d](http://iplists.firehol.org/?ipset=bi_apache_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category apache with score above 1 and age less than 7d|ipv4 hash:ip|7 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/apache/1?age=7d)
[bi_apache_2_30d](http://iplists.firehol.org/?ipset=bi_apache_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category apache with score above 2 and age less than 30d|ipv4 hash:ip|9 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/apache/2?age=30d)
[bi_apacheddos_0_1d](http://iplists.firehol.org/?ipset=bi_apacheddos_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category apacheddos with score above 0 and age less than 1d|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/apacheddos/0?age=1d)
[bi_assp_0_1d](http://iplists.firehol.org/?ipset=bi_assp_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category assp with score above 0 and age less than 1d|ipv4 hash:ip|3 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/assp/0?age=1d)
[bi_asterisk_0_1d](http://iplists.firehol.org/?ipset=bi_asterisk_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category asterisk with score above 0 and age less than 1d|ipv4 hash:ip|60 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/asterisk/0?age=1d)
[bi_asterisk_2_30d](http://iplists.firehol.org/?ipset=bi_asterisk_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category asterisk with score above 2 and age less than 30d|ipv4 hash:ip|5 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/asterisk/2?age=30d)
[bi_badbots_0_1d](http://iplists.firehol.org/?ipset=bi_badbots_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category badbots with score above 0 and age less than 1d|ipv4 hash:ip|1203 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/badbots/0?age=1d)
[bi_badbots_1_7d](http://iplists.firehol.org/?ipset=bi_badbots_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category badbots with score above 1 and age less than 7d|ipv4 hash:ip|174 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/badbots/1?age=7d)
[bi_bruteforce_0_1d](http://iplists.firehol.org/?ipset=bi_bruteforce_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category bruteforce with score above 0 and age less than 1d|ipv4 hash:ip|1440 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/bruteforce/0?age=1d)
[bi_bruteforce_1_7d](http://iplists.firehol.org/?ipset=bi_bruteforce_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category bruteforce with score above 1 and age less than 7d|ipv4 hash:ip|180 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/bruteforce/1?age=7d)
[bi_cms_0_1d](http://iplists.firehol.org/?ipset=bi_cms_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category cms with score above 0 and age less than 1d|ipv4 hash:ip|1270 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/cms/0?age=1d)
[bi_cms_1_7d](http://iplists.firehol.org/?ipset=bi_cms_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category cms with score above 1 and age less than 7d|ipv4 hash:ip|90 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/cms/1?age=7d)
[bi_cms_2_30d](http://iplists.firehol.org/?ipset=bi_cms_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category cms with score above 2 and age less than 30d|ipv4 hash:ip|94 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/cms/2?age=30d)
[bi_courierauth_0_1d](http://iplists.firehol.org/?ipset=bi_courierauth_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category courierauth with score above 0 and age less than 1d|ipv4 hash:ip|1 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/courierauth/0?age=1d)
[bi_courierauth_2_30d](http://iplists.firehol.org/?ipset=bi_courierauth_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category courierauth with score above 2 and age less than 30d|ipv4 hash:ip|0 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/courierauth/2?age=30d)
[bi_default_0_1d](http://iplists.firehol.org/?ipset=bi_default_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category default with score above 0 and age less than 1d|ipv4 hash:ip|219 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/default/0?age=1d)
[bi_default_1_7d](http://iplists.firehol.org/?ipset=bi_default_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category default with score above 1 and age less than 7d|ipv4 hash:ip|14 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/default/1?age=7d)
[bi_default_2_30d](http://iplists.firehol.org/?ipset=bi_default_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category default with score above 2 and age less than 30d|ipv4 hash:ip|17 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/default/2?age=30d)
[bi_dns_0_1d](http://iplists.firehol.org/?ipset=bi_dns_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category dns with score above 0 and age less than 1d|ipv4 hash:ip|28 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/dns/0?age=1d)
[bi_dovecot-pop3imap_0_1d](http://iplists.firehol.org/?ipset=bi_dovecot-pop3imap_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category dovecot-pop3imap with score above 0 and age less than 1d|ipv4 hash:ip|77 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/dovecot-pop3imap/0?age=1d)
[bi_dovecot-pop3imap_2_30d](http://iplists.firehol.org/?ipset=bi_dovecot-pop3imap_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category dovecot-pop3imap with score above 2 and age less than 30d|ipv4 hash:ip|92 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/dovecot-pop3imap/2?age=30d)
[bi_dovecot_0_1d](http://iplists.firehol.org/?ipset=bi_dovecot_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category dovecot with score above 0 and age less than 1d|ipv4 hash:ip|52 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/dovecot/0?age=1d)
[bi_dovecot_1_7d](http://iplists.firehol.org/?ipset=bi_dovecot_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category dovecot with score above 1 and age less than 7d|ipv4 hash:ip|7 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/dovecot/1?age=7d)
[bi_dovecot_2_30d](http://iplists.firehol.org/?ipset=bi_dovecot_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category dovecot with score above 2 and age less than 30d|ipv4 hash:ip|21 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/dovecot/2?age=30d)
[bi_drupal_0_1d](http://iplists.firehol.org/?ipset=bi_drupal_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category drupal with score above 0 and age less than 1d|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/drupal/0?age=1d)
[bi_exim_0_1d](http://iplists.firehol.org/?ipset=bi_exim_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category exim with score above 0 and age less than 1d|ipv4 hash:ip|70 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/exim/0?age=1d)
[bi_exim_1_7d](http://iplists.firehol.org/?ipset=bi_exim_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category exim with score above 1 and age less than 7d|ipv4 hash:ip|1 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/exim/1?age=7d)
[bi_ftp_0_1d](http://iplists.firehol.org/?ipset=bi_ftp_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category ftp with score above 0 and age less than 1d|ipv4 hash:ip|66 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/ftp/0?age=1d)
[bi_ftp_1_7d](http://iplists.firehol.org/?ipset=bi_ftp_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category ftp with score above 1 and age less than 7d|ipv4 hash:ip|3 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/ftp/1?age=7d)
[bi_ftp_2_30d](http://iplists.firehol.org/?ipset=bi_ftp_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category ftp with score above 2 and age less than 30d|ipv4 hash:ip|3 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/ftp/2?age=30d)
[bi_http_0_1d](http://iplists.firehol.org/?ipset=bi_http_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category http with score above 0 and age less than 1d|ipv4 hash:ip|1517 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/http/0?age=1d)
[bi_http_1_7d](http://iplists.firehol.org/?ipset=bi_http_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category http with score above 1 and age less than 7d|ipv4 hash:ip|107 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/http/1?age=7d)
[bi_http_2_30d](http://iplists.firehol.org/?ipset=bi_http_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category http with score above 2 and age less than 30d|ipv4 hash:ip|120 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/http/2?age=30d)
[bi_imap_0_1d](http://iplists.firehol.org/?ipset=bi_imap_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category imap with score above 0 and age less than 1d|ipv4 hash:ip|110 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/imap/0?age=1d)
[bi_mail_0_1d](http://iplists.firehol.org/?ipset=bi_mail_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category mail with score above 0 and age less than 1d|ipv4 hash:ip|1126 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/mail/0?age=1d)
[bi_mail_1_7d](http://iplists.firehol.org/?ipset=bi_mail_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category mail with score above 1 and age less than 7d|ipv4 hash:ip|166 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/mail/1?age=7d)
[bi_mail_2_30d](http://iplists.firehol.org/?ipset=bi_mail_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category mail with score above 2 and age less than 30d|ipv4 hash:ip|186 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/mail/2?age=30d)
[bi_named_0_1d](http://iplists.firehol.org/?ipset=bi_named_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category named with score above 0 and age less than 1d|ipv4 hash:ip|27 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/named/0?age=1d)
[bi_owncloud_0_1d](http://iplists.firehol.org/?ipset=bi_owncloud_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category owncloud with score above 0 and age less than 1d|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/owncloud/0?age=1d)
[bi_plesk-postfix_0_1d](http://iplists.firehol.org/?ipset=bi_plesk-postfix_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category plesk-postfix with score above 0 and age less than 1d|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/plesk-postfix/0?age=1d)
[bi_postfix-sasl_0_1d](http://iplists.firehol.org/?ipset=bi_postfix-sasl_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category postfix-sasl with score above 0 and age less than 1d|ipv4 hash:ip|158 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/postfix-sasl/0?age=1d)
[bi_postfix-sasl_1_7d](http://iplists.firehol.org/?ipset=bi_postfix-sasl_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category postfix-sasl with score above 1 and age less than 7d|ipv4 hash:ip|7 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/postfix-sasl/1?age=7d)
[bi_postfix-sasl_2_30d](http://iplists.firehol.org/?ipset=bi_postfix-sasl_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category postfix-sasl with score above 2 and age less than 30d|ipv4 hash:ip|6 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/postfix-sasl/2?age=30d)
[bi_postfix_0_1d](http://iplists.firehol.org/?ipset=bi_postfix_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category postfix with score above 0 and age less than 1d|ipv4 hash:ip|429 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/postfix/0?age=1d)
[bi_postfix_1_7d](http://iplists.firehol.org/?ipset=bi_postfix_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category postfix with score above 1 and age less than 7d|ipv4 hash:ip|27 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/postfix/1?age=7d)
[bi_postfix_2_30d](http://iplists.firehol.org/?ipset=bi_postfix_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category postfix with score above 2 and age less than 30d|ipv4 hash:ip|32 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/postfix/2?age=30d)
[bi_proftpd_0_1d](http://iplists.firehol.org/?ipset=bi_proftpd_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category proftpd with score above 0 and age less than 1d|ipv4 hash:ip|33 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/proftpd/0?age=1d)
[bi_proftpd_1_7d](http://iplists.firehol.org/?ipset=bi_proftpd_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category proftpd with score above 1 and age less than 7d|ipv4 hash:ip|1 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/proftpd/1?age=7d)
[bi_proftpd_2_30d](http://iplists.firehol.org/?ipset=bi_proftpd_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category proftpd with score above 2 and age less than 30d|ipv4 hash:ip|1 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/proftpd/2?age=30d)
[bi_pureftpd_0_1d](http://iplists.firehol.org/?ipset=bi_pureftpd_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category pureftpd with score above 0 and age less than 1d|ipv4 hash:ip|8 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/pureftpd/0?age=1d)
[bi_pureftpd_1_7d](http://iplists.firehol.org/?ipset=bi_pureftpd_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category pureftpd with score above 1 and age less than 7d|ipv4 hash:ip|1 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/pureftpd/1?age=7d)
[bi_pureftpd_2_30d](http://iplists.firehol.org/?ipset=bi_pureftpd_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category pureftpd with score above 2 and age less than 30d|ipv4 hash:ip|1 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/pureftpd/2?age=30d)
[bi_qmail-smtp_0_1d](http://iplists.firehol.org/?ipset=bi_qmail-smtp_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category qmail-smtp with score above 0 and age less than 1d|ipv4 hash:ip|3 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/qmail-smtp/0?age=1d)
[bi_rdp_0_1d](http://iplists.firehol.org/?ipset=bi_rdp_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category rdp with score above 0 and age less than 1d|ipv4 hash:ip|7 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/rdp/0?age=1d)
[bi_sasl_0_1d](http://iplists.firehol.org/?ipset=bi_sasl_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sasl with score above 0 and age less than 1d|ipv4 hash:ip|124 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/sasl/0?age=1d)
[bi_sasl_1_7d](http://iplists.firehol.org/?ipset=bi_sasl_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sasl with score above 1 and age less than 7d|ipv4 hash:ip|6 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/sasl/1?age=7d)
[bi_sasl_2_30d](http://iplists.firehol.org/?ipset=bi_sasl_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sasl with score above 2 and age less than 30d|ipv4 hash:ip|5 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/sasl/2?age=30d)
[bi_sip_0_1d](http://iplists.firehol.org/?ipset=bi_sip_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sip with score above 0 and age less than 1d|ipv4 hash:ip|23 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/sip/0?age=1d)
[bi_sip_1_7d](http://iplists.firehol.org/?ipset=bi_sip_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sip with score above 1 and age less than 7d|ipv4 hash:ip|1 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/sip/1?age=7d)
[bi_sip_2_30d](http://iplists.firehol.org/?ipset=bi_sip_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sip with score above 2 and age less than 30d|ipv4 hash:ip|1 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/sip/2?age=30d)
[bi_smtp_0_1d](http://iplists.firehol.org/?ipset=bi_smtp_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category smtp with score above 0 and age less than 1d|ipv4 hash:ip|150 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/smtp/0?age=1d)
[bi_spam_0_1d](http://iplists.firehol.org/?ipset=bi_spam_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category spam with score above 0 and age less than 1d|ipv4 hash:ip|162 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/spam/0?age=1d)
[bi_spam_1_7d](http://iplists.firehol.org/?ipset=bi_spam_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category spam with score above 1 and age less than 7d|ipv4 hash:ip|30 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/spam/1?age=7d)
[bi_sql-attack_0_1d](http://iplists.firehol.org/?ipset=bi_sql-attack_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sql-attack with score above 0 and age less than 1d|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/sql-attack/0?age=1d)
[bi_sql_0_1d](http://iplists.firehol.org/?ipset=bi_sql_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sql with score above 0 and age less than 1d|ipv4 hash:ip|28 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/sql/0?age=1d)
[bi_ssh-blocklist_0_1d](http://iplists.firehol.org/?ipset=bi_ssh-blocklist_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category ssh-blocklist with score above 0 and age less than 1d|ipv4 hash:ip|2 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/ssh-blocklist/0?age=1d)
[bi_ssh-ddos_0_1d](http://iplists.firehol.org/?ipset=bi_ssh-ddos_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category ssh-ddos with score above 0 and age less than 1d|ipv4 hash:ip|1204 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/ssh-ddos/0?age=1d)
[bi_ssh-ddos_2_30d](http://iplists.firehol.org/?ipset=bi_ssh-ddos_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category ssh-ddos with score above 2 and age less than 30d|ipv4 hash:ip|1 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/ssh-ddos/2?age=30d)
[bi_ssh_0_1d](http://iplists.firehol.org/?ipset=bi_ssh_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category ssh with score above 0 and age less than 1d|ipv4 hash:ip|14213 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/ssh/0?age=1d)
[bi_ssh_1_7d](http://iplists.firehol.org/?ipset=bi_ssh_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category ssh with score above 1 and age less than 7d|ipv4 hash:ip|853 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/ssh/1?age=7d)
[bi_ssh_2_30d](http://iplists.firehol.org/?ipset=bi_ssh_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category ssh with score above 2 and age less than 30d|ipv4 hash:ip|789 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/ssh/2?age=30d)
[bi_sshd_0_1d](http://iplists.firehol.org/?ipset=bi_sshd_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sshd with score above 0 and age less than 1d|ipv4 hash:ip|6139 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/sshd/0?age=1d)
[bi_sshd_1_7d](http://iplists.firehol.org/?ipset=bi_sshd_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sshd with score above 1 and age less than 7d|ipv4 hash:ip|242 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/sshd/1?age=7d)
[bi_sshd_2_30d](http://iplists.firehol.org/?ipset=bi_sshd_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category sshd with score above 2 and age less than 30d|ipv4 hash:ip|265 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/sshd/2?age=30d)
[bi_telnet_0_1d](http://iplists.firehol.org/?ipset=bi_telnet_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category telnet with score above 0 and age less than 1d|ipv4 hash:ip|132 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/telnet/0?age=1d)
[bi_telnet_1_7d](http://iplists.firehol.org/?ipset=bi_telnet_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category telnet with score above 1 and age less than 7d|ipv4 hash:ip|18 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/telnet/1?age=7d)
[bi_telnet_2_30d](http://iplists.firehol.org/?ipset=bi_telnet_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category telnet with score above 2 and age less than 30d|ipv4 hash:ip|5 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/telnet/2?age=30d)
[bi_unknown_0_1d](http://iplists.firehol.org/?ipset=bi_unknown_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category unknown with score above 0 and age less than 1d|ipv4 hash:ip|4200 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/unknown/0?age=1d)
[bi_unknown_1_7d](http://iplists.firehol.org/?ipset=bi_unknown_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category unknown with score above 1 and age less than 7d|ipv4 hash:ip|22 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/unknown/1?age=7d)
[bi_unknown_2_30d](http://iplists.firehol.org/?ipset=bi_unknown_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category unknown with score above 2 and age less than 30d|ipv4 hash:ip|25 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/unknown/2?age=30d)
[bi_username-notfound_0_1d](http://iplists.firehol.org/?ipset=bi_username-notfound_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category username-notfound with score above 0 and age less than 1d|ipv4 hash:ip|81 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/username-notfound/0?age=1d)
[bi_voip_0_1d](http://iplists.firehol.org/?ipset=bi_voip_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category voip with score above 0 and age less than 1d|ipv4 hash:ip|77 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/voip/0?age=1d)
[bi_voip_1_7d](http://iplists.firehol.org/?ipset=bi_voip_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category voip with score above 1 and age less than 7d|ipv4 hash:ip|3 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/voip/1?age=7d)
[bi_voip_2_30d](http://iplists.firehol.org/?ipset=bi_voip_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category voip with score above 2 and age less than 30d|ipv4 hash:ip|5 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/voip/2?age=30d)
[bi_vsftpd_0_1d](http://iplists.firehol.org/?ipset=bi_vsftpd_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category vsftpd with score above 0 and age less than 1d|ipv4 hash:ip|4 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/vsftpd/0?age=1d)
[bi_vsftpd_2_30d](http://iplists.firehol.org/?ipset=bi_vsftpd_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category vsftpd with score above 2 and age less than 30d|ipv4 hash:ip|0 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/vsftpd/2?age=30d)
[bi_wordpress_0_1d](http://iplists.firehol.org/?ipset=bi_wordpress_0_1d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category wordpress with score above 0 and age less than 1d|ipv4 hash:ip|1189 unique IPs|updated every 30 mins from [this link](https://www.badips.com/get/list/wordpress/0?age=1d)
[bi_wordpress_1_7d](http://iplists.firehol.org/?ipset=bi_wordpress_1_7d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category wordpress with score above 1 and age less than 7d|ipv4 hash:ip|88 unique IPs|updated every 6 hours from [this link](https://www.badips.com/get/list/wordpress/1?age=7d)
[bi_wordpress_2_30d](http://iplists.firehol.org/?ipset=bi_wordpress_2_30d)|[BadIPs.com](https://www.badips.com/) Bad IPs in category wordpress with score above 2 and age less than 30d|ipv4 hash:ip|92 unique IPs|updated every 1 day from [this link](https://www.badips.com/get/list/wordpress/2?age=30d)
[bitcoin_blockchain_info_1d](http://iplists.firehol.org/?ipset=bitcoin_blockchain_info_1d)|[Blockchain.info](https://blockchain.info/en/connected-nodes) Bitcoin nodes connected to Blockchain.info.|ipv4 hash:ip|988 unique IPs|updated every 10 mins from [this link](https://blockchain.info/en/connected-nodes)
[bitcoin_blockchain_info_30d](http://iplists.firehol.org/?ipset=bitcoin_blockchain_info_30d)|[Blockchain.info](https://blockchain.info/en/connected-nodes) Bitcoin nodes connected to Blockchain.info.|ipv4 hash:ip|8196 unique IPs|updated every 10 mins from [this link](https://blockchain.info/en/connected-nodes)
[bitcoin_blockchain_info_7d](http://iplists.firehol.org/?ipset=bitcoin_blockchain_info_7d)|[Blockchain.info](https://blockchain.info/en/connected-nodes) Bitcoin nodes connected to Blockchain.info.|ipv4 hash:ip|2636 unique IPs|updated every 10 mins from [this link](https://blockchain.info/en/connected-nodes)
[bitcoin_nodes](http://iplists.firehol.org/?ipset=bitcoin_nodes)|[BitNodes](https://getaddr.bitnodes.io/) Bitcoin connected nodes, globally.|ipv4 hash:ip|7083 unique IPs|updated every 10 mins from [this link](https://getaddr.bitnodes.io/api/v1/snapshots/latest/)
[bitcoin_nodes_1d](http://iplists.firehol.org/?ipset=bitcoin_nodes_1d)|[BitNodes](https://getaddr.bitnodes.io/) Bitcoin connected nodes, globally.|ipv4 hash:ip|7767 unique IPs|updated every 10 mins from [this link](https://getaddr.bitnodes.io/api/v1/snapshots/latest/)
[bitcoin_nodes_30d](http://iplists.firehol.org/?ipset=bitcoin_nodes_30d)|[BitNodes](https://getaddr.bitnodes.io/) Bitcoin connected nodes, globally.|ipv4 hash:ip|18755 unique IPs|updated every 10 mins from [this link](https://getaddr.bitnodes.io/api/v1/snapshots/latest/)
[bitcoin_nodes_7d](http://iplists.firehol.org/?ipset=bitcoin_nodes_7d)|[BitNodes](https://getaddr.bitnodes.io/) Bitcoin connected nodes, globally.|ipv4 hash:ip|10430 unique IPs|updated every 10 mins from [this link](https://getaddr.bitnodes.io/api/v1/snapshots/latest/)
[blocklist_de](http://iplists.firehol.org/?ipset=blocklist_de)|[Blocklist.de](https://www.blocklist.de/) IPs that have been detected by fail2ban in the last 48 hours|ipv4 hash:ip|29544 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/all.txt)
[blocklist_de_apache](http://iplists.firehol.org/?ipset=blocklist_de_apache)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours as having run attacks on the service Apache, Apache-DDOS, RFI-Attacks.|ipv4 hash:ip|8989 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/apache.txt)
[blocklist_de_bots](http://iplists.firehol.org/?ipset=blocklist_de_bots)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours as having run attacks on the RFI-Attacks, REG-Bots, IRC-Bots or BadBots (BadBots = it has posted a Spam-Comment on a open Forum or Wiki).|ipv4 hash:ip|67 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/bots.txt)
[blocklist_de_bruteforce](http://iplists.firehol.org/?ipset=blocklist_de_bruteforce)|[Blocklist.de](https://www.blocklist.de/) All IPs which attacks Joomla, Wordpress and other Web-Logins with Brute-Force Logins.|ipv4 hash:ip|977 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/bruteforcelogin.txt)
[blocklist_de_ftp](http://iplists.firehol.org/?ipset=blocklist_de_ftp)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours for attacks on the Service FTP.|ipv4 hash:ip|181 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/ftp.txt)
[blocklist_de_imap](http://iplists.firehol.org/?ipset=blocklist_de_imap)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours for attacks on the Service imap, sasl, pop3, etc.|ipv4 hash:ip|1668 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/imap.txt)
[blocklist_de_mail](http://iplists.firehol.org/?ipset=blocklist_de_mail)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours as having run attacks on the service Mail, Postfix.|ipv4 hash:ip|10263 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/mail.txt)
[blocklist_de_sip](http://iplists.firehol.org/?ipset=blocklist_de_sip)|[Blocklist.de](https://www.blocklist.de/) All IP addresses that tried to login in a SIP, VOIP or Asterisk Server and are included in the IPs list from infiltrated.net|ipv4 hash:ip|1016 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/sip.txt)
[blocklist_de_ssh](http://iplists.firehol.org/?ipset=blocklist_de_ssh)|[Blocklist.de](https://www.blocklist.de/) All IP addresses which have been reported within the last 48 hours as having run attacks on the service SSH.|ipv4 hash:ip|16991 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/ssh.txt)
[blocklist_de_strongips](http://iplists.firehol.org/?ipset=blocklist_de_strongips)|[Blocklist.de](https://www.blocklist.de/) All IPs which are older then 2 month and have more then 5.000 attacks.|ipv4 hash:ip|1116 unique IPs|updated every 15 mins from [this link](http://lists.blocklist.de/lists/strongips.txt)
[blocklist_net_ua](http://iplists.firehol.org/?ipset=blocklist_net_ua)|[blocklist.net.ua](https://blocklist.net.ua) The BlockList project was created to become protection against negative influence of the harmful and potentially dangerous events on the Internet. First of all this service will help internet and hosting providers to protect subscribers sites from being hacked. BlockList will help to stop receiving a large amount of spam from dubious SMTP relays or from attempts of brute force passwords to servers and network equipment.|ipv4 hash:ip|47617 unique IPs|updated every 10 mins from [this link](https://blocklist.net.ua/blocklist.csv)
[blueliv_crimeserver_last](http://iplists.firehol.org/?ipset=blueliv_crimeserver_last)|[blueliv.com](https://www.blueliv.com/) Last 6 hours Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|24381 unique IPs|updated every 6 hours
[blueliv_crimeserver_last_1d](http://iplists.firehol.org/?ipset=blueliv_crimeserver_last_1d)|[blueliv.com](https://www.blueliv.com/) Last 6 hours Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|58312 unique IPs|updated every 6 hours
[blueliv_crimeserver_last_2d](http://iplists.firehol.org/?ipset=blueliv_crimeserver_last_2d)|[blueliv.com](https://www.blueliv.com/) Last 6 hours Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|71293 unique IPs|updated every 6 hours
[blueliv_crimeserver_last_30d](http://iplists.firehol.org/?ipset=blueliv_crimeserver_last_30d)|[blueliv.com](https://www.blueliv.com/) Last 6 hours Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|87551 unique IPs|updated every 6 hours
[blueliv_crimeserver_last_7d](http://iplists.firehol.org/?ipset=blueliv_crimeserver_last_7d)|[blueliv.com](https://www.blueliv.com/) Last 6 hours Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|77098 unique IPs|updated every 6 hours
[blueliv_crimeserver_online](http://iplists.firehol.org/?ipset=blueliv_crimeserver_online)|[blueliv.com](https://www.blueliv.com/) Online Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|15628 unique IPs|updated every 1 day
[blueliv_crimeserver_recent](http://iplists.firehol.org/?ipset=blueliv_crimeserver_recent)|[blueliv.com](https://www.blueliv.com/) Recent Cybercrime IPs, in all categories: BACKDOOR, C_AND_C, EXPLOIT_KIT, MALWARE and PHISHING (to download the source data you need an API key from blueliv.com)|ipv4 hash:ip|64076 unique IPs|updated every 1 day
[bm_tor](http://iplists.firehol.org/?ipset=bm_tor)|[torstatus.blutmagie.de](https://torstatus.blutmagie.de) list of all TOR network servers|ipv4 hash:ip|5748 unique IPs|updated every 30 mins from [this link](https://torstatus.blutmagie.de/ip_list_all.php/Tor_ip_list_ALL.csv)
[bogons](http://iplists.firehol.org/?ipset=bogons)|[Team-Cymru.org](http://www.team-cymru.org) private and reserved addresses defined by RFC 1918, RFC 5735, and RFC 6598 and netblocks that have not been allocated to a regional internet registry|ipv4 hash:net|13 subnets, 592708608 unique IPs|updated every 1 day
[botscout](http://iplists.firehol.org/?ipset=botscout)|[BotScout](http://botscout.com/) helps prevent automated web scripts, known as bots, from registering on forums, polluting databases, spreading spam, and abusing forms on web sites. They do this by tracking the names, IPs, and email addresses that bots use and logging them as unique signatures for future reference. They also provide a simple yet powerful API that you can use to test forms when they're submitted on your site. This list is composed of the most recently-caught bots.|ipv4 hash:ip|58 unique IPs|updated every 30 mins from [this link](http://botscout.com/last_caught_cache.htm)
[botscout_1d](http://iplists.firehol.org/?ipset=botscout_1d)|[BotScout](http://botscout.com/) helps prevent automated web scripts, known as bots, from registering on forums, polluting databases, spreading spam, and abusing forms on web sites. They do this by tracking the names, IPs, and email addresses that bots use and logging them as unique signatures for future reference. They also provide a simple yet powerful API that you can use to test forms when they're submitted on your site. This list is composed of the most recently-caught bots.|ipv4 hash:ip|1276 unique IPs|updated every 30 mins from [this link](http://botscout.com/last_caught_cache.htm)
[botscout_30d](http://iplists.firehol.org/?ipset=botscout_30d)|[BotScout](http://botscout.com/) helps prevent automated web scripts, known as bots, from registering on forums, polluting databases, spreading spam, and abusing forms on web sites. They do this by tracking the names, IPs, and email addresses that bots use and logging them as unique signatures for future reference. They also provide a simple yet powerful API that you can use to test forms when they're submitted on your site. This list is composed of the most recently-caught bots.|ipv4 hash:ip|18259 unique IPs|updated every 30 mins from [this link](http://botscout.com/last_caught_cache.htm)
[botscout_7d](http://iplists.firehol.org/?ipset=botscout_7d)|[BotScout](http://botscout.com/) helps prevent automated web scripts, known as bots, from registering on forums, polluting databases, spreading spam, and abusing forms on web sites. They do this by tracking the names, IPs, and email addresses that bots use and logging them as unique signatures for future reference. They also provide a simple yet powerful API that you can use to test forms when they're submitted on your site. This list is composed of the most recently-caught bots.|ipv4 hash:ip|6464 unique IPs|updated every 30 mins from [this link](http://botscout.com/last_caught_cache.htm)
[botvrij_dst](http://iplists.firehol.org/?ipset=botvrij_dst)|[botvrij.eu](http://www.botvrij.eu/) Indicators of Compromise (IOCS) about malicious destination IPs, gathered via open source information feeds (blog pages and PDF documents) and then consolidated into different datasets. To ensure the quality of the data all entries older than approx. 6 months are removed.|ipv4 hash:ip|119 unique IPs|updated every 1 day from [this link](http://www.botvrij.eu/data/ioclist.ip-dst.raw)
[botvrij_src](http://iplists.firehol.org/?ipset=botvrij_src)|[botvrij.eu](http://www.botvrij.eu/) Indicators of Compromise (IOCS) about malicious source IPs, gathered via open source information feeds (blog pages and PDF documents) and then consolidated into different datasets. To ensure the quality of the data all entries older than approx. 6 months are removed.|ipv4 hash:ip|0 unique IPs|updated every 1 day from [this link](http://www.botvrij.eu/data/ioclist.ip-src.raw)
[bruteforceblocker](http://iplists.firehol.org/?ipset=bruteforceblocker)|[danger.rulez.sk bruteforceblocker](http://danger.rulez.sk/index.php/bruteforceblocker/) (fail2ban alternative for SSH on OpenBSD). This is an automatically generated list from users reporting failed authentication attempts. An IP seems to be included if 3 or more users report it. Its retention pocily seems 30 days.|ipv4 hash:ip|3139 unique IPs|updated every 3 hours from [this link](http://danger.rulez.sk/projects/bruteforceblocker/blist.php)
[ciarmy](http://iplists.firehol.org/?ipset=ciarmy)|[CIArmy.com](http://ciarmy.com/) IPs with poor Rogue Packet score that have not yet been identified as malicious by the community|ipv4 hash:ip|15000 unique IPs|updated every 3 hours from [this link](http://cinsscore.com/list/ci-badguys.txt)
[cidr_report_bogons](http://iplists.firehol.org/?ipset=cidr_report_bogons)|Unallocated (Free) Address Space, generated on a daily basis using the IANA registry files, the Regional Internet Registry stats files and the Regional Internet Registry whois data.|ipv4 hash:net|6196 subnets, 606056792 unique IPs|updated every 1 day from [this link](http://www.cidr-report.org/bogons/freespace-prefix.txt)
[cleanmx_phishing](http://iplists.firehol.org/?ipset=cleanmx_phishing)|[Clean-MX.de](http://support.clean-mx.de/) IPs sending phishing messages|ipv4 hash:ip|4519 unique IPs|updated every 30 mins from [this link](http://support.clean-mx.de/clean-mx/xmlphishing?response=alive&format=csv&domain=)
[cleanmx_viruses](http://iplists.firehol.org/?ipset=cleanmx_viruses)|[Clean-MX.de](http://support.clean-mx.de/clean-mx/viruses.php) IPs with viruses|ipv4 hash:ip|12190 unique IPs|updated every 30 mins from [this link](http://support.clean-mx.de/clean-mx/xmlviruses.php?response=alive&fields=ip)
[cleantalk](http://iplists.firehol.org/?ipset=cleantalk)|[CleanTalk](https://cleantalk.org/) Today's HTTP Spammers (includes: cleantalk_new cleantalk_updated)|ipv4 hash:ip|447 unique IPs|updated every 1 min
[cleantalk_1d](http://iplists.firehol.org/?ipset=cleantalk_1d)|[CleanTalk](https://cleantalk.org/) Today's HTTP Spammers (includes: cleantalk_new_1d cleantalk_updated_1d)|ipv4 hash:ip|447 unique IPs|updated every 1 min
[cleantalk_30d](http://iplists.firehol.org/?ipset=cleantalk_30d)|[CleanTalk](https://cleantalk.org/) Today's HTTP Spammers (includes: cleantalk_new_30d cleantalk_updated_30d)|ipv4 hash:ip|22306 unique IPs|updated every 1 min
[cleantalk_7d](http://iplists.firehol.org/?ipset=cleantalk_7d)|[CleanTalk](https://cleantalk.org/) Today's HTTP Spammers (includes: cleantalk_new_7d cleantalk_updated_7d)|ipv4 hash:ip|3773 unique IPs|updated every 1 min
[cleantalk_new](http://iplists.firehol.org/?ipset=cleantalk_new)|[CleanTalk](https://cleantalk.org/) Recent HTTP Spammers|ipv4 hash:ip|250 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/submited_today)
[cleantalk_new_1d](http://iplists.firehol.org/?ipset=cleantalk_new_1d)|[CleanTalk](https://cleantalk.org/) Recent HTTP Spammers|ipv4 hash:ip|250 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/submited_today)
[cleantalk_new_30d](http://iplists.firehol.org/?ipset=cleantalk_new_30d)|[CleanTalk](https://cleantalk.org/) Recent HTTP Spammers|ipv4 hash:ip|13000 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/submited_today)
[cleantalk_new_7d](http://iplists.firehol.org/?ipset=cleantalk_new_7d)|[CleanTalk](https://cleantalk.org/) Recent HTTP Spammers|ipv4 hash:ip|2000 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/submited_today)
[cleantalk_top20](http://iplists.firehol.org/?ipset=cleantalk_top20)|[CleanTalk](https://cleantalk.org/) Top 20 HTTP Spammers|ipv4 hash:ip|20 unique IPs|updated every 1 day from [this link](https://cleantalk.org/blacklists/top20)
[cleantalk_updated](http://iplists.firehol.org/?ipset=cleantalk_updated)|[CleanTalk](https://cleantalk.org/) Recurring HTTP Spammers|ipv4 hash:ip|250 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/updated_today)
[cleantalk_updated_1d](http://iplists.firehol.org/?ipset=cleantalk_updated_1d)|[CleanTalk](https://cleantalk.org/) Recurring HTTP Spammers|ipv4 hash:ip|250 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/updated_today)
[cleantalk_updated_30d](http://iplists.firehol.org/?ipset=cleantalk_updated_30d)|[CleanTalk](https://cleantalk.org/) Recurring HTTP Spammers|ipv4 hash:ip|11299 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/updated_today)
[cleantalk_updated_7d](http://iplists.firehol.org/?ipset=cleantalk_updated_7d)|[CleanTalk](https://cleantalk.org/) Recurring HTTP Spammers|ipv4 hash:ip|1943 unique IPs|updated every 15 mins from [this link](https://cleantalk.org/blacklists/updated_today)
[coinbl_hosts](http://iplists.firehol.org/?ipset=coinbl_hosts)|[CoinBlockerLists](https://gitlab.com/ZeroDot1/CoinBlockerLists) Simple lists that can help prevent cryptomining in the browser or other applications. This list contains all domains - A list for administrators to prevent mining in networks. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|9265 unique IPs|updated every 1 day from [this link](https://zerodot1.gitlab.io/CoinBlockerLists/hosts)
[coinbl_hosts_browser](http://iplists.firehol.org/?ipset=coinbl_hosts_browser)|[CoinBlockerLists](https://gitlab.com/ZeroDot1/CoinBlockerLists) Simple lists that can help prevent cryptomining in the browser or other applications. A hosts list to prevent browser mining only. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|710 unique IPs|updated every 1 day from [this link](https://zerodot1.gitlab.io/CoinBlockerLists/hosts_browser)
[coinbl_hosts_optional](http://iplists.firehol.org/?ipset=coinbl_hosts_optional)|[CoinBlockerLists](https://gitlab.com/ZeroDot1/CoinBlockerLists) Simple lists that can help prevent cryptomining in the browser or other applications. This list contains additional domains, for administrators to prevent mining in networks. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|510 unique IPs|updated every 1 day from [this link](https://zerodot1.gitlab.io/CoinBlockerLists/hosts_optional)
[coinbl_ips](http://iplists.firehol.org/?ipset=coinbl_ips)|[CoinBlockerLists](https://gitlab.com/ZeroDot1/CoinBlockerLists) Simple lists that can help prevent cryptomining in the browser or other applications. This list contains all IPs - An additional list for administrators to prevent mining in networks. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|1390 unique IPs|updated every 1 day from [this link](https://zerodot1.gitlab.io/CoinBlockerLists/MiningServerIPList.txt)
[cruzit_web_attacks](http://iplists.firehol.org/?ipset=cruzit_web_attacks)|[CruzIt.com](http://www.cruzit.com/wbl.php) IPs of compromised machines scanning for vulnerabilities and DDOS attacks|ipv4 hash:ip|11392 unique IPs|updated every 12 hours from [this link](http://www.cruzit.com/xwbl2txt.php)
[cta_cryptowall](http://iplists.firehol.org/?ipset=cta_cryptowall)|[Cyber Threat Alliance](http://www.cyberthreatalliance.org/cryptowall-dashboard.html) CryptoWall is one of the most lucrative and broad-reaching ransomware campaigns affecting Internet users today. Sharing intelligence and analysis resources, the CTA profiled the latest version of CryptoWall, which impacted hundreds of thousands of users, resulting in over US $325 million in damages worldwide.|ipv4 hash:ip|1360 unique IPs|updated every 1 day from [this link](https://public.tableau.com/views/CTAOnlineViz/DashboardData.csv?:embed=y&:showVizHome=no&:showTabs=y&:display_count=y&:display_static_image=y&:bootstrapWhenNotified=true)
[cybercrime](http://iplists.firehol.org/?ipset=cybercrime)|[CyberCrime](http://cybercrime-tracker.net/) A project tracking Command and Control.|ipv4 hash:ip|1516 unique IPs|updated every 12 hours from [this link](http://cybercrime-tracker.net/fuckerz.php)
[darklist_de](http://iplists.firehol.org/?ipset=darklist_de)|[darklist.de](http://www.darklist.de/) ssh fail2ban reporting|ipv4 hash:net|12424 subnets, 813743 unique IPs|updated every 1 day from [this link](http://www.darklist.de/raw.php)
[datacenters](http://iplists.firehol.org/?ipset=datacenters)|[Nick Galbreath](https://github.com/client9/ipcat) This is a list of IPv4 address that correspond to datacenters, co-location centers, shared and virtual webhosting providers. In other words, ip addresses that end web consumers should not be using.|ipv4 hash:net|4224 subnets, 95959476 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/client9/ipcat/master/datacenters.csv)
[dataplane_dnsrd](http://iplists.firehol.org/?ipset=dataplane_dnsrd)|[DataPlane.org](https://dataplane.org/) IP addresses that have been identified as sending recursive DNS queries to a remote host. This report lists addresses that may be cataloging open DNS resolvers or evaluating cache entries.|ipv4 hash:ip|636 unique IPs|updated every 1 hour
[dataplane_dnsrdany](http://iplists.firehol.org/?ipset=dataplane_dnsrdany)|[DataPlane.org](https://dataplane.org/) IP addresses that have been identified as sending recursive DNS IN ANY queries to a remote host. This report lists addresses that may be cataloging open DNS resolvers for the purpose of later using them to facilitate DNS amplification and reflection attacks.|ipv4 hash:ip|80 unique IPs|updated every 1 hour
[dataplane_dnsversion](http://iplists.firehol.org/?ipset=dataplane_dnsversion)|[DataPlane.org](https://dataplane.org/) IP addresses that have been identified as sending DNS CH TXT VERSION.BIND queries to a remote host. This report lists addresses that may be cataloging DNS software.|ipv4 hash:ip|251 unique IPs|updated every 1 hour
[dataplane_sipinvitation](http://iplists.firehol.org/?ipset=dataplane_sipinvitation)|[DataPlane.org](https://dataplane.org/) IP addresses that have been seen initiating a SIP INVITE operation to a remote host. This report lists hosts that are suspicious of more than just port scanning. These hosts may be SIP client cataloging or conducting various forms of telephony abuse.|ipv4 hash:ip|83 unique IPs|updated every 1 hour
[dataplane_sipquery](http://iplists.firehol.org/?ipset=dataplane_sipquery)|[DataPlane.org](https://dataplane.org/) IP addresses that has been seen initiating a SIP OPTIONS query to a remote host. This report lists hosts that are suspicious of more than just port scanning. These hosts may be SIP server cataloging or conducting various forms of telephony abuse.|ipv4 hash:ip|1006 unique IPs|updated every 1 hour
[dataplane_sipregistration](http://iplists.firehol.org/?ipset=dataplane_sipregistration)|[DataPlane.org](https://dataplane.org/) IP addresses that have been seen initiating a SIP REGISTER operation to a remote host. This report lists hosts that are suspicious of more than just port scanning. These hosts may be SIP client cataloging or conducting various forms of telephony abuse.|ipv4 hash:ip|56 unique IPs|updated every 1 hour
[dataplane_sshclient](http://iplists.firehol.org/?ipset=dataplane_sshclient)|[DataPlane.org](https://dataplane.org/) IP addresses that has been seen initiating an SSH connection to a remote host. This report lists hosts that are suspicious of more than just port scanning. These hosts may be SSH server cataloging or conducting authentication attack attempts.|ipv4 hash:ip|27660 unique IPs|updated every 1 hour
[dataplane_sshpwauth](http://iplists.firehol.org/?ipset=dataplane_sshpwauth)|[DataPlane.org](https://dataplane.org/) IP addresses that has been seen attempting to remotely login to a host using SSH password authentication. This report lists hosts that are highly suspicious and are likely conducting malicious SSH password authentication attacks.|ipv4 hash:ip|23636 unique IPs|updated every 1 hour
[dataplane_vncrfb](http://iplists.firehol.org/?ipset=dataplane_vncrfb)|[DataPlane.org](https://dataplane.org/) IP addresses that have been seen initiating a VNC remote frame buffer (RFB) session to a remote host. This report lists hosts that are suspicious of more than just port scanning. These hosts may be VNC server cataloging or conducting various forms of remote access abuse.|ipv4 hash:ip|1535 unique IPs|updated every 1 hour
[dm_tor](http://iplists.firehol.org/?ipset=dm_tor)|[dan.me.uk](https://www.dan.me.uk) dynamic list of TOR nodes|ipv4 hash:ip|6359 unique IPs|updated every 30 mins from [this link](https://www.dan.me.uk/torlist/)
[dronebl_anonymizers](http://iplists.firehol.org/?ipset=dronebl_anonymizers)|[DroneBL.org](https://dronebl.org) List of open proxies. It includes IPs which DroneBL categorizes as SOCKS proxies (8), HTTP proxies (9), web page proxies (11), WinGate proxies (14), proxy chains (10).|ipv4 hash:net|1239318 subnets, 1361659 unique IPs|updated every 1 min
[dronebl_auto_botnets](http://iplists.firehol.org/?ipset=dronebl_auto_botnets)|[DroneBL.org](https://dronebl.org) IPs of automatically detected botnets. It includes IPs for which DroneBL responds with 17.|ipv4 hash:net|10820 subnets, 10930 unique IPs|updated every 1 min
[dronebl_autorooting_worms](http://iplists.firehol.org/?ipset=dronebl_autorooting_worms)|[DroneBL.org](https://dronebl.org) IPs of autorooting worms. It includes IPs for which DroneBL responds with 16. These are usually SSH bruteforce attacks.|ipv4 hash:net|1715 subnets, 1863 unique IPs|updated every 1 min
[dronebl_compromised](http://iplists.firehol.org/?ipset=dronebl_compromised)|[DroneBL.org](https://dronebl.org) IPs of compromised routers / gateways. It includes IPs for which DroneBL responds with 15 (BOPM detected).|ipv4 hash:net|58395 subnets, 59306 unique IPs|updated every 1 min
[dronebl_ddos_drones](http://iplists.firehol.org/?ipset=dronebl_ddos_drones)|[DroneBL.org](https://dronebl.org) IPs of DDoS drones. It includes IPs for which DroneBL responds with 7.|ipv4 hash:net|2240 subnets, 2246 unique IPs|updated every 1 min
[dronebl_dns_mx_on_irc](http://iplists.firehol.org/?ipset=dronebl_dns_mx_on_irc)|[DroneBL.org](https://dronebl.org) List of IPs of DNS / MX hostname detected on IRC. It includes IPs for which DroneBL responds with 18.|ipv4 hash:net|496 subnets, 501 unique IPs|updated every 1 min
[dronebl_irc_drones](http://iplists.firehol.org/?ipset=dronebl_irc_drones)|[DroneBL.org](https://dronebl.org) List of IRC spam drones (litmus/sdbot/fyle). It includes IPs for which DroneBL responds with 3.|ipv4 hash:net|792868 subnets, 957289 unique IPs|updated every 1 min
[dronebl_unknown](http://iplists.firehol.org/?ipset=dronebl_unknown)|[DroneBL.org](https://dronebl.org) List of IPs of uncategorized threats. It includes IPs for which DroneBL responds with 255.|ipv4 hash:net|5 subnets, 5 unique IPs|updated every 1 min
[dronebl_worms_bots](http://iplists.firehol.org/?ipset=dronebl_worms_bots)|[DroneBL.org](https://dronebl.org) IPs of unknown worms or spambots. It includes IPs for which DroneBL responds with 6|ipv4 hash:net|154362 subnets, 164059 unique IPs|updated every 1 min
[dshield](http://iplists.firehol.org/?ipset=dshield)|[DShield.org](https://dshield.org/) top 20 attacking class C (/24) subnets over the last three days|ipv4 hash:net|19 subnets, 5120 unique IPs|updated every 10 mins from [this link](http://feeds.dshield.org/block.txt)
[dshield_1d](http://iplists.firehol.org/?ipset=dshield_1d)|[DShield.org](https://dshield.org/) top 20 attacking class C (/24) subnets over the last three days|ipv4 hash:net|23 subnets, 6144 unique IPs|updated every 10 mins from [this link](http://feeds.dshield.org/block.txt)
[dshield_30d](http://iplists.firehol.org/?ipset=dshield_30d)|[DShield.org](https://dshield.org/) top 20 attacking class C (/24) subnets over the last three days|ipv4 hash:net|53 subnets, 16384 unique IPs|updated every 10 mins from [this link](http://feeds.dshield.org/block.txt)
[dshield_7d](http://iplists.firehol.org/?ipset=dshield_7d)|[DShield.org](https://dshield.org/) top 20 attacking class C (/24) subnets over the last three days|ipv4 hash:net|39 subnets, 11264 unique IPs|updated every 10 mins from [this link](http://feeds.dshield.org/block.txt)
[dshield_top_1000](http://iplists.firehol.org/?ipset=dshield_top_1000)|[DShield.org](https://dshield.org/) top 1000 attacking hosts in the last 30 days|ipv4 hash:ip|1000 unique IPs|updated every 1 hour from [this link](https://isc.sans.edu/api/sources/attacks/1000/)
[dyndns_ponmocup](http://iplists.firehol.org/?ipset=dyndns_ponmocup)|[DynDNS.org](http://security-research.dyndns.org/pub/malware-feeds/) Ponmocup. The malware powering the botnet has been around since 2006 and it’s known under various names, including Ponmocup, Vundo, Virtumonde, Milicenso and Swisyn. It has been used for ad fraud, data theft and downloading additional threats to infected systems. Ponmocup is one of the largest currently active and, with nine consecutive years, also one of the longest running, but it is rarely noticed as the operators take care to keep it operating under the radar.|ipv4 hash:ip|58 unique IPs|updated every 1 day from [this link](http://security-research.dyndns.org/pub/malware-feeds/ponmocup-infected-domains-shadowserver.csv)
[esentire_14072015_com](http://iplists.firehol.org/?ipset=esentire_14072015_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|579 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/14072015.com_watch_ip.lst)
[esentire_14072015q_com](http://iplists.firehol.org/?ipset=esentire_14072015q_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|575 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/14072015q.com_watch_ip.lst)
[esentire_22072014a_com](http://iplists.firehol.org/?ipset=esentire_22072014a_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|1290 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/22072014a.com_watch_ip.lst)
[esentire_22072014b_com](http://iplists.firehol.org/?ipset=esentire_22072014b_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|1288 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/22072014b.com_watch_ip.lst)
[esentire_22072014c_com](http://iplists.firehol.org/?ipset=esentire_22072014c_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|1289 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/22072014c.com_watch_ip.lst)
[esentire_atomictrivia_ru](http://iplists.firehol.org/?ipset=esentire_atomictrivia_ru)|Andromeda/Gamarue Checkin|ipv4 hash:ip|7 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/atomictrivia.ru_watch_ip.lst)
[esentire_auth_update_ru](http://iplists.firehol.org/?ipset=esentire_auth_update_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|1306 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/auth-update.ru_watch_ip.lst)
[esentire_burmundisoul_ru](http://iplists.firehol.org/?ipset=esentire_burmundisoul_ru)|Ursnif Variant CnC|ipv4 hash:ip|2551 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/burmundisoul.ru_watch_ip.lst)
[esentire_crazyerror_su](http://iplists.firehol.org/?ipset=esentire_crazyerror_su)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|18613 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/crazyerror.su_watch_ip.lst)
[esentire_dagestanskiiviskis_ru](http://iplists.firehol.org/?ipset=esentire_dagestanskiiviskis_ru)|Ursnif Variant CnC|ipv4 hash:ip|517 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/dagestanskiiviskis.ru_watch_ip.lst)
[esentire_differentia_ru](http://iplists.firehol.org/?ipset=esentire_differentia_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|12 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/differentia.ru_watch_ip.lst)
[esentire_disorderstatus_ru](http://iplists.firehol.org/?ipset=esentire_disorderstatus_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|7 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/disorderstatus.ru_watch_ip.lst)
[esentire_dorttlokolrt_com](http://iplists.firehol.org/?ipset=esentire_dorttlokolrt_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|23664 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/dorttlokolrt.com_watch_ip.lst)
[esentire_downs1_ru](http://iplists.firehol.org/?ipset=esentire_downs1_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|7231 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/downs1.ru_watch_ip.lst)
[esentire_ebankoalalusys_ru](http://iplists.firehol.org/?ipset=esentire_ebankoalalusys_ru)|Ursnif Variant CnC|ipv4 hash:ip|898 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/ebankoalalusys.ru_watch_ip.lst)
[esentire_emptyarray_ru](http://iplists.firehol.org/?ipset=esentire_emptyarray_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|20139 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/emptyarray.ru_watch_ip.lst)
[esentire_fioartd_com](http://iplists.firehol.org/?ipset=esentire_fioartd_com)|Andromeda/Gamarue Checkin|ipv4 hash:ip|601 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/fioartd.com_watch_ip.lst)
[esentire_getarohirodrons_com](http://iplists.firehol.org/?ipset=esentire_getarohirodrons_com)|Andromeda/Gamarue Checkin|ipv4 hash:ip|2156 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/getarohirodrons.com_watch_ip.lst)
[esentire_hasanhashsde_ru](http://iplists.firehol.org/?ipset=esentire_hasanhashsde_ru)|Ursnif Variant CnC|ipv4 hash:ip|1184 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/hasanhashsde.ru_watch_ip.lst)
[esentire_inleet_ru](http://iplists.firehol.org/?ipset=esentire_inleet_ru)|Ursnif Variant CnC|ipv4 hash:ip|4219 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/inleet.ru_watch_ip.lst)
[esentire_islamislamdi_ru](http://iplists.firehol.org/?ipset=esentire_islamislamdi_ru)|Ursnif Variant CnC|ipv4 hash:ip|673 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/islamislamdi.ru_watch_ip.lst)
[esentire_krnqlwlplttc_com](http://iplists.firehol.org/?ipset=esentire_krnqlwlplttc_com)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|2 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/krnqlwlplttc.com_watch_ip.lst)
[esentire_maddox1_ru](http://iplists.firehol.org/?ipset=esentire_maddox1_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|11345 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/maddox1.ru_watch_ip.lst)
[esentire_manning1_ru](http://iplists.firehol.org/?ipset=esentire_manning1_ru)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|6824 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/manning1.ru_watch_ip.lst)
[esentire_misteryherson_ru](http://iplists.firehol.org/?ipset=esentire_misteryherson_ru)|Ursnif Variant CnC|ipv4 hash:ip|176 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/misteryherson.ru_watch_ip.lst)
[esentire_mysebstarion_ru](http://iplists.firehol.org/?ipset=esentire_mysebstarion_ru)|Ursnif Variant CnC|ipv4 hash:ip|1058 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/mysebstarion.ru_watch_ip.lst)
[esentire_smartfoodsglutenfree_kz](http://iplists.firehol.org/?ipset=esentire_smartfoodsglutenfree_kz)|Malicious Botnet Serving Various Malware Families|ipv4 hash:ip|2674 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/smartfoodsglutenfree.kz_watch_ip.lst)
[esentire_venerologvasan93_ru](http://iplists.firehol.org/?ipset=esentire_venerologvasan93_ru)|Ursnif Variant CnC|ipv4 hash:ip|1263 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/venerologvasan93.ru_watch_ip.lst)
[esentire_volaya_ru](http://iplists.firehol.org/?ipset=esentire_volaya_ru)|Win32/PSW.Papras.CK CnC|ipv4 hash:ip|5080 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/eSentire/malfeed/master/volaya.ru_watch_ip.lst)
[et_block](http://iplists.firehol.org/?ipset=et_block)|[EmergingThreats.net](http://www.emergingthreats.net/) default blacklist (at the time of writing includes spamhaus DROP, dshield and abuse.ch trackers, which are available separately too - prefer to use the direct ipsets instead of this, they seem to lag a bit in updates)|ipv4 hash:net|1154 subnets, 19798732 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt)
[et_botcc](http://iplists.firehol.org/?ipset=et_botcc)|[EmergingThreats.net Command and Control IPs](http://doc.emergingthreats.net/bin/view/Main/BotCC) These IPs are updates every 24 hours and should be considered VERY highly reliable indications that a host is communicating with a known and active Bot or Malware command and control server - (although they say this includes abuse.ch trackers, it does not - check its overlaps)|ipv4 hash:ip|67 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/fwrules/emerging-PIX-CC.rules)
[et_compromised](http://iplists.firehol.org/?ipset=et_compromised)|[EmergingThreats.net compromised hosts](http://doc.emergingthreats.net/bin/view/Main/CompromisedHost)|ipv4 hash:ip|3081 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/blockrules/compromised-ips.txt)
[et_dshield](http://iplists.firehol.org/?ipset=et_dshield)|[EmergingThreats.net](http://www.emergingthreats.net/) dshield blocklist|ipv4 hash:net|19 subnets, 5120 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/fwrules/emerging-PIX-DSHIELD.rules)
[et_spamhaus](http://iplists.firehol.org/?ipset=et_spamhaus)|[EmergingThreats.net](http://www.emergingthreats.net/) spamhaus blocklist|ipv4 hash:net|933 subnets, 19793664 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/fwrules/emerging-PIX-DROP.rules)
[et_tor](http://iplists.firehol.org/?ipset=et_tor)|[EmergingThreats.net TOR list](http://doc.emergingthreats.net/bin/view/Main/TorRules) of TOR network IPs|ipv4 hash:ip|6551 unique IPs|updated every 12 hours from [this link](http://rules.emergingthreats.net/blockrules/emerging-tor.rules)
[feodo](http://iplists.firehol.org/?ipset=feodo)|[Abuse.ch Feodo tracker](https://feodotracker.abuse.ch) trojan includes IPs which are being used by Feodo (also known as Cridex or Bugat) which commits ebanking fraud|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://feodotracker.abuse.ch/blocklist/?download=ipblocklist)
[feodo_badips](http://iplists.firehol.org/?ipset=feodo_badips)|[Abuse.ch Feodo tracker BadIPs](https://feodotracker.abuse.ch) The Feodo Tracker Feodo BadIP Blocklist only contains IP addresses (IPv4) used as C&C communication channel by the Feodo Trojan version B. These IP addresses are usually servers rented by cybercriminals directly and used for the exclusive purpose of hosting a Feodo C&C server. Hence you should expect no legit traffic to those IP addresses. The site highly recommends you to block/drop any traffic towards any Feodo C&C using the Feodo BadIP Blocklist. Please consider that this blocklist only contains IP addresses used by version B of the Feodo Trojan. C&C communication channels used by version A, version C and version D are not covered by this blocklist.|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://feodotracker.abuse.ch/blocklist/?download=badips)
[firehol_abusers_1d](http://iplists.firehol.org/?ipset=firehol_abusers_1d)|An ipset made from blocklists that track abusers in the last 24 hours. (includes: botscout_1d cleantalk_new_1d cleantalk_updated_1d php_commenters_1d php_dictionary_1d php_harvesters_1d php_spammers_1d stopforumspam_1d)|ipv4 hash:net|8024 subnets, 8390 unique IPs|updated every 1 min
[firehol_abusers_30d](http://iplists.firehol.org/?ipset=firehol_abusers_30d)|An ipset made from blocklists that track abusers in the last 30 days. (includes: cleantalk_new_30d cleantalk_updated_30d php_commenters_30d php_dictionary_30d php_harvesters_30d php_spammers_30d stopforumspam sblam)|ipv4 hash:net|191730 subnets, 200513 unique IPs|updated every 1 min
[firehol_anonymous](http://iplists.firehol.org/?ipset=firehol_anonymous)|An ipset that includes all the anonymizing IPs of the world. (includes: anonymous bm_tor dm_tor firehol_proxies tor_exits)|ipv4 hash:net|1658235 subnets, 1691648 unique IPs|updated every 1 min
[firehol_level1](http://iplists.firehol.org/?ipset=firehol_level1)|A firewall blacklist composed from IP lists, providing maximum protection with minimum false positives. Suitable for basic protection on all internet facing servers, routers and firewalls. (includes: bambenek_c2 dshield feodo fullbogons spamhaus_drop spamhaus_edrop sslbl zeus_badips ransomware_rw)|ipv4 hash:net|2752 subnets, 619502555 unique IPs|updated every 1 min
[firehol_level2](http://iplists.firehol.org/?ipset=firehol_level2)|An ipset made from blocklists that track attacks, during about the last 48 hours. (includes: blocklist_de dshield_1d greensnow)|ipv4 hash:net|22021 subnets, 36347 unique IPs|updated every 1 min
[firehol_level3](http://iplists.firehol.org/?ipset=firehol_level3)|An ipset made from blocklists that track attacks, spyware, viruses. It includes IPs than have been reported or detected in the last 30 days. (includes: bruteforceblocker ciarmy dshield_30d dshield_top_1000 malc0de maxmind_proxy_fraud myip shunlist snort_ipfilter sslbl_aggressive talosintel_ipfilter zeus vxvault)|ipv4 hash:net|19516 subnets, 36824 unique IPs|updated every 1 min
[firehol_level4](http://iplists.firehol.org/?ipset=firehol_level4)|An ipset made from blocklists that track attacks, but may include a large number of false positives. (includes: blocklist_net_ua botscout_30d cruzit_web_attacks cybercrime haley_ssh iblocklist_hijacked iblocklist_spyware iblocklist_webexploit ipblacklistcloud_top iw_wormlist malwaredomainlist)|ipv4 hash:net|134630 subnets, 9284599 unique IPs|updated every 1 min
[firehol_proxies](http://iplists.firehol.org/?ipset=firehol_proxies)|An ipset made from all sources that track open proxies. It includes IPs reported or detected in the last 30 days. (includes: iblocklist_proxies maxmind_proxy_fraud ip2proxy_px1lite proxylists_30d proxyrss_30d proxz_30d ri_connect_proxies_30d ri_web_proxies_30d socks_proxy_30d sslproxies_30d xroxy_30d)|ipv4 hash:net|1648941 subnets, 1675940 unique IPs|updated every 1 min
[firehol_webclient](http://iplists.firehol.org/?ipset=firehol_webclient)|An IP blacklist made from blocklists that track IPs that a web client should never talk to. This list is to be used on top of firehol_level1. (includes: ransomware_online sslbl_aggressive cybercrime dyndns_ponmocup maxmind_proxy_fraud)|ipv4 hash:net|2000 subnets, 2156 unique IPs|updated every 1 min
[firehol_webserver](http://iplists.firehol.org/?ipset=firehol_webserver)|A web server IP blacklist made from blocklists that track IPs that should never be used by your web users. (This list includes IPs that are servers hosting malware, bots, etc or users having a long criminal history. This list is to be used on top of firehol_level1, firehol_level2, firehol_level3 and possibly firehol_proxies or firehol_anonymous). (includes: maxmind_proxy_fraud myip pushing_inertia_blocklist stopforumspam_toxic)|ipv4 hash:net|1926 subnets, 57181535 unique IPs|updated every 1 min
[fullbogons](http://iplists.firehol.org/?ipset=fullbogons)|[Team-Cymru.org](http://www.team-cymru.org) IP space that has been allocated to an RIR, but not assigned by that RIR to an actual ISP or other end-user|ipv4 hash:net|1322 subnets, 598843392 unique IPs|updated every 1 day
geolite2_asn|[MaxMind GeoLite2 ASN](https://dev.maxmind.com/geoip/geoip2/geolite2/)|ipv4 hash:net|disabled|updated every 7 days from [this link](http://geolite.maxmind.com/download/geoip/database/GeoLite2-ASN-CSV.zip)
[geolite2_country](https://github.com/firehol/blocklist-ipsets/tree/master/geolite2_country)|[MaxMind GeoLite2](http://dev.maxmind.com/geoip/geoip2/geolite2/) databases are free IP geolocation databases comparable to, but less accurate than, MaxMind’s GeoIP2 databases. They include IPs per country, IPs per continent, IPs used by anonymous services (VPNs, Proxies, etc) and Satellite Providers.|ipv4 hash:net|All the world|updated every 7 days from [this link](http://geolite.maxmind.com/download/geoip/database/GeoLite2-Country-CSV.zip)
[gofferje_sip](http://iplists.firehol.org/?ipset=gofferje_sip)|[Stefan Gofferje](http://stefan.gofferje.net/it-stuff/sipfraud/sip-attacker-blacklist) A personal blacklist of networks and IPs of SIP attackers. To end up here, the IP or network must have been the origin of considerable and repeated attacks on my PBX and additionally, the ISP didn't react to any complaint. Note from the author: I don't give any guarantees of accuracy, completeness or even usability! USE AT YOUR OWN RISK! Also note that I block complete countries, namely China, Korea and Palestine with blocklists from ipdeny.com, so some attackers will never even get the chance to get noticed by me to be put on this blacklist. I also don't accept any liabilities related to this blocklist. If you're an ISP and don't like your IPs being listed here, too bad! You should have done something about your customers' behavior and reacted to my complaints. This blocklist is nothing but an expression of my personal opinion and exercising my right of free speech.|ipv4 hash:net|3771 subnets, 1097808 unique IPs|updated every 6 hours from [this link](http://stefan.gofferje.net/sipblocklist.zone)
[gpf_comics](http://iplists.firehol.org/?ipset=gpf_comics)|The GPF DNS Block List is a list of IP addresses on the Internet that have attacked the [GPF Comics](http://www.gpf-comics.com/) family of Web sites. IPs on this block list have been banned from accessing all of our servers because they were caught in the act of spamming, attempting to exploit our scripts, scanning for vulnerabilities, or consuming resources to the detriment of our human visitors.|ipv4 hash:ip|3280 unique IPs|updated every 1 day from [this link](https://www.gpf-comics.com/dnsbl/export.php)
[graphiclineweb](http://iplists.firehol.org/?ipset=graphiclineweb)|[GraphiclineWeb](https://graphiclineweb.wordpress.com/tech-notes/ip-blacklist/) The IP’s, Hosts and Domains listed in this table are banned universally from accessing websites controlled by the maintainer. Some form of bad activity has been seen from the addresses listed. Bad activity includes: unwanted spiders, rule breakers, comment spammers, trackback spammers, spambots, hacker bots, registration bots and other scripting attackers, harvesters, nuisance spiders, spy bots and organizations spying on websites for commercial reasons.|ipv4 hash:net|2579 subnets, 330527 unique IPs|updated every 1 day from [this link](https://graphiclineweb.wordpress.com/tech-notes/ip-blacklist/)
[greensnow](http://iplists.firehol.org/?ipset=greensnow)|[GreenSnow](https://greensnow.co/) is a team harvesting a large number of IPs from different computers located around the world. GreenSnow is comparable with SpamHaus.org for attacks of any kind except for spam. Their list is updated automatically and you can withdraw at any time your IP address if it has been listed. Attacks / bruteforce that are monitored are: Scan Port, FTP, POP3, mod_security, IMAP, SMTP, SSH, cPanel, etc.|ipv4 hash:ip|5142 unique IPs|updated every 30 mins from [this link](http://blocklist.greensnow.co/greensnow.txt)
[haley_ssh](http://iplists.firehol.org/?ipset=haley_ssh)|[Charles Haley](http://charles.the-haleys.org) IPs launching SSH dictionary attacks.|ipv4 hash:ip|58628 unique IPs|updated every 4 hours from [this link](http://charles.the-haleys.org/ssh_dico_attack_hdeny_format.php/hostsdeny.txt)
[hphosts_ats](http://iplists.firehol.org/?ipset=hphosts_ats)|[hpHosts](http://hosts-file.net/?s=Download) ad/tracking servers listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|13037 unique IPs|updated every 1 day from [this link](http://hosts-file.net/ad_servers.txt)
[hphosts_emd](http://iplists.firehol.org/?ipset=hphosts_emd)|[hpHosts](http://hosts-file.net/?s=Download) malware sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|59204 unique IPs|updated every 1 day from [this link](http://hosts-file.net/emd.txt)
[hphosts_exp](http://iplists.firehol.org/?ipset=hphosts_exp)|[hpHosts](http://hosts-file.net/?s=Download) exploit sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|196 unique IPs|updated every 1 day from [this link](http://hosts-file.net/exp.txt)
[hphosts_fsa](http://iplists.firehol.org/?ipset=hphosts_fsa)|[hpHosts](http://hosts-file.net/?s=Download) fraud sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|24764 unique IPs|updated every 1 day from [this link](http://hosts-file.net/fsa.txt)
[hphosts_grm](http://iplists.firehol.org/?ipset=hphosts_grm)|[hpHosts](http://hosts-file.net/?s=Download) sites involved in spam (that do not otherwise meet any other classification criteria) listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|293 unique IPs|updated every 1 day from [this link](http://hosts-file.net/grm.txt)
[hphosts_hfs](http://iplists.firehol.org/?ipset=hphosts_hfs)|[hpHosts](http://hosts-file.net/?s=Download) sites spamming the hpHosts forums (and not meeting any other classification criteria) listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|245 unique IPs|updated every 1 day from [this link](http://hosts-file.net/hfs.txt)
[hphosts_hjk](http://iplists.firehol.org/?ipset=hphosts_hjk)|[hpHosts](http://hosts-file.net/?s=Download) hijack sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|152 unique IPs|updated every 1 day from [this link](http://hosts-file.net/hjk.txt)
[hphosts_mmt](http://iplists.firehol.org/?ipset=hphosts_mmt)|[hpHosts](http://hosts-file.net/?s=Download) sites involved in misleading marketing (e.g. fake Flash update adverts) listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|960 unique IPs|updated every 1 day from [this link](http://hosts-file.net/mmt.txt)
[hphosts_pha](http://iplists.firehol.org/?ipset=hphosts_pha)|[hpHosts](http://hosts-file.net/?s=Download) illegal pharmacy sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|2474 unique IPs|updated every 1 day from [this link](http://hosts-file.net/pha.txt)
[hphosts_psh](http://iplists.firehol.org/?ipset=hphosts_psh)|[hpHosts](http://hosts-file.net/?s=Download) phishing sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|44781 unique IPs|updated every 1 day from [this link](http://hosts-file.net/psh.txt)
[hphosts_wrz](http://iplists.firehol.org/?ipset=hphosts_wrz)|[hpHosts](http://hosts-file.net/?s=Download) warez/piracy sites listed in the hpHosts database. The maintainer's file contains hostnames, which have been DNS resolved to IP addresses.|ipv4 hash:ip|905 unique IPs|updated every 1 day from [this link](http://hosts-file.net/wrz.txt)
[iblocklist_abuse_palevo](http://iplists.firehol.org/?ipset=iblocklist_abuse_palevo)|palevotracker.abuse.ch IP blocklist.|ipv4 hash:net|12 subnets, 12 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=erqajhwrxiuvjxqrrwfj&fileformat=p2p&archiveformat=gz)
[iblocklist_abuse_spyeye](http://iplists.firehol.org/?ipset=iblocklist_abuse_spyeye)|spyeyetracker.abuse.ch IP blocklist.|ipv4 hash:net|83 subnets, 84 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=zvjxsfuvdhoxktpeiokq&fileformat=p2p&archiveformat=gz)
[iblocklist_abuse_zeus](http://iplists.firehol.org/?ipset=iblocklist_abuse_zeus)|zeustracker.abuse.ch IP blocklist that contains IP addresses which are currently beeing tracked on the abuse.ch ZeuS Tracker.|ipv4 hash:net|209 subnets, 212 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=ynkdjqsjyfmilsgbogqf&fileformat=p2p&archiveformat=gz)
[iblocklist_ads](http://iplists.firehol.org/?ipset=iblocklist_ads)|Advertising trackers and a short list of bad/intrusive porn sites.|ipv4 hash:net|3387 subnets, 888874 unique IPs|updated every 12 hours
[iblocklist_badpeers](http://iplists.firehol.org/?ipset=iblocklist_badpeers)|IPs that have been reported for bad deeds in p2p.|ipv4 hash:net|48578 subnets, 1569289 unique IPs|updated every 12 hours
[iblocklist_bogons](http://iplists.firehol.org/?ipset=iblocklist_bogons)|Unallocated address space.|ipv4 hash:net|2691 subnets, 643576487 unique IPs|updated every 12 hours
[iblocklist_ciarmy_malicious](http://iplists.firehol.org/?ipset=iblocklist_ciarmy_malicious)|ciarmy.com IP blocklist. Based on information from a network of Sentinel devices deployed around the world, they compile a list of known bad IP addresses. Sentinel devices are uniquely positioned to pick up traffic from bad guys without requiring any type of signature-based or rate-based identification. If an IP is identified in this way by a significant number of Sentinels, the IP is malicious and should be blocked.|ipv4 hash:net|14148 subnets, 15000 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=npkuuhuxcsllnhoamkvm&fileformat=p2p&archiveformat=gz)
[iblocklist_cidr_report_bogons](http://iplists.firehol.org/?ipset=iblocklist_cidr_report_bogons)|cidr-report.org IP list of Unallocated address space.|ipv4 hash:net|6201 subnets, 606069336 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=lujdnbasfaaixitgmxpp&fileformat=p2p&archiveformat=gz)
[iblocklist_cruzit_web_attacks](http://iplists.firehol.org/?ipset=iblocklist_cruzit_web_attacks)|CruzIT IP list with individual IP addresses of compromised machines scanning for vulnerabilities and DDOS attacks.|ipv4 hash:net|11679 subnets, 11913 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=czvaehmjpsnwwttrdoyl&fileformat=p2p&archiveformat=gz)
[iblocklist_dshield](http://iplists.firehol.org/?ipset=iblocklist_dshield)|known Hackers and such people.|ipv4 hash:net|16 subnets, 2566 unique IPs|updated every 12 hours
[iblocklist_edu](http://iplists.firehol.org/?ipset=iblocklist_edu)|IPs used by Educational Institutions.|ipv4 hash:net|43902 subnets, 227994804 unique IPs|updated every 12 hours
[iblocklist_exclusions](http://iplists.firehol.org/?ipset=iblocklist_exclusions)|Exclusions.|ipv4 hash:net|313 subnets, 7488 unique IPs|updated every 12 hours
[iblocklist_fornonlancomputers](http://iplists.firehol.org/?ipset=iblocklist_fornonlancomputers)|IP blocklist for non-LAN computers.|ipv4 hash:net|4 subnets, 302055424 unique IPs|updated every 12 hours
[iblocklist_forumspam](http://iplists.firehol.org/?ipset=iblocklist_forumspam)|Forum spam.|ipv4 hash:net|455 subnets, 479 unique IPs|updated every 12 hours
[iblocklist_hijacked](http://iplists.firehol.org/?ipset=iblocklist_hijacked)|Hijacked IP-Blocks. Contains hijacked IP-Blocks and known IP-Blocks that are used to deliver Spam. This list is a combination of lists with hijacked IP-Blocks. Hijacked IP space are IP blocks that are being used without permission by organizations that have no relation to original organization (or its legal successor) that received the IP block. In essence it's stealing of somebody else's IP resources.|ipv4 hash:net|513 subnets, 8802048 unique IPs|updated every 12 hours
[iblocklist_iana_multicast](http://iplists.firehol.org/?ipset=iblocklist_iana_multicast)|IANA Multicast IPs.|ipv4 hash:net|1 subnets, 268435456 unique IPs|updated every 12 hours
[iblocklist_iana_private](http://iplists.firehol.org/?ipset=iblocklist_iana_private)|IANA Private IPs.|ipv4 hash:net|58 subnets, 51643646 unique IPs|updated every 12 hours
[iblocklist_iana_reserved](http://iplists.firehol.org/?ipset=iblocklist_iana_reserved)|IANA Reserved IPs.|ipv4 hash:net|1 subnets, 536870912 unique IPs|updated every 12 hours
[iblocklist_isp_aol](http://iplists.firehol.org/?ipset=iblocklist_isp_aol)|AOL IPs.|ipv4 hash:net|16 subnets, 6627584 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=toboaiysofkflwgrttmb&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_att](http://iplists.firehol.org/?ipset=iblocklist_isp_att)|AT&T IPs.|ipv4 hash:net|35 subnets, 55845128 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=grbtkzijgrowvobvessf&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_cablevision](http://iplists.firehol.org/?ipset=iblocklist_isp_cablevision)|Cablevision IPs.|ipv4 hash:net|11 subnets, 1787136 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=dwwbsmzirrykdlvpqozb&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_charter](http://iplists.firehol.org/?ipset=iblocklist_isp_charter)|Charter IPs.|ipv4 hash:net|21 subnets, 6138112 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=htnzojgossawhpkbulqw&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_comcast](http://iplists.firehol.org/?ipset=iblocklist_isp_comcast)|Comcast IPs.|ipv4 hash:net|33 subnets, 45121536 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=rsgyxvuklicibautguia&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_embarq](http://iplists.firehol.org/?ipset=iblocklist_isp_embarq)|Embarq IPs.|ipv4 hash:net|14 subnets, 2703360 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=twdblifaysaqtypevvdp&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_qwest](http://iplists.firehol.org/?ipset=iblocklist_isp_qwest)|Qwest IPs.|ipv4 hash:net|73 subnets, 15777552 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=jezlifrpefawuoawnfez&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_sprint](http://iplists.firehol.org/?ipset=iblocklist_isp_sprint)|Sprint IPs.|ipv4 hash:net|73 subnets, 6310570 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=hngtqrhhuadlceqxbrob&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_suddenlink](http://iplists.firehol.org/?ipset=iblocklist_isp_suddenlink)|Suddenlink IPs.|ipv4 hash:net|3 subnets, 458752 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=psaoblrwylfrdsspfuiq&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_twc](http://iplists.firehol.org/?ipset=iblocklist_isp_twc)|Time Warner Cable IPs.|ipv4 hash:net|56 subnets, 15015936 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=aqtsnttnqmcucwrjmohd&fileformat=p2p&archiveformat=gz)
[iblocklist_isp_verizon](http://iplists.firehol.org/?ipset=iblocklist_isp_verizon)|Verizon IPs.|ipv4 hash:net|22 subnets, 18087936 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=cdmdbprvldivlqsaqjol&fileformat=p2p&archiveformat=gz)
[iblocklist_level1](http://iplists.firehol.org/?ipset=iblocklist_level1)|Level 1 (for use in p2p): Companies or organizations who are clearly involved with trying to stop filesharing (e.g. Baytsp, MediaDefender, Mediasentry). Companies which anti-p2p activity has been seen from. Companies that produce or have a strong financial interest in copyrighted material (e.g. music, movie, software industries a.o.). Government ranges or companies that have a strong financial interest in doing work for governments. Legal industry ranges. IPs or ranges of ISPs from which anti-p2p activity has been observed. Basically this list will block all kinds of internet connections that most people would rather not have during their internet travels.|ipv4 hash:net|236297 subnets, 723112250 unique IPs|updated every 12 hours
[iblocklist_level2](http://iplists.firehol.org/?ipset=iblocklist_level2)|Level 2 (for use in p2p). General corporate ranges. Ranges used by labs or researchers. Proxies.|ipv4 hash:net|78374 subnets, 338108451 unique IPs|updated every 12 hours
[iblocklist_level3](http://iplists.firehol.org/?ipset=iblocklist_level3)|Level 3 (for use in p2p). Many portal-type websites. ISP ranges that may be dodgy for some reason. Ranges that belong to an individual, but which have not been determined to be used by a particular company. Ranges for things that are unusual in some way. The L3 list is aka the paranoid list.|ipv4 hash:net|18864 subnets, 137259943 unique IPs|updated every 12 hours
[iblocklist_malc0de](http://iplists.firehol.org/?ipset=iblocklist_malc0de)|malc0de.com IP blocklist. Addresses that have been identified distributing malware during the past 30 days.|ipv4 hash:net|21 subnets, 21 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=pbqcylkejciyhmwttify&fileformat=p2p&archiveformat=gz)
[iblocklist_onion_router](http://iplists.firehol.org/?ipset=iblocklist_onion_router)|The Onion Router IP addresses.|ipv4 hash:net|5586 subnets, 5791 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=togdoptykrlolpddwbvz&fileformat=p2p&archiveformat=gz)
[iblocklist_org_activision](http://iplists.firehol.org/?ipset=iblocklist_org_activision)|Activision IPs.|ipv4 hash:net|49 subnets, 4902 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=gfnxlhxsijzrcuxwzebb&fileformat=p2p&archiveformat=gz)
[iblocklist_org_apple](http://iplists.firehol.org/?ipset=iblocklist_org_apple)|Apple IPs.|ipv4 hash:net|1 subnets, 16777216 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=aphcqvpxuqgrkgufjruj&fileformat=p2p&archiveformat=gz)
[iblocklist_org_blizzard](http://iplists.firehol.org/?ipset=iblocklist_org_blizzard)|Blizzard IPs.|ipv4 hash:net|8 subnets, 16795139 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=ercbntshuthyykfkmhxc&fileformat=p2p&archiveformat=gz)
[iblocklist_org_crowd_control](http://iplists.firehol.org/?ipset=iblocklist_org_crowd_control)|Crowd Control Productions IPs.|ipv4 hash:net|2 subnets, 768 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=eveiyhgmusglurfmjyag&fileformat=p2p&archiveformat=gz)
[iblocklist_org_electronic_arts](http://iplists.firehol.org/?ipset=iblocklist_org_electronic_arts)|Electronic Arts IPs.|ipv4 hash:net|42 subnets, 69720 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=ejqebpcdmffinaetsvxj&fileformat=p2p&archiveformat=gz)
[iblocklist_org_joost](http://iplists.firehol.org/?ipset=iblocklist_org_joost)|Joost IPs.|ipv4 hash:net|4 subnets, 16779456 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=alxugfmeszbhpxqfdits&fileformat=p2p&archiveformat=gz)
[iblocklist_org_linden_lab](http://iplists.firehol.org/?ipset=iblocklist_org_linden_lab)|Linden Lab IPs.|ipv4 hash:net|11 subnets, 23600 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=qnjdimxnaupjmpqolxcv&fileformat=p2p&archiveformat=gz)
[iblocklist_org_logmein](http://iplists.firehol.org/?ipset=iblocklist_org_logmein)|LogMeIn IPs.|ipv4 hash:net|13 subnets, 16781568 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=tgbankumtwtrzllndbmb&fileformat=p2p&archiveformat=gz)
[iblocklist_org_microsoft](http://iplists.firehol.org/?ipset=iblocklist_org_microsoft)|Microsoft IP ranges.|ipv4 hash:net|901 subnets, 1848599 unique IPs|updated every 12 hours
[iblocklist_org_ncsoft](http://iplists.firehol.org/?ipset=iblocklist_org_ncsoft)|NCsoft IPs.|ipv4 hash:net|5 subnets, 12560 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=mwjuwmebrnzyyxpbezxu&fileformat=p2p&archiveformat=gz)
[iblocklist_org_nintendo](http://iplists.firehol.org/?ipset=iblocklist_org_nintendo)|Nintendo IPs.|ipv4 hash:net|45 subnets, 3927 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=pevkykuhgaegqyayzbnr&fileformat=p2p&archiveformat=gz)
[iblocklist_org_pandora](http://iplists.firehol.org/?ipset=iblocklist_org_pandora)|Pandora IPs.|ipv4 hash:net|1 subnets, 2048 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=aevzidimyvwybzkletsg&fileformat=p2p&archiveformat=gz)
[iblocklist_org_pirate_bay](http://iplists.firehol.org/?ipset=iblocklist_org_pirate_bay)|The Pirate Bay IPs.|ipv4 hash:net|5 subnets, 323 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=nzldzlpkgrcncdomnttb&fileformat=p2p&archiveformat=gz)
[iblocklist_org_punkbuster](http://iplists.firehol.org/?ipset=iblocklist_org_punkbuster)|Punkbuster IPs.|ipv4 hash:net|1 subnets, 1 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=zvwwndvzulqcltsicwdg&fileformat=p2p&archiveformat=gz)
[iblocklist_org_riot_games](http://iplists.firehol.org/?ipset=iblocklist_org_riot_games)|Riot Games IPs.|ipv4 hash:net|6 subnets, 1792 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=sdlvfabdjvrdttfjotcy&fileformat=p2p&archiveformat=gz)
[iblocklist_org_sony_online](http://iplists.firehol.org/?ipset=iblocklist_org_sony_online)|Sony Online Entertainment IPs.|ipv4 hash:net|7 subnets, 24616 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=tukpvrvlubsputmkmiwg&fileformat=p2p&archiveformat=gz)
[iblocklist_org_square_enix](http://iplists.firehol.org/?ipset=iblocklist_org_square_enix)|Square Enix IPs.|ipv4 hash:net|2 subnets, 4112 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=odyaqontcydnodrlyina&fileformat=p2p&archiveformat=gz)
[iblocklist_org_steam](http://iplists.firehol.org/?ipset=iblocklist_org_steam)|Steam IPs.|ipv4 hash:net|53 subnets, 596448 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=cnxkgiklecdaihzukrud&fileformat=p2p&archiveformat=gz)
[iblocklist_org_ubisoft](http://iplists.firehol.org/?ipset=iblocklist_org_ubisoft)|Ubisoft IPs.|ipv4 hash:net|10 subnets, 5308 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=etmcrglomupyxtaebzht&fileformat=p2p&archiveformat=gz)
[iblocklist_org_xfire](http://iplists.firehol.org/?ipset=iblocklist_org_xfire)|XFire IPs.|ipv4 hash:net|3 subnets, 3328 unique IPs|updated every 1 day from [this link](http://list.iblocklist.com/?list=ppqqnyihmcrryraaqsjo&fileformat=p2p&archiveformat=gz)
[iblocklist_pedophiles](http://iplists.firehol.org/?ipset=iblocklist_pedophiles)|IP ranges of people who we have found to be sharing child pornography in the p2p community.|ipv4 hash:net|29188 subnets, 847889 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=dufcxgnbjsdwmwctgfuj&fileformat=p2p&archiveformat=gz)
[iblocklist_proxies](http://iplists.firehol.org/?ipset=iblocklist_proxies)|Open Proxies IPs list (without TOR)|ipv4 hash:ip|672 unique IPs|updated every 12 hours
[iblocklist_rangetest](http://iplists.firehol.org/?ipset=iblocklist_rangetest)|Suspicious IPs that are under investigation.|ipv4 hash:net|576 subnets, 4280758 unique IPs|updated every 12 hours
[iblocklist_spamhaus_drop](http://iplists.firehol.org/?ipset=iblocklist_spamhaus_drop)|Spamhaus.org DROP (Don't Route Or Peer) list.|ipv4 hash:net|933 subnets, 19793664 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=zbdlwrqkabxbcppvrnos&fileformat=p2p&archiveformat=gz)
[iblocklist_spider](http://iplists.firehol.org/?ipset=iblocklist_spider)|IP list intended to be used by webmasters to block hostile spiders from their web sites.|ipv4 hash:net|773 subnets, 846788 unique IPs|updated every 12 hours
[iblocklist_spyware](http://iplists.firehol.org/?ipset=iblocklist_spyware)|Known malicious SPYWARE and ADWARE IP Address ranges. It is compiled from various sources, including other available spyware blacklists, HOSTS files, from research found at many of the top anti-spyware forums, logs of spyware victims, etc.|ipv4 hash:net|3347 subnets, 334989 unique IPs|updated every 12 hours
[iblocklist_webexploit](http://iplists.firehol.org/?ipset=iblocklist_webexploit)|Web server hack and exploit attempts. IP addresses related to current web server hack and exploit attempts that have been logged or can be found in and cross referenced with other related IP databases. Malicious and other non search engine bots will also be listed here, along with anything found that can have a negative impact on a website or webserver such as proxies being used for negative SEO hijacks, unauthorised site mirroring, harvesting, scraping, snooping and data mining / spy bot / security & copyright enforcement companies that target and continuosly scan webservers.|ipv4 hash:ip|15382 unique IPs|updated every 12 hours
[iblocklist_yoyo_adservers](http://iplists.firehol.org/?ipset=iblocklist_yoyo_adservers)|pgl.yoyo.org ad servers|ipv4 hash:net|8803 subnets, 10355 unique IPs|updated every 12 hours from [this link](http://list.iblocklist.com/?list=zhogegszwduurnvsyhdf&fileformat=p2p&archiveformat=gz)
[ip2location_country](https://github.com/ktsaou/blocklist-ipsets/tree/master/ip2location_country)|[IP2Location.com](http://lite.ip2location.com/database-ip-country) geolocation database|ipv4 hash:net|All the world|updated every 1 day from [this link](http://download.ip2location.com/lite/IP2LOCATION-LITE-DB1.CSV.ZIP)
[ip2location_country_eh](http://iplists.firehol.org/?ipset=ip2location_country_eh)|Western Sahara (EH) -- [IP2Location.com](http://lite.ip2location.com/database-ip-country)|ipv4 hash:net|1 subnets, 256 unique IPs|updated every 1 day from [this link](http://download.ip2location.com/lite/IP2LOCATION-LITE-DB1.CSV.ZIP)
[ip2proxy_px1lite](http://iplists.firehol.org/?ipset=ip2proxy_px1lite)|[IP2Location.com](https://lite.ip2location.com/database/px1-ip-country) IP2Proxy LITE IP-COUNTRY Database contains IP addresses which are used as public proxies. The LITE edition is a free version of database that is limited to public proxies IP address.|ipv4 hash:net|1647429 subnets, 1673524 unique IPs|updated every 1 day
[ipblacklistcloud_recent](http://iplists.firehol.org/?ipset=ipblacklistcloud_recent)|[IP Blacklist Cloud](http://www.ip-finder.me/) These are the most recent IP addresses that have been blacklisted by websites. IP Blacklist Cloud plugin protects your WordPress based website from spam comments, gives details about login attacks which you don't even know are happening without this plugin!|ipv4 hash:ip|32 unique IPs|updated every 4 hours from [this link](http://www.ip-finder.me/download/)
[ipblacklistcloud_recent_1d](http://iplists.firehol.org/?ipset=ipblacklistcloud_recent_1d)|[IP Blacklist Cloud](http://www.ip-finder.me/) These are the most recent IP addresses that have been blacklisted by websites. IP Blacklist Cloud plugin protects your WordPress based website from spam comments, gives details about login attacks which you don't even know are happening without this plugin!|ipv4 hash:ip|32 unique IPs|updated every 4 hours from [this link](http://www.ip-finder.me/download/)
[ipblacklistcloud_recent_30d](http://iplists.firehol.org/?ipset=ipblacklistcloud_recent_30d)|[IP Blacklist Cloud](http://www.ip-finder.me/) These are the most recent IP addresses that have been blacklisted by websites. IP Blacklist Cloud plugin protects your WordPress based website from spam comments, gives details about login attacks which you don't even know are happening without this plugin!|ipv4 hash:ip|196 unique IPs|updated every 4 hours from [this link](http://www.ip-finder.me/download/)
[ipblacklistcloud_recent_7d](http://iplists.firehol.org/?ipset=ipblacklistcloud_recent_7d)|[IP Blacklist Cloud](http://www.ip-finder.me/) These are the most recent IP addresses that have been blacklisted by websites. IP Blacklist Cloud plugin protects your WordPress based website from spam comments, gives details about login attacks which you don't even know are happening without this plugin!|ipv4 hash:ip|64 unique IPs|updated every 4 hours from [this link](http://www.ip-finder.me/download/)
[ipblacklistcloud_top](http://iplists.firehol.org/?ipset=ipblacklistcloud_top)|[IP Blacklist Cloud](http://www.ip-finder.me/) These are the top IP addresses that have been blacklisted by many websites. IP Blacklist Cloud plugin protects your WordPress based website from spam comments, gives details about login attacks which you don't even know are happening without this plugin!|ipv4 hash:ip|200 unique IPs|updated every 1 day from [this link](http://www.ip-finder.me/ip-full-list/)
[ipdeny_country](https://github.com/firehol/blocklist-ipsets/tree/master/ipdeny_country)|[IPDeny.com](http://www.ipdeny.com/) geolocation database|ipv4 hash:net|All the world|updated every 1 day from [this link](http://www.ipdeny.com/ipblocks/data/countries/all-zones.tar.gz)
[iw_spamlist](http://iplists.firehol.org/?ipset=iw_spamlist)|[ImproWare Antispam](http://antispam.imp.ch/) IPs sending spam, in the last 3 days|ipv4 hash:ip|0 unique IPs|updated every 1 hour from [this link](http://antispam.imp.ch/spamlist)
[iw_wormlist](http://iplists.firehol.org/?ipset=iw_wormlist)|[ImproWare Antispam](http://antispam.imp.ch/) IPs sending emails with viruses or worms, in the last 3 days|ipv4 hash:ip|0 unique IPs|updated every 1 hour from [this link](http://antispam.imp.ch/wormlist)
[lashback_ubl](http://iplists.firehol.org/?ipset=lashback_ubl)|[The LashBack UBL](http://blacklist.lashback.com/) The Unsubscribe Blacklist (UBL) is a real-time blacklist of IP addresses which are sending email to names harvested from suppression files (this is a big list, more than 500.000 IPs)|ipv4 hash:ip|37994 unique IPs|updated every 1 day from [this link](http://www.unsubscore.com/blacklist.txt)
[malc0de](http://iplists.firehol.org/?ipset=malc0de)|[Malc0de.com](http://malc0de.com) malicious IPs of the last 30 days|ipv4 hash:ip|21 unique IPs|updated every 1 day from [this link](http://malc0de.com/bl/IP_Blacklist.txt)
[malwaredomainlist](http://iplists.firehol.org/?ipset=malwaredomainlist)|[malwaredomainlist.com](http://www.malwaredomainlist.com) list of malware active ip addresses|ipv4 hash:ip|996 unique IPs|updated every 12 hours from [this link](http://www.malwaredomainlist.com/hostslist/ip.txt)
[maxmind_proxy_fraud](http://iplists.firehol.org/?ipset=maxmind_proxy_fraud)|[MaxMind.com](https://www.maxmind.com/en/high-risk-ip-sample-list) sample list of high-risk IP addresses.|ipv4 hash:ip|583 unique IPs|updated every 4 hours from [this link](https://www.maxmind.com/en/high-risk-ip-sample-list)
[myip](http://iplists.firehol.org/?ipset=myip)|[myip.ms](http://www.myip.ms/info/about) IPs identified as web bots in the last 10 days, using several sites that require human action|ipv4 hash:ip|506 unique IPs|updated every 1 day from [this link](http://www.myip.ms/files/blacklist/csf/latest_blacklist.txt)
[nixspam](http://iplists.firehol.org/?ipset=nixspam)|[NiX Spam](http://www.heise.de/ix/NiX-Spam-DNSBL-and-blacklist-for-download-499637.html) IP addresses that sent spam in the last hour - automatically generated entries without distinguishing open proxies from relays, dialup gateways, and so on. All IPs are removed after 12 hours if there is no spam from there.|ipv4 hash:ip|2082 unique IPs|updated every 15 mins from [this link](http://www.dnsbl.manitu.net/download/nixspam-ip.dump.gz)
[normshield_all_attack](http://iplists.firehol.org/?ipset=normshield_all_attack)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category attack with severity all|ipv4 hash:ip|549 unique IPs|updated every 12 hours
[normshield_all_bruteforce](http://iplists.firehol.org/?ipset=normshield_all_bruteforce)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category bruteforce with severity all|ipv4 hash:ip|196 unique IPs|updated every 12 hours
[normshield_all_ddosbot](http://iplists.firehol.org/?ipset=normshield_all_ddosbot)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category ddosbot with severity all|ipv4 hash:ip|1 unique IPs|updated every 12 hours
[normshield_all_dnsscan](http://iplists.firehol.org/?ipset=normshield_all_dnsscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category dnsscan with severity all|ipv4 hash:ip|1 unique IPs|updated every 12 hours
[normshield_all_spam](http://iplists.firehol.org/?ipset=normshield_all_spam)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category spam with severity all|ipv4 hash:ip|17 unique IPs|updated every 12 hours
[normshield_all_suspicious](http://iplists.firehol.org/?ipset=normshield_all_suspicious)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category suspicious with severity all|ipv4 hash:ip|11 unique IPs|updated every 12 hours
[normshield_all_wannacry](http://iplists.firehol.org/?ipset=normshield_all_wannacry)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category wannacry with severity all|ipv4 hash:ip|1165 unique IPs|updated every 12 hours
[normshield_all_webscan](http://iplists.firehol.org/?ipset=normshield_all_webscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category webscan with severity all|ipv4 hash:ip|46 unique IPs|updated every 12 hours
[normshield_all_wormscan](http://iplists.firehol.org/?ipset=normshield_all_wormscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category wormscan with severity all|ipv4 hash:ip|28 unique IPs|updated every 12 hours
[normshield_high_attack](http://iplists.firehol.org/?ipset=normshield_high_attack)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category attack with severity high|ipv4 hash:ip|549 unique IPs|updated every 12 hours
[normshield_high_bruteforce](http://iplists.firehol.org/?ipset=normshield_high_bruteforce)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category bruteforce with severity high|ipv4 hash:ip|196 unique IPs|updated every 12 hours
[normshield_high_ddosbot](http://iplists.firehol.org/?ipset=normshield_high_ddosbot)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category ddosbot with severity high|ipv4 hash:ip|1 unique IPs|updated every 12 hours
[normshield_high_dnsscan](http://iplists.firehol.org/?ipset=normshield_high_dnsscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category dnsscan with severity high|ipv4 hash:ip|1 unique IPs|updated every 12 hours
[normshield_high_spam](http://iplists.firehol.org/?ipset=normshield_high_spam)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category spam with severity high|ipv4 hash:ip|17 unique IPs|updated every 12 hours
[normshield_high_suspicious](http://iplists.firehol.org/?ipset=normshield_high_suspicious)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category suspicious with severity high|ipv4 hash:ip|11 unique IPs|updated every 12 hours
[normshield_high_wannacry](http://iplists.firehol.org/?ipset=normshield_high_wannacry)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category wannacry with severity high|ipv4 hash:ip|1165 unique IPs|updated every 12 hours
[normshield_high_webscan](http://iplists.firehol.org/?ipset=normshield_high_webscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category webscan with severity high|ipv4 hash:ip|46 unique IPs|updated every 12 hours
[normshield_high_wormscan](http://iplists.firehol.org/?ipset=normshield_high_wormscan)|[NormShield.com](https://services.normshield.com/threatfeed) IPs in category wormscan with severity high|ipv4 hash:ip|28 unique IPs|updated every 12 hours
[nt_malware_dns](http://iplists.firehol.org/?ipset=nt_malware_dns)|[No Think](http://www.nothink.org/) Malware DNS (the original list includes hostnames and domains, which are ignored)|ipv4 hash:ip|235 unique IPs|updated every 1 hour from [this link](http://www.nothink.org/blacklist/blacklist_malware_dns.txt)
[nt_malware_http](http://iplists.firehol.org/?ipset=nt_malware_http)|[No Think](http://www.nothink.org/) Malware HTTP|ipv4 hash:ip|69 unique IPs|updated every 1 hour from [this link](http://www.nothink.org/blacklist/blacklist_malware_http.txt)
[nt_malware_irc](http://iplists.firehol.org/?ipset=nt_malware_irc)|[No Think](http://www.nothink.org/) Malware IRC|ipv4 hash:ip|42 unique IPs|updated every 1 hour from [this link](http://www.nothink.org/blacklist/blacklist_malware_irc.txt)
[nt_ssh_7d](http://iplists.firehol.org/?ipset=nt_ssh_7d)|[NoThink](http://www.nothink.org/) Last 7 days SSH attacks|ipv4 hash:ip|169 unique IPs|updated every 1 hour from [this link](http://www.nothink.org/blacklist/blacklist_ssh_week.txt)
[nullsecure](http://iplists.firehol.org/?ipset=nullsecure)|[nullsecure.org](http://nullsecure.org/) This is a free threat feed provided for use in any acceptable manner. This feed was aggregated using the [Tango Honeypot Intelligence Splunk App](https://github.com/aplura/Tango) by Brian Warehime, a Senior Security Analyst at Defense Point Security.|ipv4 hash:ip|29439 unique IPs|updated every 8 hours from [this link](http://nullsecure.org/threatfeed/master.txt)
[packetmail](http://iplists.firehol.org/?ipset=packetmail)|[PacketMail.net](https://www.packetmail.net/) IP addresses that have been detected performing TCP SYN to 206.82.85.196/30 to a non-listening service or daemon. No assertion is made, nor implied, that any of the below listed IP addresses are accurate, malicious, hostile, or engaged in nefarious acts. Use this list at your own risk.|ipv4 hash:ip|3986 unique IPs|updated every 4 hours from [this link](https://www.packetmail.net/iprep.txt)
[packetmail_emerging_ips](http://iplists.firehol.org/?ipset=packetmail_emerging_ips)|[PacketMail.net](https://www.packetmail.net/) IP addresses that have been detected as potentially of interest based on the number of unique users of the packetmail IP Reputation system. No assertion is made, nor implied, that any of the below listed IP addresses are accurate, malicious, hostile, or engaged in nefarious acts. Use this list at your own risk.|ipv4 hash:ip|26 unique IPs|updated every 4 hours from [this link](https://www.packetmail.net/iprep_emerging_ips.txt)
[packetmail_mail](http://iplists.firehol.org/?ipset=packetmail_mail)|[PacketMail.net](https://www.packetmail.net/) IP addresses that have been detected performing behavior not in compliance with the requirements this system enforces for email acceptance. No assertion is made, nor implied, that any of the below listed IP addresses are accurate, malicious, hostile, or engaged in nefarious acts. Use this list at your own risk.|ipv4 hash:ip|73 unique IPs|updated every 4 hours from [this link](https://www.packetmail.net/iprep_mail.txt)
[packetmail_ramnode](http://iplists.firehol.org/?ipset=packetmail_ramnode)|[PacketMail.net](https://www.packetmail.net/) IP addresses that have been detected performing TCP SYN to 81.4.103.251 to a non-listening service or daemon. No assertion is made, nor implied, that any of the below listed IP addresses are accurate, malicious, hostile, or engaged in nefarious acts. Use this list at your own risk.|ipv4 hash:ip|2502 unique IPs|updated every 4 hours from [this link](https://www.packetmail.net/iprep_ramnode.txt)
php_bad|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) bad web hosts (this list is composed using an RSS feed)|ipv4 hash:ip|disabled|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=b&rss=1)
[php_commenters](http://iplists.firehol.org/?ipset=php_commenters)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) comment spammers (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=c&rss=1)
[php_commenters_1d](http://iplists.firehol.org/?ipset=php_commenters_1d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) comment spammers (this list is composed using an RSS feed)|ipv4 hash:ip|91 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=c&rss=1)
[php_commenters_30d](http://iplists.firehol.org/?ipset=php_commenters_30d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) comment spammers (this list is composed using an RSS feed)|ipv4 hash:ip|1137 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=c&rss=1)
[php_commenters_7d](http://iplists.firehol.org/?ipset=php_commenters_7d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) comment spammers (this list is composed using an RSS feed)|ipv4 hash:ip|284 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=c&rss=1)
[php_dictionary](http://iplists.firehol.org/?ipset=php_dictionary)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) directory attackers (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1)
[php_dictionary_1d](http://iplists.firehol.org/?ipset=php_dictionary_1d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) directory attackers (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1)
[php_dictionary_30d](http://iplists.firehol.org/?ipset=php_dictionary_30d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) directory attackers (this list is composed using an RSS feed)|ipv4 hash:ip|1053 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1)
[php_dictionary_7d](http://iplists.firehol.org/?ipset=php_dictionary_7d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) directory attackers (this list is composed using an RSS feed)|ipv4 hash:ip|272 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1)
[php_harvesters](http://iplists.firehol.org/?ipset=php_harvesters)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) harvesters (IPs that surf the internet looking for email addresses) (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=h&rss=1)
[php_harvesters_1d](http://iplists.firehol.org/?ipset=php_harvesters_1d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) harvesters (IPs that surf the internet looking for email addresses) (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=h&rss=1)
[php_harvesters_30d](http://iplists.firehol.org/?ipset=php_harvesters_30d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) harvesters (IPs that surf the internet looking for email addresses) (this list is composed using an RSS feed)|ipv4 hash:ip|454 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=h&rss=1)
[php_harvesters_7d](http://iplists.firehol.org/?ipset=php_harvesters_7d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) harvesters (IPs that surf the internet looking for email addresses) (this list is composed using an RSS feed)|ipv4 hash:ip|146 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=h&rss=1)
[php_spammers](http://iplists.firehol.org/?ipset=php_spammers)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) spam servers (IPs used by spammers to send messages) (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=s&rss=1)
[php_spammers_1d](http://iplists.firehol.org/?ipset=php_spammers_1d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) spam servers (IPs used by spammers to send messages) (this list is composed using an RSS feed)|ipv4 hash:ip|50 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=s&rss=1)
[php_spammers_30d](http://iplists.firehol.org/?ipset=php_spammers_30d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) spam servers (IPs used by spammers to send messages) (this list is composed using an RSS feed)|ipv4 hash:ip|1068 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=s&rss=1)
[php_spammers_7d](http://iplists.firehol.org/?ipset=php_spammers_7d)|[projecthoneypot.org](http://www.projecthoneypot.org/?rf=192670) spam servers (IPs used by spammers to send messages) (this list is composed using an RSS feed)|ipv4 hash:ip|283 unique IPs|updated every 1 hour from [this link](http://www.projecthoneypot.org/list_of_ips.php?t=s&rss=1)
[proxylists](http://iplists.firehol.org/?ipset=proxylists)|[proxylists.net](http://www.proxylists.net/) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|2668 unique IPs|updated every 1 hour from [this link](http://www.proxylists.net/proxylists.xml)
[proxylists_1d](http://iplists.firehol.org/?ipset=proxylists_1d)|[proxylists.net](http://www.proxylists.net/) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|5094 unique IPs|updated every 1 hour from [this link](http://www.proxylists.net/proxylists.xml)
[proxylists_30d](http://iplists.firehol.org/?ipset=proxylists_30d)|[proxylists.net](http://www.proxylists.net/) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|10138 unique IPs|updated every 1 hour from [this link](http://www.proxylists.net/proxylists.xml)
[proxylists_7d](http://iplists.firehol.org/?ipset=proxylists_7d)|[proxylists.net](http://www.proxylists.net/) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|8263 unique IPs|updated every 1 hour from [this link](http://www.proxylists.net/proxylists.xml)
[proxyrss](http://iplists.firehol.org/?ipset=proxyrss)|[proxyrss.com](http://www.proxyrss.com) open proxies syndicated from multiple sources.|ipv4 hash:ip|596 unique IPs|updated every 4 hours from [this link](http://www.proxyrss.com/proxylists/all.gz)
[proxyrss_1d](http://iplists.firehol.org/?ipset=proxyrss_1d)|[proxyrss.com](http://www.proxyrss.com) open proxies syndicated from multiple sources.|ipv4 hash:ip|1602 unique IPs|updated every 4 hours from [this link](http://www.proxyrss.com/proxylists/all.gz)
[proxyrss_30d](http://iplists.firehol.org/?ipset=proxyrss_30d)|[proxyrss.com](http://www.proxyrss.com) open proxies syndicated from multiple sources.|ipv4 hash:ip|4899 unique IPs|updated every 4 hours from [this link](http://www.proxyrss.com/proxylists/all.gz)
[proxyrss_7d](http://iplists.firehol.org/?ipset=proxyrss_7d)|[proxyrss.com](http://www.proxyrss.com) open proxies syndicated from multiple sources.|ipv4 hash:ip|3612 unique IPs|updated every 4 hours from [this link](http://www.proxyrss.com/proxylists/all.gz)
[proxyspy_1d](http://iplists.firehol.org/?ipset=proxyspy_1d)|[ProxySpy](http://spys.ru/en/) open proxies (updated hourly)|ipv4 hash:ip|300 unique IPs|updated every 1 hour from [this link](http://txt.proxyspy.net/proxy.txt)
[proxyspy_30d](http://iplists.firehol.org/?ipset=proxyspy_30d)|[ProxySpy](http://spys.ru/en/) open proxies (updated hourly)|ipv4 hash:ip|6720 unique IPs|updated every 1 hour from [this link](http://txt.proxyspy.net/proxy.txt)
[proxyspy_7d](http://iplists.firehol.org/?ipset=proxyspy_7d)|[ProxySpy](http://spys.ru/en/) open proxies (updated hourly)|ipv4 hash:ip|2828 unique IPs|updated every 1 hour from [this link](http://txt.proxyspy.net/proxy.txt)
[proxz](http://iplists.firehol.org/?ipset=proxz)|[proxz.com](http://www.proxz.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|26 unique IPs|updated every 1 hour from [this link](http://www.proxz.com/proxylists.xml)
[proxz_1d](http://iplists.firehol.org/?ipset=proxz_1d)|[proxz.com](http://www.proxz.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|266 unique IPs|updated every 1 hour from [this link](http://www.proxz.com/proxylists.xml)
[proxz_30d](http://iplists.firehol.org/?ipset=proxz_30d)|[proxz.com](http://www.proxz.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|3338 unique IPs|updated every 1 hour from [this link](http://www.proxz.com/proxylists.xml)
[proxz_7d](http://iplists.firehol.org/?ipset=proxz_7d)|[proxz.com](http://www.proxz.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|1201 unique IPs|updated every 1 hour from [this link](http://www.proxz.com/proxylists.xml)
[pushing_inertia_blocklist](http://iplists.firehol.org/?ipset=pushing_inertia_blocklist)|[Pushing Inertia](https://github.com/pushinginertia/ip-blacklist) IPs of hosting providers that are known to host various bots, spiders, scrapers, etc. to block access from these providers to web servers.|ipv4 hash:net|1277 subnets, 57157614 unique IPs|updated every 1 day from [this link](https://raw.githubusercontent.com/pushinginertia/ip-blacklist/master/ip_blacklist.conf)
[ransomware_cryptowall_ps](http://iplists.firehol.org/?ipset=ransomware_cryptowall_ps)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is CW_PS_IPBL: CryptoWall Ransomware Payment Sites IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/CW_PS_IPBL.txt)
[ransomware_feed](http://iplists.firehol.org/?ipset=ransomware_feed)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. The IPs in this list have been extracted from the tracker data feed.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/feeds/csv/)
[ransomware_locky_c2](http://iplists.firehol.org/?ipset=ransomware_locky_c2)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is LY_C2_IPBL: Locky Ransomware C2 URL blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/LY_C2_IPBL.txt)
[ransomware_locky_ps](http://iplists.firehol.org/?ipset=ransomware_locky_ps)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is LY_PS_IPBL: Locky Ransomware Payment Sites IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/LY_PS_IPBL.txt)
[ransomware_online](http://iplists.firehol.org/?ipset=ransomware_online)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. The IPs in this list have been extracted from the tracker data feed, filtering only online IPs.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/feeds/csv/)
[ransomware_rw](http://iplists.firehol.org/?ipset=ransomware_rw)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list includes TC_PS_IPBL, LY_C2_IPBL, TL_C2_IPBL, TL_PS_IPBL and it is the recommended blocklist. It might not catch everything, but the false positive rate should be low. However, false positives are possible, especially with regards to RW_IPBL. IP addresses associated with Ransomware Payment Sites (*_PS_IPBL) or Locky botnet C&Cs (LY_C2_IPBL) stay listed on RW_IPBL for a time of 30 days after the last appearance. This means that an IP address stays listed on RW_IPBL even after the threat has been eliminated (e.g. the VPS / server has been suspended by the hosting provider) for another 30 days.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt)
[ransomware_teslacrypt_ps](http://iplists.firehol.org/?ipset=ransomware_teslacrypt_ps)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is TC_PS_IPBL: TeslaCrypt Ransomware Payment Sites IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/TC_PS_IPBL.txt)
[ransomware_torrentlocker_c2](http://iplists.firehol.org/?ipset=ransomware_torrentlocker_c2)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is TL_C2_IPBL: TorrentLocker Ransomware C2 IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/TL_C2_IPBL.txt)
[ransomware_torrentlocker_ps](http://iplists.firehol.org/?ipset=ransomware_torrentlocker_ps)|[Abuse.ch Ransomware Tracker](https://ransomwaretracker.abuse.ch) Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreants to commit fraud. This list is TL_PS_IPBL: TorrentLocker Ransomware Payment Sites IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 5 mins from [this link](https://ransomwaretracker.abuse.ch/downloads/TL_PS_IPBL.txt)
[ri_connect_proxies](http://iplists.firehol.org/?ipset=ri_connect_proxies)|[rosinstrument.com](http://www.rosinstrument.com) open CONNECT proxies (this list is composed using an RSS feed)|ipv4 hash:ip|150 unique IPs|updated every 1 hour from [this link](http://tools.rosinstrument.com/proxy/plab100.xml)
[ri_connect_proxies_1d](http://iplists.firehol.org/?ipset=ri_connect_proxies_1d)|[rosinstrument.com](http://www.rosinstrument.com) open CONNECT proxies (this list is composed using an RSS feed)|ipv4 hash:ip|150 unique IPs|updated every 1 hour from [this link](http://tools.rosinstrument.com/proxy/plab100.xml)
[ri_connect_proxies_30d](http://iplists.firehol.org/?ipset=ri_connect_proxies_30d)|[rosinstrument.com](http://www.rosinstrument.com) open CONNECT proxies (this list is composed using an RSS feed)|ipv4 hash:ip|150 unique IPs|updated every 1 hour from [this link](http://tools.rosinstrument.com/proxy/plab100.xml)
[ri_connect_proxies_7d](http://iplists.firehol.org/?ipset=ri_connect_proxies_7d)|[rosinstrument.com](http://www.rosinstrument.com) open CONNECT proxies (this list is composed using an RSS feed)|ipv4 hash:ip|150 unique IPs|updated every 1 hour from [this link](http://tools.rosinstrument.com/proxy/plab100.xml)
[ri_web_proxies](http://iplists.firehol.org/?ipset=ri_web_proxies)|[rosinstrument.com](http://www.rosinstrument.com) open HTTP proxies (this list is composed using an RSS feed)|ipv4 hash:ip|139 unique IPs|updated every 1 hour from [this link](http://tools.rosinstrument.com/proxy/l100.xml)
[ri_web_proxies_1d](http://iplists.firehol.org/?ipset=ri_web_proxies_1d)|[rosinstrument.com](http://www.rosinstrument.com) open HTTP proxies (this list is composed using an RSS feed)|ipv4 hash:ip|139 unique IPs|updated every 1 hour from [this link](http://tools.rosinstrument.com/proxy/l100.xml)
[ri_web_proxies_30d](http://iplists.firehol.org/?ipset=ri_web_proxies_30d)|[rosinstrument.com](http://www.rosinstrument.com) open HTTP proxies (this list is composed using an RSS feed)|ipv4 hash:ip|139 unique IPs|updated every 1 hour from [this link](http://tools.rosinstrument.com/proxy/l100.xml)
[ri_web_proxies_7d](http://iplists.firehol.org/?ipset=ri_web_proxies_7d)|[rosinstrument.com](http://www.rosinstrument.com) open HTTP proxies (this list is composed using an RSS feed)|ipv4 hash:ip|139 unique IPs|updated every 1 hour from [this link](http://tools.rosinstrument.com/proxy/l100.xml)
[sblam](http://iplists.firehol.org/?ipset=sblam)|[sblam.com](http://sblam.com) IPs used by web form spammers, during the last month|ipv4 hash:ip|8114 unique IPs|updated every 1 day from [this link](http://sblam.com/blacklist.txt)
[shunlist](http://iplists.firehol.org/?ipset=shunlist)|[AutoShun.org](http://autoshun.org/) IPs identified as hostile by correlating logs from distributed snort installations running the autoshun plugin|ipv4 hash:ip|500 unique IPs|updated every 4 hours
[snort_ipfilter](http://iplists.firehol.org/?ipset=snort_ipfilter)|[labs.snort.org](https://labs.snort.org/) supplied IP blacklist (this list seems to be updated frequently, but we found no information about it)|ipv4 hash:ip|836 unique IPs|updated every 12 hours from [this link](http://labs.snort.org/feeds/ip-filter.blf)
[socks_proxy](http://iplists.firehol.org/?ipset=socks_proxy)|[socks-proxy.net](http://www.socks-proxy.net/) open SOCKS proxies|ipv4 hash:ip|302 unique IPs|updated every 10 mins from [this link](http://www.socks-proxy.net/)
[socks_proxy_1d](http://iplists.firehol.org/?ipset=socks_proxy_1d)|[socks-proxy.net](http://www.socks-proxy.net/) open SOCKS proxies|ipv4 hash:ip|6364 unique IPs|updated every 10 mins from [this link](http://www.socks-proxy.net/)
[socks_proxy_30d](http://iplists.firehol.org/?ipset=socks_proxy_30d)|[socks-proxy.net](http://www.socks-proxy.net/) open SOCKS proxies|ipv4 hash:ip|18744 unique IPs|updated every 10 mins from [this link](http://www.socks-proxy.net/)
[socks_proxy_7d](http://iplists.firehol.org/?ipset=socks_proxy_7d)|[socks-proxy.net](http://www.socks-proxy.net/) open SOCKS proxies|ipv4 hash:ip|10560 unique IPs|updated every 10 mins from [this link](http://www.socks-proxy.net/)
[sorbs_anonymizers](http://iplists.firehol.org/?ipset=sorbs_anonymizers)|[Sorbs.net](https://www.sorbs.net/) List of open HTTP and SOCKS proxies.|ipv4 hash:net|597391 subnets, 610263 unique IPs|updated every 1 min
sorbs_block|[Sorbs.net](https://www.sorbs.net/) List of hosts demanding that they never be tested by SORBS.|ipv4 hash:net|disabled|
[sorbs_dul](http://iplists.firehol.org/?ipset=sorbs_dul)|[Sorbs.net](https://www.sorbs.net/) Dynamic IP Addresses.|ipv4 hash:net|607718 subnets, 375474210 unique IPs|updated every 1 min
[sorbs_escalations](http://iplists.firehol.org/?ipset=sorbs_escalations)|[Sorbs.net](https://www.sorbs.net/) Netblocks of spam supporting service providers, including those who provide websites, DNS or drop boxes for a spammer. Spam supporters are added on a 'third strike and you are out' basis, where the third spam will cause the supporter to be added to the list.|ipv4 hash:net|8 subnets, 2304 unique IPs|updated every 1 min
[sorbs_new_spam](http://iplists.firehol.org/?ipset=sorbs_new_spam)|[Sorbs.net](https://www.sorbs.net/) List of hosts that have been noted as sending spam/UCE/UBE within the last 48 hours|ipv4 hash:net|33977 subnets, 35967 unique IPs|updated every 1 min
[sorbs_noserver](http://iplists.firehol.org/?ipset=sorbs_noserver)|[Sorbs.net](https://www.sorbs.net/) IP addresses and netblocks of where system administrators and ISPs owning the network have indicated that servers should not be present.|ipv4 hash:net|15066 subnets, 22951270 unique IPs|updated every 1 min
[sorbs_recent_spam](http://iplists.firehol.org/?ipset=sorbs_recent_spam)|[Sorbs.net](https://www.sorbs.net/) List of hosts that have been noted as sending spam/UCE/UBE within the last 28 days (includes sorbs_new_spam)|ipv4 hash:net|522240 subnets, 555438 unique IPs|updated every 1 min
[sorbs_smtp](http://iplists.firehol.org/?ipset=sorbs_smtp)|[Sorbs.net](https://www.sorbs.net/) List of SMTP Open Relays.|ipv4 hash:net|1968 subnets, 1976 unique IPs|updated every 1 min
[sorbs_web](http://iplists.firehol.org/?ipset=sorbs_web)|[Sorbs.net](https://www.sorbs.net/) List of IPs which have spammer abusable vulnerabilities (e.g. FormMail scripts)|ipv4 hash:net|5895259 subnets, 6375029 unique IPs|updated every 1 min
[sorbs_zombie](http://iplists.firehol.org/?ipset=sorbs_zombie)|[Sorbs.net](https://www.sorbs.net/) List of networks hijacked from their original owners, some of which have already used for spamming.|ipv4 hash:net|78 subnets, 1903876 unique IPs|updated every 1 min
[spamhaus_drop](http://iplists.firehol.org/?ipset=spamhaus_drop)|[Spamhaus.org](http://www.spamhaus.org) DROP list (according to their site this list should be dropped at tier-1 ISPs globally)|ipv4 hash:net|933 subnets, 19793664 unique IPs|updated every 12 hours from [this link](http://www.spamhaus.org/drop/drop.txt)
[spamhaus_edrop](http://iplists.firehol.org/?ipset=spamhaus_edrop)|[Spamhaus.org](http://www.spamhaus.org) EDROP (extended matches that should be used with DROP)|ipv4 hash:net|69 subnets, 968192 unique IPs|updated every 12 hours from [this link](http://www.spamhaus.org/drop/edrop.txt)
[sslbl](http://iplists.firehol.org/?ipset=sslbl)|[Abuse.ch SSL Blacklist](https://sslbl.abuse.ch/) bad SSL traffic related to malware or botnet activities|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://sslbl.abuse.ch/blacklist/sslipblacklist.csv)
[sslbl_aggressive](http://iplists.firehol.org/?ipset=sslbl_aggressive)|[Abuse.ch SSL Blacklist](https://sslbl.abuse.ch/) The aggressive version of the SSL IP Blacklist contains all IPs that SSLBL ever detected being associated with a malicious SSL certificate. Since IP addresses can be reused (e.g. when the customer changes), this blacklist may cause false positives. Hence I highly recommend you to use the standard version instead of the aggressive one.|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.csv)
[sslproxies](http://iplists.firehol.org/?ipset=sslproxies)|[SSLProxies.org](http://www.sslproxies.org/) open SSL proxies|ipv4 hash:ip|102 unique IPs|updated every 10 mins from [this link](http://www.sslproxies.org/)
[sslproxies_1d](http://iplists.firehol.org/?ipset=sslproxies_1d)|[SSLProxies.org](http://www.sslproxies.org/) open SSL proxies|ipv4 hash:ip|606 unique IPs|updated every 10 mins from [this link](http://www.sslproxies.org/)
[sslproxies_30d](http://iplists.firehol.org/?ipset=sslproxies_30d)|[SSLProxies.org](http://www.sslproxies.org/) open SSL proxies|ipv4 hash:ip|6492 unique IPs|updated every 10 mins from [this link](http://www.sslproxies.org/)
[sslproxies_7d](http://iplists.firehol.org/?ipset=sslproxies_7d)|[SSLProxies.org](http://www.sslproxies.org/) open SSL proxies|ipv4 hash:ip|2340 unique IPs|updated every 10 mins from [this link](http://www.sslproxies.org/)
[stopforumspam](http://iplists.firehol.org/?ipset=stopforumspam)|[StopForumSpam.com](http://www.stopforumspam.com) Banned IPs used by forum spammers|ipv4 hash:ip|176511 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/bannedips.zip)
[stopforumspam_180d](http://iplists.firehol.org/?ipset=stopforumspam_180d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers (last 180 days)|ipv4 hash:ip|303654 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/listed_ip_180.zip)
[stopforumspam_1d](http://iplists.firehol.org/?ipset=stopforumspam_1d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers in the last 24 hours|ipv4 hash:ip|7013 unique IPs|updated every 1 hour from [this link](http://www.stopforumspam.com/downloads/listed_ip_1.zip)
[stopforumspam_30d](http://iplists.firehol.org/?ipset=stopforumspam_30d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers (last 30 days)|ipv4 hash:ip|72262 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/listed_ip_30.zip)
[stopforumspam_365d](http://iplists.firehol.org/?ipset=stopforumspam_365d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers (last 365 days)|ipv4 hash:ip|531698 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/listed_ip_365.zip)
[stopforumspam_7d](http://iplists.firehol.org/?ipset=stopforumspam_7d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers (last 7 days)|ipv4 hash:ip|23975 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/listed_ip_7.zip)
[stopforumspam_90d](http://iplists.firehol.org/?ipset=stopforumspam_90d)|[StopForumSpam.com](http://www.stopforumspam.com) IPs used by forum spammers (last 90 days)|ipv4 hash:ip|177499 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/listed_ip_90.zip)
[stopforumspam_toxic](http://iplists.firehol.org/?ipset=stopforumspam_toxic)|[StopForumSpam.com](http://www.stopforumspam.com) Networks that have large amounts of spambots and are flagged as toxic. Toxic IP ranges are infrequently changed.|ipv4 hash:net|42 subnets, 119883 unique IPs|updated every 1 day from [this link](http://www.stopforumspam.com/downloads/toxic_ip_cidr.txt)
[taichung](http://iplists.firehol.org/?ipset=taichung)|[Taichung Education Center](https://www.tc.edu.tw/net/netflow/lkout/recent/30) Blocked IP Addresses (attacks and bots).|ipv4 hash:ip|2160 unique IPs|updated every 1 day from [this link](https://www.tc.edu.tw/net/netflow/lkout/recent/30)
[talosintel_ipfilter](http://iplists.firehol.org/?ipset=talosintel_ipfilter)|[TalosIntel.com](http://talosintel.com/additional-resources/) List of known malicious network threats|ipv4 hash:ip|732 unique IPs|updated every 15 mins from [this link](http://talosintel.com/feeds/ip-filter.blf)
[threatcrowd](http://iplists.firehol.org/?ipset=threatcrowd)|[Crowdsourced IP feed from ThreatCrowd](http://threatcrowd.blogspot.gr/2016/02/crowdsourced-feeds-from-threatcrowd.html). These feeds are not a substitute for the scale of auto-extracted command and control domains or the quality of some commercially provided feeds. But crowd-sourcing does go some way towards the quick sharing of threat intelligence between the community.|ipv4 hash:ip|977 unique IPs|updated every 1 hour from [this link](https://www.threatcrowd.org/feeds/ips.txt)
[tor_exits](http://iplists.firehol.org/?ipset=tor_exits)|[TorProject.org](https://www.torproject.org) list of all current TOR exit points (TorDNSEL)|ipv4 hash:ip|1263 unique IPs|updated every 5 mins from [this link](https://check.torproject.org/exit-addresses)
[tor_exits_1d](http://iplists.firehol.org/?ipset=tor_exits_1d)|[TorProject.org](https://www.torproject.org) list of all current TOR exit points (TorDNSEL)|ipv4 hash:ip|1263 unique IPs|updated every 5 mins from [this link](https://check.torproject.org/exit-addresses)
[tor_exits_30d](http://iplists.firehol.org/?ipset=tor_exits_30d)|[TorProject.org](https://www.torproject.org) list of all current TOR exit points (TorDNSEL)|ipv4 hash:ip|2072 unique IPs|updated every 5 mins from [this link](https://check.torproject.org/exit-addresses)
[tor_exits_7d](http://iplists.firehol.org/?ipset=tor_exits_7d)|[TorProject.org](https://www.torproject.org) list of all current TOR exit points (TorDNSEL)|ipv4 hash:ip|1394 unique IPs|updated every 5 mins from [this link](https://check.torproject.org/exit-addresses)
[turris_greylist](http://iplists.firehol.org/?ipset=turris_greylist)|[Turris Greylist](https://www.turris.cz/en/greylist) IPs that are blocked on the firewalls of Turris routers. The data is processed and clasified every week and behaviour of IP addresses that accessed a larger number of Turris routers is evaluated. The result is a list of addresses that have tried to obtain information about services on the router or tried to gain access to them. We do not recommend to use these data as a list of addresses that should be blocked but it can be used for example in analysis of the traffic in other networks.|ipv4 hash:ip|26472 unique IPs|updated every 7 days from [this link](https://www.turris.cz/greylist-data/greylist-latest.csv)
[urandomusto_dns](http://iplists.firehol.org/?ipset=urandomusto_dns)|IP Feed about dns, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|67 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=dns&out=txt&submit=go)
[urandomusto_ftp](http://iplists.firehol.org/?ipset=urandomusto_ftp)|IP Feed about ftp, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|152 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=ftp&out=txt&submit=go)
[urandomusto_http](http://iplists.firehol.org/?ipset=urandomusto_http)|IP Feed about http, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|289 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=http&out=txt&submit=go)
[urandomusto_mailer](http://iplists.firehol.org/?ipset=urandomusto_mailer)|IP Feed about mailer, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|259 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=mailer&out=txt&submit=go)
[urandomusto_malware](http://iplists.firehol.org/?ipset=urandomusto_malware)|IP Feed about malware, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|1 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=malware&out=txt&submit=go)
[urandomusto_ntp](http://iplists.firehol.org/?ipset=urandomusto_ntp)|IP Feed about ntp, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|72 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=ntp&out=txt&submit=go)
[urandomusto_rdp](http://iplists.firehol.org/?ipset=urandomusto_rdp)|IP Feed about rdp, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|133 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=rdp&out=txt&submit=go)
[urandomusto_smb](http://iplists.firehol.org/?ipset=urandomusto_smb)|IP Feed about smb, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|45 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=smb&out=txt&submit=go)
[urandomusto_spam](http://iplists.firehol.org/?ipset=urandomusto_spam)|IP Feed about spam, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|4 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=spam&out=txt&submit=go)
[urandomusto_ssh](http://iplists.firehol.org/?ipset=urandomusto_ssh)|IP Feed about ssh, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|126 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=ssh&out=txt&submit=go)
[urandomusto_telnet](http://iplists.firehol.org/?ipset=urandomusto_telnet)|IP Feed about telnet, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|299 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=telnet&out=txt&submit=go)
[urandomusto_unspecified](http://iplists.firehol.org/?ipset=urandomusto_unspecified)|IP Feed about unspecified, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|178 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=unspecified&out=txt&submit=go)
[urandomusto_vnc](http://iplists.firehol.org/?ipset=urandomusto_vnc)|IP Feed about vnc, crawled from several sources, including several twitter accounts.|ipv4 hash:ip|27 unique IPs|updated every 1 hour from [this link](http://urandom.us.to/report.php?ip=&info=&tag=vnc&out=txt&submit=go)
[urlvir](http://iplists.firehol.org/?ipset=urlvir)|[URLVir.com](http://www.urlvir.com/) Active Malicious IP Addresses Hosting Malware. URLVir is an online security service developed by NoVirusThanks Company Srl that automatically monitors changes of malicious URLs (executable files).|ipv4 hash:ip|171 unique IPs|updated every 1 day from [this link](http://www.urlvir.com/export-ip-addresses/)
[uscert_hidden_cobra](http://iplists.firehol.org/?ipset=uscert_hidden_cobra)|Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace. DHS and FBI assess that HIDDEN COBRA actors will continue to use cyber operations to advance their government’s military and strategic objectives. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware. Variants of malware and tools used by HIDDEN COBRA actors include Destover, Wild Positron/Duuzer and Hangman.|ipv4 hash:ip|627 unique IPs|updated every 1 day from [this link](https://www.us-cert.gov/sites/default/files/publications/TA-17-164A_csv.csv)
[voipbl](http://iplists.firehol.org/?ipset=voipbl)|[VoIPBL.org](http://www.voipbl.org/) a distributed VoIP blacklist that is aimed to protects against VoIP Fraud and minimizing abuse for network that have publicly accessible PBX's. Several algorithms, external sources and manual confirmation are used before they categorize something as an attack and determine the threat level.|ipv4 hash:net|20397 subnets, 21087 unique IPs|updated every 4 hours from [this link](http://www.voipbl.org/update/)
[vxvault](http://iplists.firehol.org/?ipset=vxvault)|[VxVault](http://vxvault.net) The latest 100 additions of VxVault.|ipv4 hash:ip|51 unique IPs|updated every 12 hours from [this link](http://vxvault.net/ViriList.php?s=0&m=100)
[xforce_bccs](http://iplists.firehol.org/?ipset=xforce_bccs)|[IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/) Botnet Command and Control Servers|ipv4 hash:ip|411 unique IPs|updated every 1 day from [this link](https://api.xforce.ibmcloud.com/taxii)
[xroxy](http://iplists.firehol.org/?ipset=xroxy)|[xroxy.com](http://www.xroxy.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|60 unique IPs|updated every 1 hour from [this link](http://www.xroxy.com/proxyrss.xml)
[xroxy_1d](http://iplists.firehol.org/?ipset=xroxy_1d)|[xroxy.com](http://www.xroxy.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|288 unique IPs|updated every 1 hour from [this link](http://www.xroxy.com/proxyrss.xml)
[xroxy_30d](http://iplists.firehol.org/?ipset=xroxy_30d)|[xroxy.com](http://www.xroxy.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|880 unique IPs|updated every 1 hour from [this link](http://www.xroxy.com/proxyrss.xml)
[xroxy_7d](http://iplists.firehol.org/?ipset=xroxy_7d)|[xroxy.com](http://www.xroxy.com) open proxies (this list is composed using an RSS feed)|ipv4 hash:ip|600 unique IPs|updated every 1 hour from [this link](http://www.xroxy.com/proxyrss.xml)
[yoyo_adservers](http://iplists.firehol.org/?ipset=yoyo_adservers)|[Yoyo.org](http://pgl.yoyo.org/adservers/) IPs of ad servers|ipv4 hash:ip|10355 unique IPs|updated every 12 hours from [this link](http://pgl.yoyo.org/adservers/iplist.php?ipformat=plain&showintro=0&mimetype=plaintext)
[zeus](http://iplists.firehol.org/?ipset=zeus)|[Abuse.ch Zeus tracker](https://zeustracker.abuse.ch) standard, contains the same data as the ZeuS IP blocklist (zeus_badips) but with the slight difference that it doesn't exclude hijacked websites (level 2) and free web hosting providers (level 3). This means that this blocklist contains all IPv4 addresses associated with ZeuS C&Cs which are currently being tracked by ZeuS Tracker. Hence this blocklist will likely cause some false positives.|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://zeustracker.abuse.ch/blocklist.php?download=ipblocklist)
[zeus_badips](http://iplists.firehol.org/?ipset=zeus_badips)|[Abuse.ch Zeus tracker](https://zeustracker.abuse.ch) badips includes IPv4 addresses that are used by the ZeuS trojan. It is the recommened blocklist if you want to block only ZeuS IPs. It excludes IP addresses that ZeuS Tracker believes to be hijacked (level 2) or belong to a free web hosting provider (level 3). Hence the false postive rate should be much lower compared to the standard ZeuS IP blocklist.|ipv4 hash:ip|0 unique IPs|updated every 30 mins from [this link](https://zeustracker.abuse.ch/blocklist.php?download=badips)

1612
alienvault_reputation.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

30
asprox_c2.ipset Normal file
View File

@ -0,0 +1,30 @@
#
# asprox_c2
#
# ipv4 hash:ip ipset
#
# [h3x.eu] (http://atrack.h3x.eu/) ASPROX Tracker - Asprox
# C&C Sites
#
# Maintainer : h3x.eu
# Maintainer URL : http://atrack.h3x.eu/
# List source URL : http://atrack.h3x.eu/c2
# Source File Date: Mon Nov 6 03:04:11 UTC 2017
#
# Category : malware
# Version : 1
#
# This File Date : Sun Jun 3 05:36:21 UTC 2018
# Update Frequency: 1 day
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=asprox_c2
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

167
bambenek_banjori.ipset Normal file
View File

@ -0,0 +1,167 @@
#
# bambenek_banjori
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of banjori C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/banjori-iplist.txt
# Source File Date: Wed Jul 29 20:05:53 UTC 2020
#
# Category : malware
# Version : 17534
#
# This File Date : Wed Jul 29 20:12:14 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 136 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_banjori
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
3.216.121.17
5.79.79.212
13.59.74.74
14.192.4.75
18.213.250.117
18.215.128.143
23.89.20.107
23.89.102.123
23.107.124.53
23.110.15.74
23.226.53.226
23.227.38.65
23.231.218.195
23.236.62.147
34.98.99.30
34.102.136.180
35.186.238.101
35.226.69.129
43.230.142.125
43.241.196.105
43.249.76.176
47.91.170.222
47.245.10.59
50.117.86.130
52.4.209.250
52.25.92.0
52.58.78.16
54.65.172.3
54.85.65.140
62.149.142.219
67.20.112.155
74.208.236.219
74.220.199.8
78.24.9.52
78.46.156.194
81.169.145.88
81.169.145.159
81.169.145.160
81.169.145.161
89.188.24.70
92.53.96.22
94.130.109.30
95.211.75.10
96.30.52.60
103.70.226.182
104.24.102.57
104.24.103.57
104.24.108.92
104.24.109.92
104.164.181.36
104.171.23.69
104.171.23.70
107.165.137.88
107.180.26.185
108.59.12.99
108.59.12.101
109.70.4.246
109.71.54.17
112.78.125.29
112.121.187.246
119.3.179.174
119.188.157.23
121.40.153.149
121.54.175.96
122.10.99.22
130.211.40.170
133.130.35.90
133.242.195.32
134.73.61.187
137.175.15.6
145.131.10.247
149.255.58.42
150.95.255.38
154.95.106.131
154.195.133.14
154.195.209.90
154.201.77.14
154.213.139.148
154.216.122.13
154.216.243.104
156.224.61.139
156.225.101.57
156.238.79.182
156.247.12.40
156.250.218.137
158.177.208.8
160.121.36.178
160.153.96.67
162.209.205.67
162.210.102.66
162.210.195.111
163.43.102.74
169.50.13.61
169.50.57.89
172.67.143.254
172.67.211.10
172.106.32.42
175.29.102.46
178.22.59.66
180.153.100.94
185.104.45.33
185.135.241.4
185.216.113.170
186.202.153.222
192.169.243.26
192.190.87.140
193.222.100.37
196.22.132.17
198.23.48.104
198.38.83.24
198.54.117.197
198.54.117.198
198.54.117.199
198.54.117.200
198.54.121.133
199.58.179.10
199.59.242.153
202.124.241.178
202.181.97.76
202.254.234.152
203.156.192.80
208.73.210.202
208.73.210.217
208.73.211.165
208.73.211.177
208.91.197.91
208.109.80.14
212.12.54.87
213.176.50.208
213.186.33.5
216.40.47.17
217.26.53.16
217.26.63.20
217.70.184.38
219.118.71.121
219.235.5.224

31
bambenek_bebloh.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_bebloh
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of bebloh C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/bebloh-iplist.txt
# Source File Date: Thu Jun 7 00:02:37 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:33 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_bebloh
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

517
bambenek_c2.ipset Normal file
View File

@ -0,0 +1,517 @@
#
# bambenek_c2
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) master feed of
# known, active and non-sinkholed C&Cs IP addresses
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/c2-ipmasterlist.txt
# Source File Date: Tue Apr 14 23:17:00 UTC 2020
#
# Category : malware
# Version : 16212
#
# This File Date : Tue Apr 14 23:20:06 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 486 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_c2
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
3.90.198.217
5.63.155.65
5.79.79.211
5.157.84.170
5.180.102.147
13.90.196.81
14.128.136.68
14.192.4.35
18.213.250.117
18.215.128.143
18.218.40.17
18.224.184.93
23.89.20.107
23.89.102.123
23.89.102.127
23.107.49.18
23.107.124.53
23.110.15.74
23.227.38.65
23.229.213.5
23.231.218.195
23.236.62.147
31.11.32.144
31.186.169.41
31.217.192.121
34.197.76.50
34.206.12.234
34.225.182.233
35.169.58.188
35.186.238.101
35.187.36.248
35.209.70.88
35.214.186.61
35.224.11.86
35.226.69.129
37.152.88.55
40.255.0.62
43.230.112.86
43.230.142.125
43.241.196.105
45.33.2.79
45.33.23.183
45.38.3.236
45.56.79.23
45.77.226.209
45.79.19.196
45.82.253.244
45.88.202.115
45.114.106.55
45.136.245.235
45.202.208.234
45.204.37.242
45.204.41.153
46.28.105.107
46.30.215.126
46.30.215.145
46.30.215.194
46.165.220.141
46.165.220.142
46.165.220.143
46.165.220.144
46.165.220.145
46.165.220.146
46.165.220.147
46.165.220.148
46.165.220.149
46.165.220.150
46.165.220.151
46.165.220.152
46.165.220.153
46.165.220.154
46.165.220.155
46.165.221.136
46.165.221.144
46.165.221.154
46.165.229.164
46.165.229.165
46.165.229.166
46.165.229.167
46.165.254.193
46.165.254.194
46.165.254.195
46.165.254.196
46.165.254.197
46.165.254.198
46.165.254.199
46.165.254.200
46.165.254.201
46.165.254.202
46.165.254.203
46.165.254.204
46.165.254.205
46.165.254.206
46.165.254.207
46.165.254.208
46.165.254.209
46.165.254.210
46.165.254.211
46.165.254.212
46.165.254.213
46.165.254.214
46.242.242.252
46.249.43.105
50.63.103.1
50.87.145.146
50.87.146.132
50.93.202.39
50.118.129.167
52.0.217.44
52.4.209.250
52.58.78.16
52.63.118.238
52.218.36.4
52.218.98.4
52.218.100.36
54.72.11.253
54.88.108.200
54.208.77.124
59.188.232.88
62.97.115.37
62.129.200.14
62.149.128.72
62.149.128.74
62.149.128.151
62.149.128.154
62.149.128.157
62.149.128.160
62.149.128.163
62.149.128.166
62.149.142.219
62.153.122.95
63.251.106.29
64.21.149.167
64.68.200.46
64.95.103.189
64.135.149.51
64.207.140.209
64.235.41.10
65.127.154.211
66.29.58.119
66.96.149.31
66.175.208.22
67.20.112.155
67.23.117.19
67.59.157.51
67.229.184.183
68.66.216.25
68.71.58.245
69.15.64.241
69.41.162.77
69.103.233.16
69.191.176.179
69.195.124.132
72.5.161.7
72.26.218.70
72.26.218.83
74.208.215.45
74.208.236.219
74.220.199.8
75.5.255.185
77.111.240.32
77.111.240.52
78.24.9.52
78.46.156.194
78.47.106.15
79.170.40.236
80.67.28.246
80.85.86.6
80.237.132.180
80.237.132.244
81.2.194.62
81.2.194.128
81.2.194.176
81.169.145.68
81.169.145.83
81.169.145.84
81.169.145.88
81.169.145.93
81.169.145.94
81.169.145.105
81.169.145.144
81.169.145.159
81.169.145.160
81.169.145.161
81.177.165.51
82.98.135.43
82.100.220.53
82.112.184.197
82.220.91.188
84.38.224.155
85.13.129.76
85.13.132.239
85.13.158.14
85.114.135.128
85.128.185.12
85.236.47.218
87.98.230.60
88.198.56.106
89.31.143.1
89.46.108.57
89.188.24.70
89.223.109.60
91.121.59.137
91.121.154.229
91.174.205.10
91.195.240.13
91.195.240.82
91.195.240.87
91.199.77.50
91.212.28.29
91.223.145.130
92.43.203.171
92.53.96.22
92.61.39.239
93.89.19.124
93.185.103.42
94.130.109.30
94.152.8.56
94.229.72.116
94.229.72.123
96.30.52.60
96.126.123.244
103.4.217.55
103.70.226.182
103.120.83.30
103.224.212.222
104.18.40.160
104.18.41.160
104.18.58.253
104.18.59.253
104.24.108.81
104.24.109.81
104.27.180.130
104.27.180.160
104.27.181.130
104.27.181.160
104.27.184.30
104.27.185.30
104.28.26.243
104.28.27.243
104.28.28.252
104.28.29.252
104.149.174.100
104.156.57.40
104.171.23.69
104.171.23.70
104.195.23.59
104.197.104.56
104.202.22.13
104.202.87.74
104.203.167.207
104.206.78.18
104.244.75.32
107.6.74.80
107.6.74.93
107.151.119.204
107.180.41.146
108.59.12.98
108.59.12.99
108.59.12.100
108.61.19.11
108.61.19.14
108.179.252.199
109.70.4.246
109.71.54.17
109.248.10.176
112.78.125.29
112.121.187.246
116.202.231.184
119.3.179.174
119.188.157.23
120.107.3.165
120.227.100.34
121.35.145.102
121.40.153.149
121.41.147.32
121.54.175.96
121.241.144.35
121.254.178.252
122.10.99.22
123.254.108.81
129.181.96.164
130.211.40.170
130.229.91.0
132.148.25.127
132.148.231.248
132.213.126.70
133.37.107.164
133.130.35.90
133.242.195.32
134.73.61.187
134.73.142.227
134.73.209.244
137.74.151.103
137.74.217.60
138.68.142.109
141.105.126.87
142.111.199.16
143.95.79.234
143.215.15.199
145.131.10.247
146.148.34.125
149.216.106.61
149.255.58.42
150.95.255.38
154.80.242.31
154.90.36.229
154.90.37.102
154.95.135.196
154.195.209.90
154.196.20.154
154.198.219.27
154.212.209.96
154.214.250.73
154.216.243.104
155.159.53.217
155.159.172.76
156.225.101.57
156.232.185.254
156.234.43.65
156.238.79.182
156.245.93.85
157.7.44.219
157.7.184.14
157.7.184.17
157.7.188.207
157.230.67.179
159.8.210.35
160.16.199.126
160.16.223.90
160.121.17.22
160.121.22.55
160.181.164.88
162.144.26.233
162.209.205.41
162.210.102.66
162.217.99.132
162.217.99.137
162.243.55.152
162.255.119.102
162.255.119.204
163.43.102.74
163.172.86.124
164.155.160.223
164.155.160.228
164.155.163.203
169.50.13.61
172.98.192.37
172.104.243.27
172.120.167.67
172.120.168.177
172.252.250.177
173.231.184.61
173.231.184.117
173.231.184.123
173.236.178.74
173.239.5.6
173.239.8.164
178.22.59.66
178.254.10.14
180.153.100.94
180.215.129.7
185.26.105.244
185.42.107.8
185.51.65.38
185.66.237.14
185.104.45.33
185.114.108.15
185.135.241.4
185.181.104.74
185.183.8.67
185.232.248.163
186.202.153.222
188.165.143.5
189.50.110.40
192.64.119.63
192.64.119.107
192.64.119.138
192.64.147.231
192.74.245.227
192.124.249.106
192.155.198.18
192.185.72.119
192.190.87.140
193.41.64.176
193.146.253.35
193.146.253.36
193.146.253.37
193.146.253.38
193.146.253.51
193.222.100.37
194.9.94.85
194.9.94.86
194.150.113.18
194.150.113.50
194.242.61.31
195.74.38.62
195.110.124.188
195.123.216.248
196.22.132.17
198.23.48.104
198.38.83.24
198.54.117.197
198.54.117.198
198.54.117.199
198.54.117.200
198.54.121.133
198.58.118.167
199.34.228.76
199.58.179.10
199.59.242.153
202.124.241.178
202.181.97.76
202.254.234.152
203.88.111.122
203.156.192.80
205.144.171.124
206.189.61.126
207.10.232.16
207.10.232.21
208.73.210.202
208.73.210.217
208.73.211.165
208.73.211.177
208.91.197.26
208.91.197.27
208.91.197.66
208.91.197.91
208.109.80.14
209.99.40.222
209.99.40.223
209.99.64.33
209.140.30.61
209.160.65.66
210.172.183.32
211.43.203.53
212.12.54.87
212.57.32.149
212.85.106.71
213.176.50.208
213.186.33.5
213.186.33.19
213.186.33.87
213.247.47.190
216.40.47.17
217.20.116.129
217.20.116.130
217.20.116.131
217.20.116.132
217.20.116.133
217.20.116.134
217.20.116.135
217.20.116.136
217.20.116.137
217.20.116.138
217.20.116.139
217.20.116.140
217.20.116.141
217.20.116.142
217.20.116.143
217.20.116.145
217.20.116.146
217.20.116.147
217.20.116.148
217.20.116.149
217.20.116.150
217.20.116.151
217.20.116.152
217.20.116.153
217.26.53.16
217.26.63.20
217.70.184.38
217.74.71.168
217.116.16.235
217.160.0.27
217.160.0.59
217.160.0.169
217.160.0.225
217.160.0.231
217.160.0.239
217.160.122.61
217.160.223.127
217.160.233.84
219.94.129.157
219.235.5.224
220.158.225.187

31
bambenek_cl.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_cl
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of cl C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/cl-iplist.txt
# Source File Date: Fri Dec 14 00:05:01 UTC 2018
#
# Category : malware
# Version : 18
#
# This File Date : Fri Dec 14 00:08:08 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_cl
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

31
bambenek_cryptowall.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_cryptowall
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of cryptowall C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/cryptowall-iplist.txt
# Source File Date: Thu Dec 3 12:25:05 UTC 2015
#
# Category : malware
# Version : 5
#
# This File Date : Thu Jun 7 00:08:34 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_cryptowall
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

33
bambenek_dircrypt.ipset Normal file
View File

@ -0,0 +1,33 @@
#
# bambenek_dircrypt
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of dircrypt C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/dircrypt-iplist.txt
# Source File Date: Sat Jul 18 09:06:23 UTC 2020
#
# Category : malware
# Version : 260
#
# This File Date : Sat Jul 18 09:08:07 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 2 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_dircrypt
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
164.155.216.36
169.50.13.61

31
bambenek_dyre.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_dyre
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of dyre C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/dyre-iplist.txt
# Source File Date: Thu Jun 7 00:03:08 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:34 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_dyre
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

31
bambenek_geodo.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_geodo
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of geodo C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/geodo-iplist.txt
# Source File Date: Thu Jun 7 00:02:33 UTC 2018
#
# Category : malware
# Version : 6
#
# This File Date : Thu Jun 7 00:08:34 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_geodo
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

33
bambenek_hesperbot.ipset Normal file
View File

@ -0,0 +1,33 @@
#
# bambenek_hesperbot
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of hesperbot C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/hesperbot-iplist.txt
# Source File Date: Sat Jul 18 10:07:53 UTC 2020
#
# Category : malware
# Version : 234
#
# This File Date : Sat Jul 18 10:12:32 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 2 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_hesperbot
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
72.5.161.7
164.155.219.11

32
bambenek_matsnu.ipset Normal file
View File

@ -0,0 +1,32 @@
#
# bambenek_matsnu
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of matsnu C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/matsnu-iplist.txt
# Source File Date: Mon Jul 27 04:09:06 UTC 2020
#
# Category : malware
# Version : 522
#
# This File Date : Mon Jul 27 04:12:41 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_matsnu
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
64.207.152.130

44
bambenek_necurs.ipset Normal file
View File

@ -0,0 +1,44 @@
#
# bambenek_necurs
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of necurs C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/necurs-iplist.txt
# Source File Date: Wed Jul 29 01:11:02 UTC 2020
#
# Category : malware
# Version : 10186
#
# This File Date : Wed Jul 29 01:16:08 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 13 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_necurs
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
40.121.206.97
64.47.209.23
64.63.188.85
64.231.250.149
65.79.10.48
65.159.138.178
66.7.34.215
66.247.157.54
68.199.246.20
69.47.125.180
69.79.159.208
70.23.145.183
70.63.91.183

31
bambenek_p2pgoz.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_p2pgoz
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of p2pgoz C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/p2pgoz-iplist.txt
# Source File Date: Sun Jul 26 15:10:57 UTC 2020
#
# Category : malware
# Version : 478
#
# This File Date : Sun Jul 26 15:16:09 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_p2pgoz
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

31
bambenek_pushdo.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_pushdo
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of pushdo C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/pushdo-iplist.txt
# Source File Date: Sat Jun 20 05:15:31 UTC 2020
#
# Category : malware
# Version : 12
#
# This File Date : Sat Jun 20 05:20:06 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_pushdo
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

36
bambenek_pykspa.ipset Normal file
View File

@ -0,0 +1,36 @@
#
# bambenek_pykspa
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of pykspa C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/pykspa-iplist.txt
# Source File Date: Wed Jul 29 04:13:10 UTC 2020
#
# Category : malware
# Version : 1373
#
# This File Date : Wed Jul 29 04:16:06 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 5 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_pykspa
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
40.255.0.62
78.47.106.15
169.50.13.61
189.50.110.40
193.146.253.37

33
bambenek_qakbot.ipset Normal file
View File

@ -0,0 +1,33 @@
#
# bambenek_qakbot
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of qakbot C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/qakbot-iplist.txt
# Source File Date: Sun Jul 26 12:13:39 UTC 2020
#
# Category : malware
# Version : 453
#
# This File Date : Sun Jul 26 12:16:47 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 2 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_qakbot
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
72.26.218.72
199.21.76.82

129
bambenek_ramnit.ipset Normal file
View File

@ -0,0 +1,129 @@
#
# bambenek_ramnit
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of ramnit C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/ramnit-iplist.txt
# Source File Date: Wed Jul 29 20:18:04 UTC 2020
#
# Category : malware
# Version : 3671
#
# This File Date : Wed Jul 29 20:24:06 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 98 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_ramnit
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.180.102.147
13.90.196.81
18.213.250.117
18.215.128.143
34.197.76.50
34.225.182.233
35.224.11.86
46.17.47.67
46.165.220.141
46.165.220.142
46.165.220.143
46.165.220.144
46.165.220.145
46.165.220.146
46.165.220.147
46.165.220.148
46.165.220.149
46.165.220.150
46.165.220.151
46.165.220.152
46.165.220.153
46.165.220.154
46.165.220.155
46.165.221.136
46.165.221.144
46.165.221.154
46.165.229.164
46.165.229.165
46.165.229.166
46.165.229.167
46.165.254.193
46.165.254.194
46.165.254.195
46.165.254.196
46.165.254.197
46.165.254.198
46.165.254.199
46.165.254.200
46.165.254.201
46.165.254.202
46.165.254.203
46.165.254.204
46.165.254.205
46.165.254.206
46.165.254.207
46.165.254.208
46.165.254.209
46.165.254.210
46.165.254.211
46.165.254.212
46.165.254.213
46.165.254.214
47.91.170.222
52.4.209.250
72.26.218.70
82.112.184.197
88.212.208.67
109.248.10.176
154.216.211.122
160.16.199.126
160.16.223.90
164.155.216.31
169.50.13.61
173.239.5.6
173.239.8.164
178.33.69.68
193.146.253.36
193.146.253.38
193.146.253.44
194.67.71.41
194.67.71.114
208.91.197.66
213.186.33.19
213.247.47.190
217.20.116.129
217.20.116.130
217.20.116.131
217.20.116.132
217.20.116.133
217.20.116.134
217.20.116.135
217.20.116.136
217.20.116.137
217.20.116.138
217.20.116.139
217.20.116.140
217.20.116.141
217.20.116.142
217.20.116.143
217.20.116.145
217.20.116.146
217.20.116.147
217.20.116.148
217.20.116.149
217.20.116.150
217.20.116.151
217.20.116.152
217.20.116.153

31
bambenek_ranbyus.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bambenek_ranbyus
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of ranbyus C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/ranbyus-iplist.txt
# Source File Date: Thu Feb 14 14:06:27 UTC 2019
#
# Category : malware
# Version : 101
#
# This File Date : Thu Feb 14 14:12:10 UTC 2019
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_ranbyus
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

162
bambenek_simda.ipset Normal file
View File

@ -0,0 +1,162 @@
#
# bambenek_simda
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of simda C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/simda-iplist.txt
# Source File Date: Wed Jul 29 20:19:03 UTC 2020
#
# Category : malware
# Version : 17362
#
# This File Date : Wed Jul 29 20:24:07 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 131 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_simda
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.157.84.170
14.128.136.68
23.89.102.127
23.236.62.147
31.11.32.144
31.186.169.41
31.217.192.121
34.98.99.30
34.102.136.180
45.82.253.244
46.28.105.107
46.30.215.127
46.30.215.202
46.242.242.252
46.249.43.105
52.25.92.0
52.58.78.16
54.65.172.3
62.97.115.37
62.129.200.14
62.149.128.72
62.149.128.74
62.149.128.151
62.149.128.154
62.149.128.157
62.149.128.160
62.149.128.163
62.149.128.166
62.149.181.236
62.153.122.95
67.229.36.115
69.162.80.54
69.162.80.58
77.111.240.49
77.111.240.59
79.170.40.236
80.85.86.6
80.237.132.180
81.2.194.62
81.2.194.128
81.2.194.176
81.169.145.68
81.169.145.84
81.169.145.93
81.169.145.94
81.169.145.105
81.169.145.161
81.177.165.51
82.98.135.43
82.100.220.53
84.38.224.155
85.13.129.76
85.13.132.239
85.114.135.128
85.128.185.12
85.236.47.218
87.98.230.60
88.198.56.106
89.31.143.1
89.46.108.57
91.121.59.137
91.121.154.229
91.174.205.10
91.195.241.136
91.199.77.50
91.212.28.29
91.223.145.130
92.43.203.171
92.61.39.239
93.185.103.42
93.190.48.3
94.152.8.56
95.211.117.215
95.211.219.65
104.27.180.160
104.27.181.160
104.28.26.243
104.28.27.243
104.28.28.252
104.28.29.252
116.202.231.184
141.105.126.87
146.148.34.125
149.216.106.61
157.7.188.207
162.217.99.134
162.255.119.102
163.172.86.124
169.50.13.61
172.67.156.67
172.67.157.206
172.67.184.127
173.236.178.74
178.254.10.14
185.26.105.244
185.51.65.38
185.66.237.14
185.114.108.15
185.181.104.74
185.183.8.67
185.232.248.163
188.93.150.101
188.165.143.5
192.64.147.231
193.41.64.176
194.9.94.85
194.9.94.86
194.150.113.18
194.242.61.31
195.74.38.62
195.110.124.188
199.34.228.76
199.59.242.153
205.144.171.124
208.91.197.91
209.140.30.61
210.172.183.32
211.43.203.53
212.57.32.149
212.85.106.71
213.186.33.5
217.70.184.38
217.74.71.168
217.116.16.235
217.160.0.59
217.160.0.97
217.160.0.169
217.160.0.225
217.160.0.239
217.160.122.61
217.160.233.84

139
bambenek_suppobox.ipset Normal file
View File

@ -0,0 +1,139 @@
#
# bambenek_suppobox
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of suppobox C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/suppobox-iplist.txt
# Source File Date: Wed Jul 29 20:19:32 UTC 2020
#
# Category : malware
# Version : 9682
#
# This File Date : Wed Jul 29 20:24:08 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 108 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_suppobox
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
18.216.20.136
23.83.35.75
23.227.38.65
23.236.62.147
34.102.136.180
34.198.7.77
34.202.122.77
34.225.38.128
35.169.225.248
35.186.238.101
35.231.184.193
39.106.40.57
43.226.23.42
45.133.2.132
45.192.23.245
45.199.245.19
46.30.213.209
46.166.189.98
52.0.7.30
54.36.56.87
54.84.104.245
62.233.121.5
63.251.235.71
66.6.44.4
66.96.161.157
67.195.197.24
67.227.226.240
69.163.184.176
69.172.201.218
72.26.218.72
74.96.70.52
74.208.236.135
75.2.37.224
80.77.123.65
81.28.232.67
83.140.241.13
84.49.232.107
87.98.242.65
89.106.12.49
94.136.40.82
95.143.172.148
97.74.182.1
98.124.199.77
103.67.235.120
104.16.12.194
104.16.13.194
104.16.14.194
104.16.15.194
104.16.16.194
104.27.188.229
104.27.189.229
104.248.50.87
104.248.60.43
104.248.63.231
104.248.63.248
106.249.28.73
112.216.156.206
121.42.239.99
121.78.197.82
121.254.178.233
137.220.193.208
138.207.69.72
139.129.156.33
150.95.255.38
151.80.184.231
154.208.167.236
157.65.171.29
157.245.130.6
159.8.210.35
161.47.102.211
162.217.99.134
162.217.99.139
162.217.99.141
162.241.194.34
162.241.224.134
162.241.224.200
162.243.212.245
162.255.119.8
162.255.119.250
172.67.154.177
173.231.184.119
173.231.189.30
173.236.166.37
185.55.85.123
192.64.119.20
192.64.119.148
192.64.119.202
192.227.107.19
193.93.253.54
194.59.222.76
198.54.117.197
198.54.117.198
198.54.117.199
198.54.117.200
199.34.228.69
199.59.242.153
206.191.152.37
206.191.152.49
207.96.1.77
208.91.197.26
208.91.197.27
208.91.197.46
208.91.197.91
208.91.197.194
212.96.137.160
213.186.33.5
213.250.113.193
217.160.0.16

32
bambenek_symmi.ipset Normal file
View File

@ -0,0 +1,32 @@
#
# bambenek_symmi
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of symmi C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/symmi-iplist.txt
# Source File Date: Fri Jun 26 10:49:11 UTC 2020
#
# Category : malware
# Version : 14
#
# This File Date : Fri Jun 26 10:56:26 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_symmi
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
208.100.26.245

35
bambenek_tinba.ipset Normal file
View File

@ -0,0 +1,35 @@
#
# bambenek_tinba
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of tinba C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/tinba-iplist.txt
# Source File Date: Wed Jul 29 16:20:23 UTC 2020
#
# Category : malware
# Version : 3576
#
# This File Date : Wed Jul 29 16:24:10 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 4 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_tinba
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
198.54.117.197
198.54.117.198
198.54.117.199
198.54.117.200

32
bambenek_volatile.ipset Normal file
View File

@ -0,0 +1,32 @@
#
# bambenek_volatile
#
# ipv4 hash:ip ipset
#
# [Bambenek Consulting]
# (http://osint.bambenekconsulting.com/feeds/) feed of
# current IPs of volatile C&Cs with 90 minute lookback
#
# Maintainer : Bambenek Consulting
# Maintainer URL : http://osint.bambenekconsulting.com/feeds/
# List source URL : http://osint.bambenekconsulting.com/feeds/volatile-iplist.txt
# Source File Date: Fri Feb 7 15:08:38 UTC 2020
#
# Category : malware
# Version : 10
#
# This File Date : Fri Feb 7 15:12:21 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bambenek_volatile
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
169.50.13.61

2717
bbcan177_ms1.netset Normal file
View File

File diff suppressed because it is too large Load Diff

1175
bbcan177_ms3.netset Normal file
View File

File diff suppressed because it is too large Load Diff

358
bds_atif.ipset Normal file
View File

@ -0,0 +1,358 @@
#
# bds_atif
#
# ipv4 hash:ip ipset
#
# Artillery Threat Intelligence Feed and Banlist Feed
#
# Maintainer : Binary Defense Systems
# Maintainer URL : https://www.binarydefense.com/
# List source URL : https://www.binarydefense.com/banlist.txt
# Source File Date: Tue Mar 16 16:30:08 UTC 2021
#
# Category : reputation
# Version : 1009
#
# This File Date : Tue Mar 16 16:48:04 UTC 2021
# Update Frequency: 1 day
# Aggregation : none
# Entries : 329 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bds_atif
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.6.164.50
1.9.164.35
2.57.122.97
5.9.187.180
5.182.210.70
5.253.84.215
13.88.221.123
14.17.84.10
14.50.234.143
14.140.245.26
14.142.75.234
14.166.111.151
14.168.221.226
14.169.207.33
14.171.70.23
14.179.198.127
14.181.53.204
14.228.48.126
14.230.242.11
14.250.227.112
14.255.59.17
18.216.30.14
20.83.32.200
27.68.121.150
27.72.72.54
27.79.135.228
27.79.194.3
27.110.152.142
31.6.114.47
31.23.3.100
31.186.24.111
35.187.190.226
36.80.3.229
36.90.44.169
36.91.191.169
37.104.191.43
37.151.86.252
40.72.103.145
41.32.217.50
41.66.231.189
41.212.221.66
42.112.17.30
42.114.173.35
42.228.2.150
42.243.229.151
45.33.40.191
45.33.65.38
45.70.126.9
45.115.89.121
45.135.232.165
45.160.181.46
45.182.104.226
45.183.220.46
45.233.137.11
46.101.7.141
46.167.65.54
46.187.6.98
49.37.185.47
49.146.59.85
49.206.201.102
50.225.101.181
52.247.207.35
58.179.134.126
58.218.204.51
59.89.93.69
59.92.9.200
60.251.145.235
61.177.173.8
62.60.177.198
65.49.20.69
66.240.219.146
72.255.61.76
77.83.36.101
78.83.11.98
78.85.4.132
78.187.239.66
78.188.233.15
79.124.62.246
79.132.174.94
81.161.63.100
81.214.67.232
81.248.44.206
82.147.78.134
84.53.247.55
85.89.176.147
85.105.13.97
87.235.101.226
87.251.70.85
87.251.70.87
87.251.75.145
88.208.236.9
88.225.253.64
88.244.196.190
88.249.104.169
89.6.64.137
89.122.211.151
89.248.165.163
91.192.44.34
91.218.102.22
91.219.144.109
92.118.161.45
92.126.196.244
93.63.115.107
94.232.47.130
95.30.167.109
95.128.188.162
95.173.236.140
102.185.4.68
103.4.31.142
103.26.53.210
103.48.25.250
103.54.85.22
103.87.106.156
103.89.91.156
103.89.170.107
103.92.41.196
103.97.166.130
103.98.152.239
103.127.66.170
103.205.179.81
103.226.226.2
104.206.128.10
104.206.128.42
105.112.108.192
106.86.52.103
106.198.152.253
106.198.219.205
110.49.41.103
111.59.65.15
111.68.101.130
112.213.119.235
113.70.128.95
113.105.79.98
113.141.67.162
113.173.203.51
113.180.146.20
113.218.129.172
114.41.130.28
114.134.93.202
116.0.49.52
116.96.77.239
116.103.223.100
117.4.152.180
117.44.173.174
117.69.233.112
117.223.187.146
117.254.186.98
118.69.0.93
118.69.191.34
118.175.4.42
119.178.12.134
121.196.232.56
122.2.27.36
122.227.174.246
122.238.25.120
124.95.165.194
124.109.55.225
124.123.106.111
125.166.89.247
128.199.13.234
132.148.83.132
138.197.178.37
139.59.58.25
139.59.102.231
139.162.108.129
139.162.145.250
139.201.164.231
141.98.10.149
141.98.10.207
143.110.155.74
143.198.57.195
143.198.225.126
146.120.225.251
146.145.113.183
150.249.224.82
151.106.34.191
156.196.161.102
156.204.247.44
159.69.37.19
162.142.125.38
162.142.125.54
162.142.125.128
163.53.180.115
164.90.145.3
164.155.88.18
167.71.4.188
167.71.12.46
167.71.12.120
167.248.133.40
167.248.133.53
168.63.250.211
168.119.249.52
168.194.72.50
168.194.72.67
170.246.134.126
171.111.153.171
171.238.50.160
171.243.167.13
172.105.218.213
173.82.151.65
176.59.98.137
176.111.173.16
176.113.117.3
177.8.164.99
177.10.250.131
177.12.58.162
177.72.197.25
177.207.204.230
177.215.94.3
177.222.42.170
178.73.215.171
178.74.92.235
178.207.99.23
179.118.217.212
179.183.176.148
179.191.245.5
180.171.132.83
180.243.15.146
180.243.15.251
180.244.125.73
181.48.233.147
181.57.167.193
182.72.104.66
183.196.172.36
184.105.247.254
185.19.77.159
185.56.80.222
185.88.175.37
185.136.193.33
185.141.104.55
185.153.199.131
185.156.72.10
185.167.96.236
185.176.222.74
185.202.1.24
185.202.1.122
185.202.1.124
185.202.2.66
185.202.2.131
185.220.101.7
186.0.176.225
186.33.113.134
186.193.207.158
187.1.181.117
187.84.232.214
187.121.162.216
187.141.241.118
187.153.160.203
187.168.221.223
187.170.135.210
188.124.36.157
188.162.44.174
189.32.148.92
189.39.10.53
189.48.184.173
189.129.151.50
189.131.245.44
189.172.67.118
189.254.93.67
189.254.153.242
190.7.61.58
190.36.252.248
190.73.245.202
190.78.32.58
190.85.177.210
190.104.214.20
190.215.57.118
191.35.119.174
192.100.163.2
192.145.213.24
192.241.219.57
192.241.221.122
192.241.226.104
193.32.164.24
193.46.255.34
193.239.86.165
194.61.54.112
194.61.55.94
195.246.120.95
197.44.212.155
197.156.129.254
198.204.240.90
199.195.251.205
200.85.158.83
200.110.156.234
200.202.246.178
201.249.13.210
202.51.111.214
202.142.177.84
202.164.138.215
202.166.198.71
203.113.130.219
203.150.54.178
203.160.187.6
205.185.122.102
205.240.77.231
207.250.96.210
209.13.179.84
210.14.130.35
212.169.233.161
213.27.6.28
216.218.206.66
217.74.162.221
218.22.48.134
218.91.237.35
218.95.37.13
218.154.242.48
220.102.178.162
220.137.164.210
220.178.67.242
221.131.165.23
221.131.165.86
221.181.185.19
221.181.185.135
221.181.185.140
221.181.185.143
221.181.185.150
221.181.185.151
221.181.185.198
221.181.185.220
221.181.185.223
221.181.185.237
221.232.69.100
222.187.232.205
222.187.232.213
222.187.239.31
222.243.207.104
223.180.176.8
223.197.168.60

19373
bi_any_0_1d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

1211
bi_any_1_7d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

225
bi_any_2_1d.ipset Normal file
View File

@ -0,0 +1,225 @@
#
# bi_any_2_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# any with score above 2 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/any/2?age=1d
# Source File Date: Mon Dec 14 14:09:34 UTC 2020
#
# Category : attacks
# Version : 37826
#
# This File Date : Mon Dec 14 14:09:34 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 195 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_any_2_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.179.186.174
5.8.10.202
5.196.95.80
14.215.237.205
14.232.160.213
31.14.140.241
35.193.104.24
37.153.32.237
37.187.0.20
37.187.125.87
37.187.181.182
41.39.134.88
41.223.142.211
46.148.20.25
50.62.177.206
51.38.51.200
51.254.120.159
54.38.183.181
58.17.243.151
61.72.255.26
61.147.107.94
61.177.172.13
61.177.172.54
61.177.172.61
61.177.172.107
61.183.144.188
62.94.206.57
62.210.105.116
62.210.185.4
71.6.135.131
72.12.203.182
76.72.169.18
77.82.90.234
77.247.181.163
80.82.78.104
80.244.224.122
82.200.226.226
86.107.110.78
87.106.30.24
87.118.122.51
89.31.57.5
89.97.218.142
91.208.99.2
92.198.28.38
93.174.95.106
96.125.228.110
101.231.241.170
103.4.217.139
103.43.185.166
103.69.124.247
103.76.252.6
103.205.68.2
103.242.56.122
104.236.246.16
106.38.99.158
106.243.87.162
106.245.95.116
107.170.172.23
107.170.227.141
109.81.181.238
109.227.63.3
111.11.181.53
111.68.46.68
111.93.235.74
112.85.42.53
112.85.42.102
112.85.42.110
112.85.42.151
112.85.42.196
112.85.42.230
112.95.225.158
113.98.193.58
115.88.201.58
115.231.0.56
115.238.97.2
117.34.91.22
117.144.189.69
117.149.0.90
117.232.127.51
118.25.44.66
118.98.127.138
119.45.49.240
119.252.170.2
120.31.129.135
121.142.146.167
122.114.70.12
122.194.229.3
123.207.74.24
124.123.98.19
124.235.171.114
125.19.153.156
125.212.233.50
129.122.16.156
138.97.94.96
139.162.75.112
139.162.122.110
139.199.14.128
139.220.192.57
143.255.140.164
145.239.76.62
149.202.56.228
149.202.102.36
151.80.41.64
151.80.144.233
151.80.155.98
154.68.5.109
157.55.39.31
158.69.194.115
160.174.129.174
162.247.72.199
164.132.47.139
164.132.56.243
164.163.99.10
165.227.124.168
168.226.218.253
171.25.193.20
171.25.193.77
171.25.193.78
172.104.108.109
176.31.128.45
177.67.83.215
177.73.136.228
177.131.11.190
178.205.136.242
180.76.246.38
180.97.80.246
181.40.76.162
181.53.251.181
181.129.14.218
182.74.25.246
184.168.46.188
185.53.168.96
185.81.157.102
185.100.87.207
185.100.87.247
185.128.13.34
185.143.223.136
185.182.56.17
185.220.101.1
185.220.101.10
185.220.102.6
185.220.102.7
187.217.199.20
188.165.235.21
188.166.1.95
188.166.34.129
189.90.255.173
190.144.14.170
190.144.139.76
190.151.100.10
190.213.180.98
191.7.145.246
192.0.2.1
193.70.0.42
194.105.205.42
195.36.136.59
196.35.41.109
196.38.70.24
196.44.176.55
198.71.239.51
200.29.120.94
200.44.50.155
200.204.174.163
200.216.31.148
201.22.95.52
202.120.38.51
202.131.152.2
202.144.77.4
203.66.168.81
203.81.78.180
203.213.66.170
204.194.29.4
206.174.214.90
206.189.127.6
207.154.193.178
208.100.26.232
210.12.127.66
210.177.243.102
210.206.92.137
211.99.229.3
211.155.225.104
211.253.10.96
218.28.238.162
218.56.11.181
219.142.19.70
219.239.47.66
219.248.137.7
220.120.106.254
220.130.80.216
221.7.213.133
221.143.48.143
221.202.168.254
222.122.179.208
222.185.231.246
223.197.188.206

1189
bi_any_2_30d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

1006
bi_any_2_7d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

39
bi_apache-404_0_1d.ipset Normal file
View File

@ -0,0 +1,39 @@
#
# bi_apache-404_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# apache-404 with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/apache-404/0?age=1d
# Source File Date: Mon Dec 14 13:00:21 UTC 2020
#
# Category : attacks
# Version : 3990
#
# This File Date : Mon Dec 14 13:00:21 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 9 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_apache-404_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
13.235.246.122
18.232.185.155
51.4.147.32
93.158.90.91
106.12.179.102
161.35.89.147
172.105.13.165
185.100.87.247
188.166.6.11

32
bi_apache-modsec_0_1d.ipset Normal file
View File

@ -0,0 +1,32 @@
#
# bi_apache-modsec_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# apache-modsec with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/apache-modsec/0?age=1d
# Source File Date: Mon Dec 14 14:09:38 UTC 2020
#
# Category : attacks
# Version : 12664
#
# This File Date : Mon Dec 14 14:09:38 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 2 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_apache-modsec_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
51.104.242.82
103.254.154.72

84
bi_apache-noscript_0_1d.ipset Normal file
View File

@ -0,0 +1,84 @@
#
# bi_apache-noscript_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# apache-noscript with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/apache-noscript/0?age=1d
# Source File Date: Mon Dec 14 13:00:22 UTC 2020
#
# Category : attacks
# Version : 28804
#
# This File Date : Mon Dec 14 13:00:22 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 54 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_apache-noscript_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.210.227
18.191.254.247
37.46.150.5
42.232.237.181
44.242.137.72
45.154.255.68
49.51.160.107
61.219.11.153
64.227.99.233
66.228.35.12
72.79.58.112
80.82.65.74
83.239.90.50
84.17.46.203
91.241.19.84
94.232.47.20
103.47.104.243
112.30.110.32
117.202.65.56
117.251.61.19
119.27.167.61
134.19.215.196
139.59.99.103
140.143.19.50
159.65.228.60
159.65.228.79
161.35.230.3
161.97.128.124
165.232.104.32
165.232.108.164
172.104.242.173
172.105.89.161
178.128.182.135
178.128.185.5
188.166.63.105
188.166.94.6
192.144.130.54
192.241.150.141
192.241.211.132
192.241.215.127
192.241.215.216
192.241.217.64
192.241.220.224
192.241.235.74
192.241.235.126
192.241.236.123
193.112.94.225
194.48.199.121
198.211.110.224
207.46.13.218
208.115.198.74
213.180.203.11
221.4.133.52
221.120.43.181

33
bi_apache-noscript_2_30d.ipset Normal file
View File

@ -0,0 +1,33 @@
#
# bi_apache-noscript_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# apache-noscript with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/apache-noscript/2?age=30d
# Source File Date: Fri Dec 4 09:44:35 UTC 2020
#
# Category : attacks
# Version : 387
#
# This File Date : Fri Dec 4 09:44:35 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 3 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_apache-noscript_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
64.246.165.200
66.240.205.34
176.10.99.200

31
bi_apache-phpmyadmin_0_1d.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bi_apache-phpmyadmin_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# apache-phpmyadmin with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/apache-phpmyadmin/0?age=1d
# Source File Date: Mon Dec 14 09:04:13 UTC 2020
#
# Category : attacks
# Version : 5584
#
# This File Date : Mon Dec 14 09:04:14 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_apache-phpmyadmin_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
58.244.255.45

427
bi_apache-scriddies_0_1d.ipset Normal file
View File

@ -0,0 +1,427 @@
#
# bi_apache-scriddies_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# apache-scriddies with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/apache-scriddies/0?age=1d
# Source File Date: Thu Oct 29 18:32:43 UTC 2020
#
# Category : attacks
# Version : 16314
#
# This File Date : Thu Oct 29 18:32:43 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 397 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_apache-scriddies_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.168.86.209
2.100.89.131
2.152.197.190
3.237.23.111
5.151.23.1
5.157.14.208
5.173.155.216
5.188.62.214
13.68.244.143
13.82.232.196
14.192.213.81
23.108.252.157
24.86.134.112
24.186.56.5
27.34.13.177
27.125.241.68
31.22.148.236
31.176.164.141
31.206.14.233
31.223.107.136
34.66.110.7
34.91.148.234
34.123.189.223
35.175.180.66
37.248.152.236
39.82.200.106
39.82.201.42
39.82.201.86
39.82.201.131
40.70.23.7
41.47.152.188
41.78.73.158
41.80.97.224
41.97.22.133
41.143.23.61
41.147.0.201
41.147.0.202
45.40.166.158
45.70.185.138
45.247.195.164
46.4.83.150
46.76.22.215
46.99.1.112
46.123.253.165
46.150.253.42
46.150.255.126
46.217.170.145
49.64.105.47
49.68.250.199
49.72.133.41
49.81.172.76
49.81.173.128
49.81.174.30
49.81.174.87
49.81.222.94
49.146.13.161
50.63.194.60
50.63.194.175
50.67.210.135
50.100.112.74
51.39.230.77
51.195.200.217
51.223.139.126
52.255.207.231
58.214.185.135
58.214.187.54
58.214.187.159
58.214.188.154
58.214.188.219
58.214.189.242
58.214.191.0
59.52.37.158
59.52.102.184
59.53.166.21
59.55.114.78
59.56.2.63
59.61.164.118
59.166.129.237
61.52.72.229
61.52.72.243
61.52.73.126
61.52.76.111
61.52.76.129
61.52.76.135
61.52.77.248
61.52.78.213
61.52.79.156
67.198.237.229
67.218.247.182
68.102.193.125
70.77.14.226
71.9.175.220
72.66.100.103
72.167.190.212
72.204.51.189
73.6.37.148
73.125.207.184
77.28.68.232
77.111.40.197
77.246.52.163
77.247.148.150
77.247.250.66
78.1.27.4
78.19.64.216
78.82.5.122
78.99.58.24
78.158.4.22
78.220.209.125
79.17.75.32
79.32.117.239
79.100.174.245
79.145.10.87
81.182.80.127
82.78.22.74
83.165.144.9
84.26.128.24
84.108.97.13
84.195.95.107
84.236.218.72
84.254.56.183
85.139.118.122
85.243.201.70
86.15.127.132
86.96.73.110
87.75.182.20
87.116.161.133
87.116.167.248
87.116.181.251
91.203.194.70
91.249.22.209
93.35.217.62
93.36.166.59
93.40.195.84
93.42.97.118
93.49.243.234
94.2.1.68
94.31.100.26
94.68.184.54
94.204.248.120
95.90.239.8
95.91.238.35
95.149.200.245
95.180.49.235
95.180.117.113
95.233.209.119
97.74.24.95
97.74.228.81
99.116.59.65
99.189.69.149
101.71.232.45
101.71.232.161
101.71.232.206
101.71.233.12
101.71.233.130
101.71.233.164
101.71.233.191
101.71.234.149
101.71.234.154
101.71.234.185
102.132.221.215
103.6.196.175
104.210.214.37
104.214.79.46
105.105.108.130
107.180.120.52
107.180.120.69
108.52.194.251
108.83.91.38
109.77.15.143
109.152.52.212
110.52.235.77
110.52.235.116
110.52.235.146
110.52.235.151
110.90.12.141
110.90.12.165
111.164.172.114
111.164.172.177
111.164.179.127
111.164.182.229
111.164.189.20
112.134.113.168
112.134.214.169
113.58.224.35
113.58.229.4
113.58.230.144
113.58.234.225
113.58.235.245
113.58.237.180
113.58.239.58
113.58.240.224
113.58.242.247
113.210.197.239
114.220.235.82
114.220.235.89
114.225.186.15
114.234.156.175
114.234.157.204
114.234.157.211
115.164.85.206
115.202.73.131
115.202.74.221
115.202.78.91
115.202.87.66
115.202.92.73
115.202.95.211
115.239.26.222
116.2.64.112
116.2.73.58
116.2.74.87
116.2.75.25
116.2.77.69
116.2.81.13
116.2.81.169
116.2.82.84
116.2.92.60
116.2.95.24
117.25.6.85
117.25.6.90
117.29.120.113
117.40.114.48
117.40.114.54
117.40.114.144
117.81.84.10
117.85.12.142
117.85.12.177
117.87.66.24
119.29.93.25
120.32.38.68
121.29.80.41
121.29.80.48
121.29.80.65
121.29.80.71
121.29.80.159
121.29.80.179
121.29.80.253
121.29.81.157
121.29.81.165
121.29.81.196
121.121.52.14
121.204.0.44
121.224.208.97
121.224.216.68
121.227.28.210
121.228.147.85
121.235.168.72
124.163.36.133
124.163.36.153
124.163.36.157
124.163.36.158
124.163.37.61
124.163.38.103
124.163.39.58
124.163.39.125
124.163.164.57
124.163.164.105
124.163.164.207
124.163.165.203
124.163.166.56
124.163.166.174
125.77.0.55
125.104.233.218
125.104.240.167
125.111.40.59
125.111.41.51
125.111.41.66
125.111.41.208
125.111.41.218
125.111.41.243
125.111.43.25
125.123.136.241
125.123.137.19
125.123.139.11
125.123.141.255
128.199.123.87
129.146.75.180
132.148.86.198
132.148.104.135
138.68.88.149
138.246.253.15
140.224.112.108
140.224.112.115
141.226.247.213
142.44.179.150
145.87.245.20
147.135.28.105
149.200.209.23
151.24.167.113
151.34.179.10
156.17.118.225
156.212.147.42
156.213.128.145
158.69.248.120
160.153.147.130
160.153.154.6
160.153.156.141
162.157.161.178
162.241.216.32
162.245.154.213
171.116.206.30
172.72.16.242
175.176.50.246
176.31.244.49
176.58.224.226
176.63.16.145
176.228.11.168
177.22.23.178
178.32.217.133
178.221.252.36
179.6.210.150
179.145.38.194
179.180.169.124
179.213.141.250
180.104.187.212
180.104.239.103
180.107.125.190
180.107.131.88
180.108.72.93
180.108.72.136
180.112.18.55
180.114.220.32
181.46.78.115
183.171.72.195
183.185.196.61
183.185.196.102
183.185.196.111
183.185.197.183
184.105.3.5
184.168.152.174
184.168.193.28
184.168.193.136
184.168.193.196
185.150.190.196
185.165.36.30
185.211.42.181
185.219.178.141
186.1.207.172
186.18.136.165
186.84.88.118
186.107.161.253
186.143.163.110
186.169.36.30
186.220.39.242
186.247.252.212
187.190.153.231
187.198.19.93
188.82.168.168
188.120.117.91
188.127.115.206
188.166.96.5
188.213.34.100
189.34.167.20
189.216.206.222
189.225.137.167
190.5.35.163
190.25.41.133
190.104.168.44
190.230.74.57
190.236.71.251
191.5.198.189
191.243.204.165
193.27.229.26
193.165.236.207
195.43.189.68
195.181.170.158
196.188.244.115
197.15.11.183
197.15.29.7
197.166.113.149
197.238.218.63
198.71.227.33
201.219.239.182
202.60.56.240
203.126.83.2
204.145.6.136
209.51.197.138
209.51.205.98
211.59.244.26
212.200.101.142
213.149.61.54
216.10.217.237
217.138.199.169
217.234.104.136
218.5.28.117
218.73.118.122
218.73.119.54
218.74.226.111
218.150.10.166
220.160.18.2
220.160.18.63
220.175.166.169
220.177.9.16
220.177.9.82
222.93.30.35
222.135.230.8
222.191.172.127
222.191.173.255

221
bi_apache_0_1d.ipset Normal file
View File

@ -0,0 +1,221 @@
#
# bi_apache_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# apache with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/apache/0?age=1d
# Source File Date: Mon Dec 14 14:09:36 UTC 2020
#
# Category : attacks
# Version : 38387
#
# This File Date : Mon Dec 14 14:09:36 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 191 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_apache_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.206.202
5.188.210.227
13.235.246.122
18.191.254.247
18.232.185.155
27.255.75.6
34.90.63.44
34.90.160.66
34.90.161.145
34.91.46.97
35.204.14.75
37.28.193.117
37.46.150.5
37.59.47.61
37.170.0.183
41.226.8.25
42.76.76.75
42.76.152.165
42.232.237.181
44.242.137.72
45.154.255.68
46.235.183.28
49.51.160.107
49.233.28.77
51.4.147.32
51.11.39.131
51.89.164.205
51.104.242.82
51.210.242.135
52.188.3.122
54.201.116.88
58.34.34.251
58.244.255.45
58.247.51.194
59.42.236.139
61.219.11.153
62.34.64.186
62.148.157.150
64.227.99.233
66.228.35.12
72.79.58.112
77.130.24.40
77.197.177.103
78.128.113.66
78.156.235.162
78.224.249.41
80.82.65.74
81.185.173.111
81.200.23.2
83.239.90.50
84.17.46.203
86.20.39.158
87.175.190.118
90.88.59.165
91.241.19.84
93.158.90.91
94.190.19.121
94.232.47.20
96.44.162.82
99.151.215.62
101.200.77.111
103.47.104.243
103.76.228.45
103.151.122.3
103.254.154.72
104.129.4.186
106.5.105.47
106.12.179.102
109.23.14.103
109.210.241.233
111.82.55.239
111.83.38.239
111.83.78.2
111.251.205.119
112.30.1.230
112.30.110.32
114.16.9.180
114.129.22.85
115.53.237.133
115.148.72.253
117.202.65.56
117.251.61.19
118.89.65.15
119.27.167.61
119.45.140.92
123.133.133.22
123.240.9.144
128.106.166.8
134.19.215.196
138.118.166.15
139.59.99.103
139.59.126.122
140.143.19.50
142.44.251.104
146.66.164.59
154.68.5.109
154.68.5.131
157.55.39.31
158.69.158.101
159.65.202.139
159.65.228.60
159.65.228.79
161.35.89.147
161.35.230.3
161.97.128.124
162.247.73.192
163.22.10.129
163.22.10.130
165.231.143.134
165.232.104.32
165.232.108.164
172.104.242.173
172.105.13.165
172.105.89.161
176.60.197.241
178.27.234.56
178.128.182.135
178.128.185.5
180.177.240.130
181.143.101.194
182.84.163.107
182.84.187.207
182.101.179.47
182.107.251.213
183.56.212.208
185.100.87.247
185.220.100.245
185.244.41.7
185.244.41.10
185.244.41.14
185.244.41.18
185.244.41.19
185.244.41.21
185.244.41.32
185.244.41.33
185.244.41.34
185.244.41.35
185.244.41.37
185.244.41.38
185.244.41.39
185.244.41.40
185.244.41.41
185.244.41.42
185.244.41.43
185.244.41.44
185.244.41.45
185.244.41.46
188.165.194.99
188.165.239.211
188.166.6.11
188.166.63.105
188.166.94.6
188.166.178.83
188.191.126.153
190.8.42.10
192.99.0.98
192.144.130.54
192.241.150.141
192.241.211.132
192.241.215.127
192.241.215.216
192.241.217.64
192.241.220.224
192.241.235.74
192.241.235.126
192.241.236.123
193.112.94.225
194.48.199.121
195.161.41.222
196.112.2.238
198.71.238.15
198.211.110.224
204.44.104.170
207.46.13.218
208.115.198.74
209.141.50.5
212.70.149.5
212.70.149.53
212.70.149.84
213.180.203.11
217.24.152.97
221.4.133.52
221.120.43.181
223.130.29.3
223.141.173.67
223.141.243.86
240.23.228.217
244.133.132.141
246.74.187.120
246.226.180.50
248.51.160.147

37
bi_apache_1_7d.ipset Normal file
View File

@ -0,0 +1,37 @@
#
# bi_apache_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# apache with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/apache/1?age=7d
# Source File Date: Mon Dec 14 03:56:17 UTC 2020
#
# Category : attacks
# Version : 2382
#
# This File Date : Mon Dec 14 03:56:17 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 7 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_apache_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.211.72
66.249.65.85
66.249.66.86
66.249.66.222
94.102.49.26
157.55.39.31
185.100.87.247

39
bi_apache_2_30d.ipset Normal file
View File

@ -0,0 +1,39 @@
#
# bi_apache_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# apache with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/apache/2?age=30d
# Source File Date: Mon Dec 14 11:44:36 UTC 2020
#
# Category : attacks
# Version : 766
#
# This File Date : Mon Dec 14 11:44:36 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 9 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_apache_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
64.246.165.200
66.240.205.34
66.249.65.85
66.249.66.86
94.102.49.26
103.8.12.100
157.55.39.31
176.10.99.200
185.100.87.247

30
bi_apacheddos_0_1d.ipset Normal file
View File

@ -0,0 +1,30 @@
#
# bi_apacheddos_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# apacheddos with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/apacheddos/0?age=1d
# Source File Date: Sat Dec 5 07:52:13 UTC 2020
#
# Category : attacks
# Version : 3079
#
# This File Date : Wed Dec 9 10:44:40 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_apacheddos_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

33
bi_assp_0_1d.ipset Normal file
View File

@ -0,0 +1,33 @@
#
# bi_assp_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# assp with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/assp/0?age=1d
# Source File Date: Mon Dec 14 13:32:40 UTC 2020
#
# Category : attacks
# Version : 16751
#
# This File Date : Mon Dec 14 13:32:40 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 3 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_assp_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
77.40.3.185
77.40.13.202
103.141.136.70

90
bi_asterisk_0_1d.ipset Normal file
View File

@ -0,0 +1,90 @@
#
# bi_asterisk_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# asterisk with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/asterisk/0?age=1d
# Source File Date: Mon Dec 14 14:09:41 UTC 2020
#
# Category : attacks
# Version : 31479
#
# This File Date : Mon Dec 14 14:09:41 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 60 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_asterisk_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.104.110.58
5.154.174.59
13.68.212.39
13.74.8.177
13.74.165.56
20.51.214.254
20.51.221.172
23.101.154.243
23.146.241.135
37.49.230.221
40.117.195.50
45.56.137.128
45.58.126.218
50.7.9.206
51.11.180.162
51.103.50.173
51.161.20.122
51.195.57.145
51.195.57.147
51.195.57.149
51.195.57.151
51.195.57.152
51.195.57.153
51.195.57.154
51.195.57.156
52.152.239.109
52.162.206.182
80.94.93.101
80.94.93.103
80.94.93.104
80.94.93.107
80.94.93.117
103.145.13.43
104.215.176.78
134.119.206.202
137.117.87.152
147.135.254.96
156.96.58.106
158.140.126.2
163.47.20.26
164.132.63.18
164.132.63.24
165.227.129.215
176.31.226.188
176.67.86.203
178.32.116.69
185.132.250.137
185.147.213.12
185.147.213.14
185.147.215.14
193.32.8.14
193.32.8.68
193.32.8.87
193.32.8.91
193.32.8.128
200.25.20.248
209.234.248.192
212.108.234.104
217.138.215.179
217.182.199.121

35
bi_asterisk_2_30d.ipset Normal file
View File

@ -0,0 +1,35 @@
#
# bi_asterisk_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# asterisk with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/asterisk/2?age=30d
# Source File Date: Thu Dec 3 09:32:12 UTC 2020
#
# Category : attacks
# Version : 356
#
# This File Date : Thu Dec 3 09:32:12 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 5 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_asterisk_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
155.94.64.74
188.161.186.186
188.165.222.17
195.154.56.166
198.27.70.131

1233
bi_badbots_0_1d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

204
bi_badbots_1_7d.ipset Normal file
View File

@ -0,0 +1,204 @@
#
# bi_badbots_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# badbots with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/badbots/1?age=7d
# Source File Date: Mon Dec 14 03:56:19 UTC 2020
#
# Category : attacks
# Version : 3100
#
# This File Date : Mon Dec 14 03:56:19 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 174 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_badbots_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.237.174.253
5.8.10.202
37.49.224.218
37.153.32.237
37.187.181.182
41.39.134.88
41.73.252.236
41.208.150.114
41.223.142.211
46.148.192.41
51.254.37.192
51.254.220.20
51.255.35.58
54.36.182.244
54.37.69.251
58.17.243.151
58.210.96.156
61.72.255.26
61.76.169.138
61.177.172.13
61.177.172.41
61.177.172.54
61.177.172.61
61.177.172.107
62.94.206.57
66.249.64.85
66.249.64.87
66.249.64.89
66.249.64.90
66.249.64.91
66.249.64.213
66.249.64.215
66.249.64.217
66.249.65.98
66.249.65.124
66.249.65.126
66.249.65.130
66.249.65.132
66.249.66.154
66.249.66.155
66.249.66.213
66.249.66.215
66.249.66.217
66.249.69.107
66.249.69.109
66.249.69.244
66.249.69.246
66.249.69.248
66.249.70.7
66.249.73.75
66.249.73.77
66.249.73.79
66.249.73.83
66.249.73.85
66.249.73.149
66.249.73.151
66.249.73.153
66.249.75.31
66.249.75.154
66.249.75.156
66.249.75.158
66.249.79.49
66.249.79.105
66.249.79.107
66.249.79.109
66.249.79.111
66.249.79.143
72.12.203.182
80.82.78.104
82.200.65.218
92.222.84.34
94.181.94.12
96.57.82.166
103.23.100.87
103.36.84.100
107.170.48.64
109.173.40.60
109.195.198.27
109.227.63.3
111.11.181.53
111.231.119.141
112.85.42.53
112.85.42.102
112.85.42.110
112.85.42.151
112.85.42.196
112.85.42.230
112.85.42.231
112.95.225.158
112.215.113.10
113.160.244.144
115.88.201.58
115.159.25.60
115.238.97.2
117.50.13.29
117.232.127.51
118.98.127.138
118.126.105.120
119.29.2.157
120.92.173.154
121.12.151.250
122.176.40.9
122.194.229.3
122.227.159.84
123.127.107.70
123.127.244.100
123.207.107.144
125.19.153.156
125.212.207.205
125.212.224.41
125.212.233.50
125.227.236.60
129.122.16.156
137.74.199.177
138.197.216.162
139.59.249.255
139.99.105.138
142.4.204.122
142.4.214.151
149.56.15.98
149.202.214.11
151.80.144.233
151.80.155.98
159.65.12.204
164.132.47.139
164.132.56.243
164.132.225.151
164.163.99.10
171.221.210.158
172.104.108.109
179.190.96.146
180.76.187.94
180.76.246.38
180.166.192.66
180.250.205.114
181.40.76.162
181.53.251.181
181.118.94.57
182.74.25.246
185.53.168.96
186.87.32.48
187.60.36.104
187.190.236.88
189.6.45.130
189.112.109.185
190.85.34.140
190.98.228.54
190.145.5.170
193.58.196.146
196.38.70.24
197.251.207.20
198.50.197.216
200.195.171.74
200.204.174.163
201.22.95.52
202.51.110.214
202.88.252.53
202.131.152.2
203.81.78.180
203.129.218.76
203.154.162.168
203.213.66.170
203.236.51.35
206.174.214.90
210.21.226.2
211.252.86.82
212.44.65.22
212.170.50.203
213.174.147.83
218.28.238.162
218.75.132.59
219.153.31.186
222.252.16.140
222.252.30.117

1470
bi_bruteforce_0_1d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

210
bi_bruteforce_1_7d.ipset Normal file
View File

@ -0,0 +1,210 @@
#
# bi_bruteforce_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# bruteforce with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/bruteforce/1?age=7d
# Source File Date: Mon Dec 14 03:56:20 UTC 2020
#
# Category : attacks
# Version : 3114
#
# This File Date : Mon Dec 14 03:56:20 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 180 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_bruteforce_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.237.174.253
5.8.10.202
37.49.224.218
37.153.32.237
37.187.181.182
41.39.134.88
41.73.252.236
41.208.150.114
41.223.142.211
46.148.192.41
49.248.148.165
51.254.37.192
51.254.220.20
51.255.35.58
54.36.182.244
54.37.69.251
58.17.243.151
58.210.96.156
61.72.255.26
61.76.169.138
61.177.172.13
61.177.172.41
61.177.172.54
61.177.172.61
61.177.172.107
62.94.206.57
66.249.64.85
66.249.64.87
66.249.64.89
66.249.64.90
66.249.64.91
66.249.64.213
66.249.64.215
66.249.64.217
66.249.65.98
66.249.65.124
66.249.65.126
66.249.65.130
66.249.65.132
66.249.66.154
66.249.66.155
66.249.66.213
66.249.66.215
66.249.66.217
66.249.69.107
66.249.69.109
66.249.69.244
66.249.69.246
66.249.69.248
66.249.70.7
66.249.73.75
66.249.73.77
66.249.73.79
66.249.73.83
66.249.73.85
66.249.73.149
66.249.73.151
66.249.73.153
66.249.75.31
66.249.75.154
66.249.75.156
66.249.75.158
66.249.79.49
66.249.79.105
66.249.79.107
66.249.79.109
66.249.79.111
66.249.79.143
72.12.203.182
77.247.181.165
80.82.78.104
82.200.65.218
92.222.84.34
94.181.94.12
96.57.82.166
103.23.100.87
103.36.84.100
107.170.48.64
109.173.40.60
109.195.198.27
109.227.63.3
111.11.181.53
111.231.119.141
112.85.42.53
112.85.42.102
112.85.42.110
112.85.42.151
112.85.42.196
112.85.42.230
112.85.42.231
112.95.225.158
112.215.113.10
113.160.244.144
115.88.201.58
115.159.25.60
115.238.97.2
117.50.13.29
117.232.127.51
118.98.127.138
118.126.105.120
119.29.2.157
120.92.173.154
121.12.151.250
122.176.40.9
122.194.229.3
122.227.159.84
123.127.107.70
123.127.244.100
123.207.107.144
125.19.153.156
125.212.207.205
125.212.224.41
125.212.233.50
125.227.236.60
129.122.16.156
137.74.199.177
138.197.216.162
139.59.249.255
139.99.105.138
142.4.204.122
142.4.214.151
149.56.15.98
149.202.214.11
151.80.144.233
151.80.155.98
159.65.12.204
164.132.47.139
164.132.56.243
164.132.225.151
164.163.99.10
171.221.210.158
172.104.108.109
176.31.252.148
179.190.96.146
180.76.187.94
180.76.246.38
180.166.192.66
180.250.205.114
181.40.76.162
181.53.251.181
181.118.94.57
182.74.25.246
185.53.168.96
186.87.32.48
187.60.36.104
187.190.236.88
189.6.45.130
189.112.109.185
190.85.34.140
190.98.228.54
190.145.5.170
193.58.196.146
195.136.66.4
196.38.70.24
197.251.207.20
198.50.197.216
200.29.120.94
200.195.171.74
200.204.174.163
201.22.95.52
202.51.110.214
202.88.252.53
202.131.152.2
203.81.78.180
203.129.218.76
203.154.162.168
203.213.66.170
203.236.51.35
206.174.214.90
210.21.226.2
210.22.161.50
211.252.86.82
212.44.65.22
212.170.50.203
213.174.147.83
218.28.238.162
218.75.132.59
219.153.31.186
222.252.16.140
222.252.30.117

1300
bi_cms_0_1d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

120
bi_cms_1_7d.ipset Normal file
View File

@ -0,0 +1,120 @@
#
# bi_cms_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# cms with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/cms/1?age=7d
# Source File Date: Mon Dec 14 10:04:24 UTC 2020
#
# Category : attacks
# Version : 3132
#
# This File Date : Mon Dec 14 10:04:24 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 90 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_cms_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.211.16
37.187.252.148
41.161.74.100
50.62.177.206
50.62.208.106
50.62.208.139
50.62.208.141
62.210.185.4
66.198.240.31
66.230.230.230
67.205.10.97
91.121.165.170
91.208.99.2
97.74.24.45
97.74.24.194
97.74.24.215
97.74.24.227
103.67.235.26
103.90.200.4
114.35.243.41
114.143.230.186
118.163.58.117
149.202.76.139
149.202.196.9
154.68.5.109
160.153.147.130
160.153.147.137
160.153.147.141
160.153.147.154
160.153.153.29
173.201.196.174
176.10.99.200
177.19.164.149
178.165.72.177
182.50.130.9
184.168.46.104
184.168.46.188
184.168.46.215
184.168.193.98
184.168.193.127
184.168.193.129
184.168.193.159
184.168.193.196
185.14.56.96
185.81.157.102
185.85.190.132
185.85.191.196
185.85.191.201
185.85.238.244
185.85.239.110
185.85.239.195
185.86.164.98
185.86.164.99
185.86.164.100
185.86.164.101
185.86.164.102
185.86.164.103
185.86.164.104
185.86.164.107
185.86.164.108
185.86.164.109
185.86.164.110
185.86.167.4
185.107.47.215
185.107.70.202
185.166.131.147
185.182.56.17
185.220.100.252
185.220.101.1
185.220.101.4
185.220.101.12
185.220.101.13
185.220.101.22
185.220.102.6
186.232.141.17
189.114.67.195
190.202.44.194
192.145.239.207
196.44.176.55
198.71.224.64
198.71.224.65
198.71.238.6
198.71.239.32
198.71.239.46
198.71.239.51
198.245.62.53
210.245.81.159
211.221.155.6
212.142.226.93
212.142.226.124

124
bi_cms_2_30d.ipset Normal file
View File

@ -0,0 +1,124 @@
#
# bi_cms_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# cms with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/cms/2?age=30d
# Source File Date: Mon Dec 14 11:44:38 UTC 2020
#
# Category : attacks
# Version : 837
#
# This File Date : Mon Dec 14 11:44:38 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 94 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_cms_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
37.187.252.148
41.33.229.210
50.62.177.206
50.62.208.106
50.62.208.139
50.62.208.141
50.63.194.48
59.125.2.63
62.99.78.120
62.210.185.4
66.11.32.201
82.208.65.46
91.208.99.2
94.156.119.230
103.28.38.166
113.161.4.51
114.35.243.41
114.199.112.138
115.84.112.138
118.163.58.117
118.163.97.19
118.163.146.70
119.29.82.97
121.128.135.73
121.128.135.75
149.202.76.139
154.68.5.109
173.201.196.174
175.198.214.201
176.10.99.200
177.19.164.149
177.135.101.101
177.135.103.54
178.165.72.177
182.50.132.113
183.102.114.251
184.168.27.162
184.168.46.188
184.168.46.215
185.14.56.96
185.81.157.102
185.85.190.132
185.85.191.196
185.85.191.201
185.85.238.244
185.85.239.110
185.85.239.195
185.86.164.98
185.86.164.99
185.86.164.100
185.86.164.101
185.86.164.102
185.86.164.103
185.86.164.104
185.86.164.107
185.86.164.108
185.86.164.109
185.86.164.110
185.86.167.4
185.100.87.207
185.107.70.202
185.166.131.147
185.182.56.17
185.220.100.252
185.220.101.1
185.220.101.4
185.220.101.12
185.220.101.13
185.220.101.22
185.220.102.6
186.215.130.242
186.215.143.149
186.215.195.249
187.58.132.251
189.59.69.3
189.114.67.195
189.114.67.217
190.13.106.123
190.56.70.131
190.202.44.194
192.145.239.207
192.169.249.201
195.81.64.102
196.44.176.55
198.71.228.18
198.71.239.51
200.175.104.103
201.140.110.78
201.184.241.243
210.245.81.159
211.20.181.113
211.221.155.6
212.142.226.93
212.142.226.124

31
bi_courierauth_0_1d.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bi_courierauth_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# courierauth with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/courierauth/0?age=1d
# Source File Date: Sun Dec 13 15:00:58 UTC 2020
#
# Category : attacks
# Version : 4964
#
# This File Date : Sun Dec 13 15:00:58 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_courierauth_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
139.59.118.196

30
bi_courierauth_2_30d.ipset Normal file
View File

@ -0,0 +1,30 @@
#
# bi_courierauth_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# courierauth with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/courierauth/2?age=30d
# Source File Date: Sun Oct 4 20:08:14 UTC 2020
#
# Category : attacks
# Version : 100
#
# This File Date : Mon Oct 5 20:20:06 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_courierauth_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

249
bi_default_0_1d.ipset Normal file
View File

@ -0,0 +1,249 @@
#
# bi_default_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# default with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/default/0?age=1d
# Source File Date: Mon Dec 14 13:52:41 UTC 2020
#
# Category : attacks
# Version : 29134
#
# This File Date : Mon Dec 14 13:52:41 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 219 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_default_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.23.183.197
14.102.112.178
27.128.199.247
27.254.95.199
31.216.38.22
35.192.178.18
35.224.1.26
36.67.163.146
36.89.213.100
36.134.79.96
38.72.132.198
39.106.142.70
40.79.248.65
42.192.94.8
43.226.69.103
43.226.144.63
45.55.180.7
45.229.54.85
45.229.54.141
46.41.138.43
46.101.4.230
46.101.29.76
46.101.100.227
49.232.12.54
49.233.31.121
49.233.54.212
49.233.168.100
51.38.188.63
51.68.91.191
51.77.150.203
51.81.34.189
51.89.107.21
51.178.80.229
51.210.183.93
51.254.93.76
52.175.223.122
52.183.2.76
58.65.145.83
58.220.39.205
58.222.133.82
59.99.46.118
59.124.6.166
60.196.69.234
61.82.120.130
61.155.217.77
62.234.80.115
62.234.217.203
65.52.173.170
68.183.73.179
78.139.216.117
79.137.74.57
80.82.65.74
81.68.175.38
81.68.253.104
81.70.2.91
81.70.159.7
81.71.85.116
81.161.63.101
81.248.104.172
82.65.104.195
82.65.190.68
83.18.149.38
83.27.155.111
85.72.186.146
85.247.151.109
91.134.151.29
91.241.19.84
92.81.222.217
93.61.137.226
93.203.35.140
95.85.9.94
97.107.135.70
103.221.252.46
103.238.69.138
104.131.79.252
104.192.102.43
104.199.53.197
104.224.183.154
104.248.24.145
104.248.55.220
104.248.114.184
106.52.199.111
106.53.236.9
106.54.227.32
106.75.75.160
106.75.156.124
107.170.134.125
108.36.253.227
109.248.203.4
111.93.10.213
111.229.155.183
111.229.198.182
111.229.218.192
113.209.128.114
114.67.68.255
114.67.77.148
115.72.129.137
115.159.78.65
115.159.105.200
116.59.25.196
116.98.166.158
117.34.80.178
117.247.236.51
118.24.106.210
118.24.121.227
118.25.24.84
118.27.37.117
118.70.33.125
118.89.241.214
119.27.189.46
119.45.138.160
119.200.186.168
120.28.151.136
120.131.2.210
122.51.154.84
122.51.209.252
123.206.41.68
123.207.145.66
124.156.149.127
124.205.119.183
124.230.206.11
129.204.203.218
129.213.40.181
132.232.97.167
136.33.189.193
138.68.254.55
138.91.120.191
138.197.142.81
138.197.143.146
139.59.44.143
139.59.124.23
139.198.5.138
139.199.35.168
139.199.189.158
139.199.223.208
140.143.152.200
142.93.172.106
142.93.200.110
146.56.216.83
146.185.130.101
149.56.130.248
150.109.146.235
151.80.38.19
152.136.36.250
152.136.121.150
154.85.58.147
157.230.100.192
159.89.112.44
159.89.156.186
161.35.5.183
162.142.125.54
162.243.128.189
164.132.134.20
165.22.22.250
165.227.28.204
165.227.75.135
165.227.164.95
167.172.130.49
167.172.180.190
167.172.204.125
167.248.133.54
169.44.172.23
175.24.8.247
177.23.58.23
177.191.160.42
178.62.75.60
178.62.187.136
178.72.71.93
178.128.157.242
179.191.69.146
180.76.104.101
180.215.204.179
182.92.98.14
184.22.4.80
185.234.217.184
185.238.29.11
187.95.119.2
187.172.235.182
188.131.166.222
188.166.6.11
188.166.252.134
190.144.79.157
190.144.114.162
191.29.42.153
191.235.70.69
192.241.204.61
192.241.211.249
192.241.217.64
192.241.238.207
192.241.238.218
192.241.239.247
193.77.238.11
193.112.39.2
193.112.157.231
193.112.196.101
194.48.199.121
198.50.212.177
198.98.51.16
200.56.17.5
201.238.154.170
201.249.229.107
202.29.80.133
202.164.139.240
203.180.218.175
203.205.37.233
203.223.191.66
206.189.87.108
206.189.141.156
206.189.173.15
207.154.242.155
209.97.143.9
209.141.59.18
211.239.124.233
211.251.239.72
213.176.35.40
219.232.115.95
219.255.59.153
220.132.75.140
220.167.103.105

44
bi_default_1_7d.ipset Normal file
View File

@ -0,0 +1,44 @@
#
# bi_default_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# default with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/default/1?age=7d
# Source File Date: Sun Dec 13 15:44:17 UTC 2020
#
# Category : attacks
# Version : 2016
#
# This File Date : Sun Dec 13 15:44:17 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 14 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_default_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.196.95.80
61.177.172.107
64.113.32.29
77.247.181.162
117.232.127.51
166.70.207.2
171.25.193.20
171.25.193.78
185.100.87.206
185.100.87.207
185.129.62.62
188.166.1.95
192.42.116.16
200.216.31.148

47
bi_default_2_30d.ipset Normal file
View File

@ -0,0 +1,47 @@
#
# bi_default_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# default with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/default/2?age=30d
# Source File Date: Mon Dec 14 11:44:39 UTC 2020
#
# Category : attacks
# Version : 597
#
# This File Date : Mon Dec 14 11:44:39 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 17 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_default_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.196.95.80
51.254.37.192
61.177.172.107
64.113.32.29
77.247.181.162
103.23.100.87
117.232.127.51
166.70.207.2
171.25.193.20
171.25.193.78
185.100.87.206
185.100.87.207
185.129.62.62
188.166.1.95
192.42.116.16
200.216.31.148
206.174.214.90

58
bi_dns_0_1d.ipset Normal file
View File

@ -0,0 +1,58 @@
#
# bi_dns_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# dns with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/dns/0?age=1d
# Source File Date: Mon Dec 14 13:00:25 UTC 2020
#
# Category : attacks
# Version : 8148
#
# This File Date : Mon Dec 14 13:00:26 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 28 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_dns_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
2.91.247.138
24.47.226.25
31.7.5.25
47.155.60.203
50.25.46.163
65.27.130.147
68.42.117.192
71.82.227.75
74.97.182.126
78.57.179.13
80.181.185.38
81.155.18.101
87.64.51.221
87.72.115.5
88.80.186.137
89.242.64.92
93.168.159.188
104.31.92.47
107.11.79.118
120.71.145.56
129.208.51.55
162.226.205.106
174.119.28.29
185.93.24.1
185.93.24.101
185.93.24.207
188.52.78.227
217.251.222.107

107
bi_dovecot-pop3imap_0_1d.ipset Normal file
View File

@ -0,0 +1,107 @@
#
# bi_dovecot-pop3imap_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# dovecot-pop3imap with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/dovecot-pop3imap/0?age=1d
# Source File Date: Mon Dec 14 14:09:43 UTC 2020
#
# Category : attacks
# Version : 31844
#
# This File Date : Mon Dec 14 14:09:43 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 77 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_dovecot-pop3imap_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.171.52.123
14.162.146.31
18.133.156.91
18.205.41.249
20.51.226.115
20.55.27.177
24.249.199.19
27.123.240.167
35.153.134.34
37.49.225.145
40.85.163.142
40.112.177.49
43.245.222.163
45.83.64.113
45.83.67.25
45.129.33.123
45.154.35.235
46.8.174.116
61.6.247.92
62.19.90.71
64.119.197.105
70.166.167.50
71.6.233.58
71.6.233.234
72.210.252.155
85.214.19.70
93.38.169.69
103.141.138.125
107.6.168.211
109.52.1.184
109.52.4.191
109.52.10.173
109.52.12.68
109.52.27.110
109.52.28.208
109.52.28.251
109.52.29.111
109.52.32.233
109.52.37.69
109.52.40.188
109.52.41.44
109.52.45.140
109.52.47.247
109.52.240.49
109.52.240.87
109.52.240.127
109.52.240.229
109.52.241.155
111.199.159.112
111.199.159.243
124.156.240.79
125.34.240.33
129.205.8.70
139.59.118.196
146.185.25.174
147.75.124.130
154.125.67.233
171.103.32.202
173.12.136.105
177.74.143.144
184.179.216.136
187.189.86.141
189.203.139.37
190.205.157.91
192.145.48.239
196.52.43.125
196.179.163.71
202.137.155.78
202.138.241.97
206.75.128.23
212.98.122.91
212.142.226.93
216.250.251.62
217.58.26.29
217.146.81.127
219.74.125.133
222.165.182.42

122
bi_dovecot-pop3imap_2_30d.ipset Normal file
View File

@ -0,0 +1,122 @@
#
# bi_dovecot-pop3imap_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# dovecot-pop3imap with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/dovecot-pop3imap/2?age=30d
# Source File Date: Mon Dec 14 11:44:40 UTC 2020
#
# Category : attacks
# Version : 517
#
# This File Date : Mon Dec 14 11:44:40 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 92 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_dovecot-pop3imap_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
27.189.251.86
58.17.221.4
58.214.24.53
58.216.170.50
58.220.234.18
58.242.164.10
59.44.47.106
59.49.233.24
60.6.223.191
60.8.207.34
60.13.181.244
60.166.52.51
60.167.19.30
60.171.135.254
60.171.155.26
60.173.114.254
60.174.37.226
60.174.192.240
61.131.3.225
61.134.44.28
61.153.54.38
61.177.60.140
61.182.82.34
61.185.137.161
61.185.242.195
61.189.47.93
61.191.130.198
109.226.23.26
111.26.198.30
112.27.129.154
112.113.241.17
113.8.194.3
113.161.4.51
114.104.158.172
115.84.112.138
115.239.244.198
116.112.207.235
116.248.41.55
119.48.16.182
120.194.7.10
120.209.71.14
122.139.5.237
123.138.199.66
123.178.123.190
124.112.45.222
124.161.35.88
124.164.235.209
124.165.247.42
124.207.209.114
125.75.206.244
157.122.183.218
157.122.183.220
177.43.251.153
178.234.35.42
182.137.14.72
183.65.17.118
183.167.225.165
187.58.151.15
190.202.44.194
201.140.110.78
201.184.241.243
202.107.34.250
211.20.181.113
211.221.155.6
218.22.11.106
218.22.135.190
218.22.148.105
218.22.190.133
218.23.26.50
218.25.31.150
218.27.162.22
218.28.164.218
218.57.237.243
218.65.220.48
218.75.148.181
218.76.252.245
218.201.14.134
218.204.69.3
219.148.39.134
220.164.2.131
220.173.107.124
220.174.209.154
220.178.2.114
220.180.107.193
221.199.41.218
221.212.58.242
221.224.114.229
222.160.126.34
222.185.243.130
222.189.206.51
222.222.71.101
223.241.100.16

82
bi_dovecot_0_1d.ipset Normal file
View File

@ -0,0 +1,82 @@
#
# bi_dovecot_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# dovecot with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/dovecot/0?age=1d
# Source File Date: Mon Dec 14 14:09:43 UTC 2020
#
# Category : attacks
# Version : 33443
#
# This File Date : Mon Dec 14 14:09:43 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 52 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_dovecot_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.206.202
37.46.150.197
37.49.225.196
45.142.120.59
45.142.120.60
45.142.120.62
45.142.120.63
45.142.120.65
45.142.120.93
45.142.120.99
45.142.120.121
45.142.120.133
45.142.120.135
45.142.120.147
45.142.120.149
45.142.120.180
45.142.120.209
45.142.120.215
45.150.206.113
45.150.206.115
45.150.206.116
45.150.206.117
45.150.206.119
46.92.214.11
59.39.183.34
66.70.133.112
72.223.168.76
75.134.4.13
78.128.113.66
79.195.142.197
80.187.99.76
95.144.101.119
103.114.107.87
103.141.136.70
111.132.5.132
112.53.68.114
120.237.161.139
135.125.25.7
156.96.56.41
171.97.47.45
174.228.135.94
176.113.115.132
185.142.236.35
193.56.28.33
193.169.252.60
201.87.118.178
212.70.149.53
212.70.149.84
213.205.240.144
218.25.161.226
219.75.79.61
222.223.203.3

37
bi_dovecot_1_7d.ipset Normal file
View File

@ -0,0 +1,37 @@
#
# bi_dovecot_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# dovecot with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/dovecot/1?age=7d
# Source File Date: Sat Dec 12 09:12:48 UTC 2020
#
# Category : attacks
# Version : 2296
#
# This File Date : Sat Dec 12 09:12:48 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 7 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_dovecot_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
61.153.54.38
71.6.135.131
94.102.49.190
118.112.183.204
120.194.193.7
178.234.35.26
189.114.67.213

51
bi_dovecot_2_30d.ipset Normal file
View File

@ -0,0 +1,51 @@
#
# bi_dovecot_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# dovecot with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/dovecot/2?age=30d
# Source File Date: Sat Dec 12 11:20:18 UTC 2020
#
# Category : attacks
# Version : 757
#
# This File Date : Sat Dec 12 11:20:18 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 21 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_dovecot_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
59.45.171.158
60.174.118.80
61.153.54.38
61.177.81.158
66.240.192.138
71.6.135.131
93.174.95.106
94.102.49.190
118.112.183.204
120.194.193.7
178.234.34.179
178.234.35.26
186.215.197.15
189.114.67.213
197.230.63.203
218.64.77.62
218.65.220.48
219.237.78.2
220.164.2.61
220.164.2.67
220.164.2.113

30
bi_drupal_0_1d.ipset Normal file
View File

@ -0,0 +1,30 @@
#
# bi_drupal_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# drupal with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/drupal/0?age=1d
# Source File Date: Sun Sep 29 20:36:48 UTC 2019
#
# Category : attacks
# Version : 3009
#
# This File Date : Sun Sep 29 21:08:27 UTC 2019
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_drupal_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

100
bi_exim_0_1d.ipset Normal file
View File

@ -0,0 +1,100 @@
#
# bi_exim_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# exim with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/exim/0?age=1d
# Source File Date: Mon Dec 14 14:09:44 UTC 2020
#
# Category : attacks
# Version : 15291
#
# This File Date : Mon Dec 14 14:09:44 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 70 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_exim_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.206.202
13.111.4.146
31.170.60.202
34.123.105.7
45.11.99.62
45.70.5.245
45.125.65.39
45.125.65.105
45.162.20.76
45.162.21.174
45.162.21.179
45.181.30.204
45.181.31.139
45.224.161.137
45.224.161.214
45.227.98.62
45.230.89.48
61.182.227.245
78.128.113.66
81.22.33.252
91.83.162.234
91.83.163.184
91.137.251.26
91.246.213.9
93.190.9.77
93.190.9.80
103.198.80.105
103.237.56.170
103.253.42.54
103.255.74.39
131.72.174.35
131.196.93.186
138.94.210.47
138.122.38.185
141.98.10.143
141.98.80.87
149.56.217.50
149.56.217.51
149.56.217.52
149.56.217.53
149.56.217.54
167.250.166.44
167.250.191.140
168.228.119.2
170.83.188.194
177.11.55.104
177.11.115.147
177.21.193.205
177.52.74.146
177.54.250.88
177.129.206.225
177.154.237.181
177.190.74.107
181.16.198.62
181.174.144.224
185.150.117.87
186.250.198.126
187.19.7.165
187.87.8.230
189.91.4.207
191.53.192.34
191.53.196.206
191.243.210.177
194.29.70.78
195.136.43.175
195.226.207.168
196.0.34.134
200.108.143.158
201.55.158.55
210.16.88.184

31
bi_exim_1_7d.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bi_exim_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# exim with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/exim/1?age=7d
# Source File Date: Sun Dec 13 06:48:33 UTC 2020
#
# Category : attacks
# Version : 229
#
# This File Date : Sun Dec 13 06:48:34 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_exim_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
71.6.165.200

96
bi_ftp_0_1d.ipset Normal file
View File

@ -0,0 +1,96 @@
#
# bi_ftp_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# ftp with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/ftp/0?age=1d
# Source File Date: Mon Dec 14 13:32:43 UTC 2020
#
# Category : attacks
# Version : 35303
#
# This File Date : Mon Dec 14 13:32:43 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 66 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_ftp_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.58.47.108
1.83.55.142
14.236.17.205
31.184.199.114
36.37.124.100
36.90.42.132
51.89.107.21
58.22.93.115
58.33.174.203
58.48.196.127
58.228.50.98
61.142.20.22
61.142.21.29
61.177.172.158
85.26.234.177
87.241.1.186
94.78.193.73
110.87.80.53
111.61.177.158
111.225.205.11
111.231.226.216
112.98.166.81
113.70.242.159
113.77.160.250
113.87.100.93
113.87.201.163
113.116.171.105
115.60.91.153
116.96.128.232
116.236.91.34
118.31.187.234
119.126.143.0
121.10.3.83
122.51.250.133
123.191.241.120
124.234.49.247
125.93.110.241
125.93.111.69
134.175.133.109
144.123.160.129
165.84.180.37
172.0.252.134
180.139.124.79
180.247.51.198
182.86.226.255
182.146.116.104
182.200.23.59
183.190.9.36
185.234.217.184
185.239.242.225
189.252.214.37
194.61.24.177
194.105.205.42
194.242.96.15
202.78.232.138
211.177.113.84
211.192.95.220
219.91.168.167
221.202.168.254
221.203.23.107
222.246.37.62
222.246.111.24
223.165.149.25
223.165.150.21
223.165.196.32
223.220.140.226

33
bi_ftp_1_7d.ipset Normal file
View File

@ -0,0 +1,33 @@
#
# bi_ftp_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# ftp with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/ftp/1?age=7d
# Source File Date: Sat Dec 12 09:12:50 UTC 2020
#
# Category : attacks
# Version : 1697
#
# This File Date : Sat Dec 12 09:12:50 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 3 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_ftp_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
45.79.144.216
221.13.7.50
221.202.168.254

33
bi_ftp_2_30d.ipset Normal file
View File

@ -0,0 +1,33 @@
#
# bi_ftp_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# ftp with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/ftp/2?age=30d
# Source File Date: Sat Dec 12 11:20:20 UTC 2020
#
# Category : attacks
# Version : 521
#
# This File Date : Sat Dec 12 11:20:20 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 3 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_ftp_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
123.178.150.230
221.13.7.50
221.202.168.254

1547
bi_http_0_1d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

137
bi_http_1_7d.ipset Normal file
View File

@ -0,0 +1,137 @@
#
# bi_http_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# http with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/http/1?age=7d
# Source File Date: Mon Dec 14 10:04:26 UTC 2020
#
# Category : attacks
# Version : 3325
#
# This File Date : Mon Dec 14 10:04:26 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 107 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_http_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.8.10.202
5.188.211.16
5.188.211.26
5.188.211.72
37.187.205.244
37.187.252.148
41.161.74.100
50.62.177.206
50.62.208.106
50.62.208.139
50.62.208.141
62.210.185.4
66.198.240.31
66.230.230.230
66.249.65.85
66.249.66.86
66.249.66.222
67.205.10.97
80.82.77.139
82.221.105.6
91.121.165.170
91.208.99.2
93.174.93.149
94.102.49.26
97.74.24.45
97.74.24.194
97.74.24.215
97.74.24.227
103.67.235.26
103.90.200.4
114.35.243.41
114.143.230.186
118.163.58.117
149.202.76.139
149.202.196.9
154.68.5.109
157.55.39.31
160.153.147.130
160.153.147.137
160.153.147.141
160.153.147.154
160.153.153.29
173.201.196.174
176.10.99.200
177.19.164.149
178.165.72.177
182.50.130.9
184.168.46.104
184.168.46.188
184.168.46.215
184.168.193.98
184.168.193.127
184.168.193.129
184.168.193.159
184.168.193.196
185.14.56.96
185.81.157.102
185.85.190.132
185.85.191.196
185.85.191.201
185.85.238.244
185.85.239.110
185.85.239.195
185.86.164.98
185.86.164.99
185.86.164.100
185.86.164.101
185.86.164.102
185.86.164.103
185.86.164.104
185.86.164.107
185.86.164.108
185.86.164.109
185.86.164.110
185.86.167.4
185.100.87.191
185.100.87.245
185.100.87.247
185.107.47.215
185.107.70.202
185.166.131.147
185.182.56.17
185.220.100.252
185.220.101.1
185.220.101.4
185.220.101.12
185.220.101.13
185.220.101.22
185.220.102.6
186.232.141.17
189.114.67.195
190.202.44.194
192.145.239.207
196.44.176.55
198.71.224.64
198.71.224.65
198.71.238.6
198.71.239.32
198.71.239.46
198.71.239.51
198.245.62.53
208.100.26.229
208.100.26.232
210.245.81.159
211.221.155.6
212.142.226.93
212.142.226.124

150
bi_http_2_30d.ipset Normal file
View File

@ -0,0 +1,150 @@
#
# bi_http_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# http with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/http/2?age=30d
# Source File Date: Mon Dec 14 11:44:42 UTC 2020
#
# Category : attacks
# Version : 862
#
# This File Date : Mon Dec 14 11:44:42 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 120 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_http_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.8.10.202
5.188.211.26
37.187.205.244
37.187.252.148
41.33.229.210
50.30.32.186
50.62.177.206
50.62.208.106
50.62.208.139
50.62.208.141
50.63.194.48
59.125.2.63
62.99.78.120
62.210.185.4
64.246.165.200
66.11.32.201
66.240.205.34
66.249.65.85
66.249.66.86
71.6.146.185
71.6.165.200
80.82.77.33
80.82.77.139
82.208.65.46
82.221.105.6
91.208.99.2
93.174.93.149
94.102.49.26
94.156.119.230
103.8.12.100
103.28.38.166
113.161.4.51
114.35.243.41
114.199.112.138
115.84.112.138
118.163.58.117
118.163.97.19
118.163.146.70
119.29.82.97
121.128.135.73
121.128.135.75
139.162.119.197
149.202.76.139
154.68.5.109
157.55.39.31
173.201.196.174
175.198.214.201
176.10.99.200
177.19.164.149
177.135.101.101
177.135.103.54
178.165.72.177
182.50.132.113
183.102.114.251
184.168.27.162
184.168.46.188
184.168.46.215
185.14.56.96
185.81.157.102
185.85.190.132
185.85.191.196
185.85.191.201
185.85.238.244
185.85.239.110
185.85.239.195
185.86.164.98
185.86.164.99
185.86.164.100
185.86.164.101
185.86.164.102
185.86.164.103
185.86.164.104
185.86.164.107
185.86.164.108
185.86.164.109
185.86.164.110
185.86.167.4
185.100.87.191
185.100.87.207
185.100.87.245
185.100.87.247
185.107.70.202
185.166.131.147
185.182.56.17
185.220.100.252
185.220.101.1
185.220.101.4
185.220.101.12
185.220.101.13
185.220.101.22
185.220.102.6
186.215.130.242
186.215.143.149
186.215.195.249
187.58.132.251
189.59.69.3
189.114.67.195
189.114.67.217
190.13.106.123
190.56.70.131
190.202.44.194
192.145.239.207
192.169.249.201
195.81.64.102
196.44.176.55
198.71.228.18
198.71.239.51
200.175.104.103
201.140.110.78
201.184.241.243
207.46.13.22
207.46.13.24
207.46.13.130
208.100.26.229
208.100.26.232
210.245.81.159
211.20.181.113
211.221.155.6
212.142.226.93
212.142.226.124

140
bi_imap_0_1d.ipset Normal file
View File

@ -0,0 +1,140 @@
#
# bi_imap_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# imap with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/imap/0?age=1d
# Source File Date: Mon Dec 14 14:09:46 UTC 2020
#
# Category : attacks
# Version : 14887
#
# This File Date : Mon Dec 14 14:09:46 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 110 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_imap_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.133.20.182
27.123.240.167
37.46.150.129
41.139.131.177
45.170.129.135
45.238.121.134
45.238.121.139
45.238.121.243
45.238.122.174
49.216.61.232
59.125.248.139
59.145.146.166
60.248.249.190
65.102.49.62
65.169.38.45
65.169.38.111
66.135.227.179
66.135.227.182
66.254.196.158
67.201.38.131
68.71.240.212
68.71.241.37
68.71.245.203
72.210.252.142
72.210.252.147
72.210.252.148
72.217.158.202
72.217.158.212
72.221.164.60
72.221.164.61
72.221.196.135
72.221.232.141
72.221.232.142
72.221.232.147
72.223.168.81
72.223.168.82
74.119.147.213
80.94.252.21
92.184.97.190
92.184.97.230
93.89.68.36
98.162.25.10
98.162.25.15
98.162.96.59
98.184.33.212
101.0.42.171
103.99.149.250
103.194.243.186
103.224.167.227
103.225.22.118
107.152.98.1
113.193.240.109
115.84.91.38
116.14.49.49
116.14.60.83
116.14.148.129
117.240.166.51
118.201.212.230
119.160.135.166
123.20.5.65
125.17.90.10
129.205.8.70
136.35.57.213
142.54.235.12
164.160.151.22
174.70.203.3
174.76.48.241
174.76.48.245
184.170.249.69
184.170.251.26
184.178.172.7
184.178.172.24
184.179.216.134
184.179.216.140
184.179.216.141
184.179.216.142
184.179.216.145
184.179.216.150
184.179.216.151
185.145.26.31
187.188.115.81
187.189.176.171
187.189.211.33
190.180.138.62
191.102.120.112
193.63.77.2
194.79.62.217
198.8.83.238
198.8.84.1
199.58.185.11
199.102.104.65
200.159.1.218
200.205.134.107
200.241.39.37
202.137.134.139
202.137.155.146
202.137.155.171
202.137.155.234
205.240.77.36
208.65.90.229
210.210.117.95
213.230.71.0
216.183.222.135
219.74.125.133
219.74.162.21
219.75.79.61
219.93.110.60
220.66.155.2
221.157.75.124
222.165.182.42

1156
bi_mail_0_1d.ipset Normal file
View File

File diff suppressed because it is too large Load Diff

196
bi_mail_1_7d.ipset Normal file
View File

@ -0,0 +1,196 @@
#
# bi_mail_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# mail with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/mail/1?age=7d
# Source File Date: Mon Dec 14 10:08:37 UTC 2020
#
# Category : attacks
# Version : 3414
#
# This File Date : Mon Dec 14 10:08:37 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 166 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_mail_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.211.10
5.188.211.14
5.188.211.24
27.189.251.86
36.37.180.59
37.49.225.15
37.49.225.123
37.49.225.138
37.49.225.161
51.15.80.14
58.17.221.4
58.214.24.53
58.216.170.50
58.220.234.18
58.221.55.221
58.241.124.154
58.242.164.10
59.44.47.106
59.49.233.24
60.6.223.191
60.8.207.34
60.13.181.244
60.166.52.51
60.167.19.30
60.167.20.135
60.167.21.231
60.167.112.77
60.167.113.133
60.167.113.245
60.167.118.60
60.167.119.99
60.169.94.65
60.169.114.163
60.171.135.254
60.171.155.26
60.173.114.254
60.174.37.226
60.174.192.240
61.131.3.225
61.134.44.28
61.153.54.38
61.177.60.140
61.182.82.34
61.185.137.161
61.185.242.195
61.189.47.93
61.191.130.198
62.210.105.116
66.240.192.138
71.6.135.131
71.6.165.200
77.247.181.165
80.82.70.118
80.82.77.33
80.82.77.139
82.127.124.78
82.165.159.39
82.165.159.44
82.208.65.46
87.118.122.51
89.31.57.5
92.154.95.236
93.174.95.106
94.102.49.190
94.230.208.148
103.47.14.246
105.67.10.10
109.226.23.26
111.26.198.30
112.27.129.154
112.113.241.17
112.221.173.170
113.8.194.3
113.161.4.51
114.104.158.172
114.237.155.139
115.84.112.138
115.239.244.198
116.112.207.235
116.248.41.55
118.112.183.204
119.48.16.182
120.194.7.10
120.194.193.7
120.209.71.14
122.139.5.237
123.138.199.66
123.178.123.190
124.112.45.222
124.161.35.88
124.164.235.209
124.165.247.42
124.207.209.114
125.75.206.244
157.122.183.218
157.122.183.220
162.247.72.199
171.25.193.78
176.10.99.200
176.10.104.240
177.43.251.153
178.17.174.14
178.234.35.26
178.234.35.42
182.137.14.72
183.65.17.118
183.167.225.165
185.43.206.103
185.100.86.182
185.100.87.206
185.220.101.8
185.220.101.18
185.220.102.4
185.220.102.6
186.10.7.66
187.58.151.15
188.163.109.153
188.165.235.21
189.114.67.213
190.202.44.194
192.160.102.170
193.188.254.67
195.176.3.24
197.156.97.73
198.20.69.98
201.140.110.78
201.150.37.34
201.184.241.243
202.107.34.250
204.194.29.4
208.100.26.233
208.100.26.236
208.100.26.237
211.20.181.113
211.221.155.6
217.217.179.17
218.22.11.106
218.22.135.190
218.22.148.105
218.22.190.133
218.23.26.50
218.25.31.150
218.27.162.22
218.28.164.218
218.57.237.243
218.65.220.48
218.75.148.181
218.76.252.245
218.201.14.134
218.204.69.3
219.148.39.134
220.164.2.131
220.173.107.124
220.174.209.154
220.178.2.114
220.178.107.242
220.180.107.193
221.199.41.218
221.212.58.242
221.224.114.229
221.230.1.113
222.160.126.34
222.185.243.130
222.189.206.51
222.222.71.101
223.241.100.16

216
bi_mail_2_30d.ipset Normal file
View File

@ -0,0 +1,216 @@
#
# bi_mail_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# mail with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/mail/2?age=30d
# Source File Date: Mon Dec 14 11:44:42 UTC 2020
#
# Category : attacks
# Version : 875
#
# This File Date : Mon Dec 14 11:44:42 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 186 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_mail_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.211.14
5.188.211.24
27.189.251.86
36.37.180.59
37.49.225.15
37.49.225.102
37.49.225.123
37.49.225.138
37.49.225.161
37.49.225.164
37.49.225.186
41.85.161.136
46.165.230.5
51.15.80.14
58.17.221.4
58.214.24.53
58.216.170.50
58.220.234.18
58.241.124.154
58.242.164.10
59.44.47.106
59.45.171.158
59.49.233.24
60.6.223.191
60.8.207.34
60.13.181.244
60.166.52.51
60.167.19.30
60.167.112.77
60.171.135.254
60.171.155.26
60.173.114.254
60.174.37.226
60.174.118.80
60.174.192.240
61.131.3.225
61.134.44.28
61.153.54.38
61.177.60.140
61.177.81.158
61.182.82.34
61.185.137.161
61.185.242.195
61.189.47.93
61.191.130.198
62.99.78.120
62.210.105.116
66.240.192.138
71.6.135.131
71.6.146.186
71.6.165.200
77.247.181.162
77.247.181.165
80.82.70.118
80.82.77.33
80.82.77.139
82.165.159.39
82.165.159.44
82.208.65.46
87.118.122.51
89.31.57.5
89.234.157.254
91.245.28.37
92.154.95.236
93.174.95.106
94.102.49.190
103.47.14.246
105.66.10.10
105.67.10.10
109.226.23.26
111.26.198.30
112.2.52.100
112.27.129.154
112.113.241.17
112.133.248.100
112.196.43.202
113.8.194.3
113.161.4.51
114.104.158.172
115.84.112.138
115.239.244.198
116.112.207.235
116.248.41.55
118.112.183.204
119.48.16.182
120.194.7.10
120.194.193.7
120.209.71.14
122.139.5.237
123.138.199.66
123.178.123.190
124.112.45.222
124.161.35.88
124.164.235.209
124.165.247.42
124.207.209.114
125.75.206.244
138.186.179.16
139.162.99.243
157.122.183.218
157.122.183.220
162.247.72.199
164.52.24.168
171.25.193.78
176.10.99.200
176.10.104.240
177.43.251.153
178.17.174.14
178.234.34.179
178.234.35.26
178.234.35.42
182.137.14.72
183.65.17.118
183.167.225.165
185.100.87.206
185.220.100.252
185.220.101.3
185.220.101.4
185.220.101.5
185.220.101.6
185.220.101.8
185.220.101.10
185.220.101.20
185.220.102.4
185.220.102.6
185.220.102.7
185.220.102.8
186.215.197.15
187.58.151.15
188.165.235.21
189.114.67.213
190.202.44.194
192.42.116.16
192.160.102.165
192.160.102.170
193.188.254.67
197.156.97.73
197.230.63.203
198.20.69.98
201.140.110.78
201.174.182.158
201.184.241.243
202.107.34.250
204.194.29.4
208.100.26.233
208.100.26.236
208.100.26.237
211.20.181.113
211.221.155.6
217.217.179.17
218.22.11.106
218.22.135.190
218.22.148.105
218.22.190.133
218.23.26.50
218.25.31.150
218.27.162.22
218.28.164.218
218.57.237.243
218.64.77.62
218.65.220.48
218.75.148.181
218.76.252.245
218.201.14.134
218.204.69.3
219.143.72.21
219.148.39.134
219.237.78.2
220.164.2.61
220.164.2.67
220.164.2.113
220.164.2.131
220.173.107.124
220.174.209.154
220.178.2.114
220.178.107.242
220.180.107.193
221.199.41.218
221.212.58.242
221.224.114.229
221.230.1.113
222.160.126.34
222.185.243.130
222.189.206.51
222.222.71.101
223.241.100.16

57
bi_named_0_1d.ipset Normal file
View File

@ -0,0 +1,57 @@
#
# bi_named_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# named with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/named/0?age=1d
# Source File Date: Mon Dec 14 13:00:29 UTC 2020
#
# Category : attacks
# Version : 7575
#
# This File Date : Mon Dec 14 13:00:29 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 27 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_named_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
2.91.247.138
24.47.226.25
31.7.5.25
47.155.60.203
50.25.46.163
65.27.130.147
68.42.117.192
71.82.227.75
74.97.182.126
78.57.179.13
80.181.185.38
81.155.18.101
87.64.51.221
87.72.115.5
89.242.64.92
93.168.159.188
104.31.92.47
107.11.79.118
120.71.145.56
129.208.51.55
162.226.205.106
174.119.28.29
185.93.24.1
185.93.24.101
185.93.24.207
188.52.78.227
217.251.222.107

30
bi_owncloud_0_1d.ipset Normal file
View File

@ -0,0 +1,30 @@
#
# bi_owncloud_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# owncloud with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/owncloud/0?age=1d
# Source File Date: Mon Nov 5 08:01:27 UTC 2018
#
# Category : attacks
# Version : 30
#
# This File Date : Mon Nov 5 08:32:46 UTC 2018
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_owncloud_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

30
bi_plesk-postfix_0_1d.ipset Normal file
View File

@ -0,0 +1,30 @@
#
# bi_plesk-postfix_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# plesk-postfix with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/plesk-postfix/0?age=1d
# Source File Date: Mon Dec 14 08:12:24 UTC 2020
#
# Category : attacks
# Version : 12207
#
# This File Date : Mon Dec 14 08:44:46 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 0 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_plesk-postfix_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#

188
bi_postfix-sasl_0_1d.ipset Normal file
View File

@ -0,0 +1,188 @@
#
# bi_postfix-sasl_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# postfix-sasl with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/postfix-sasl/0?age=1d
# Source File Date: Mon Dec 14 14:09:49 UTC 2020
#
# Category : attacks
# Version : 37617
#
# This File Date : Mon Dec 14 14:09:49 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 158 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_postfix-sasl_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.206.202
18.220.68.185
37.49.225.196
42.235.175.95
45.125.65.39
45.125.65.105
45.142.120.11
45.142.120.20
45.142.120.34
45.142.120.57
45.142.120.59
45.142.120.60
45.142.120.62
45.142.120.63
45.142.120.65
45.142.120.82
45.142.120.87
45.142.120.93
45.142.120.99
45.142.120.121
45.142.120.133
45.142.120.135
45.142.120.138
45.142.120.147
45.142.120.149
45.142.120.180
45.142.120.209
45.142.120.215
45.150.206.40
45.150.206.113
45.150.206.114
45.150.206.115
45.150.206.116
45.150.206.117
45.150.206.119
54.36.165.239
60.19.64.4
60.167.20.135
60.167.52.99
60.167.52.139
60.167.53.88
60.167.53.162
60.167.53.217
60.167.82.213
60.167.82.241
60.167.112.133
60.167.112.151
60.167.112.193
60.167.113.109
60.167.113.125
60.167.116.180
60.167.117.44
60.167.117.232
60.167.118.197
60.167.118.199
60.167.119.30
60.167.119.211
60.169.94.8
60.169.95.17
60.169.114.138
61.150.115.117
75.134.4.13
77.40.3.58
78.128.113.66
83.139.140.135
87.246.7.45
87.246.7.53
87.246.7.56
96.44.162.82
103.106.193.227
103.114.107.87
103.253.42.54
111.75.149.221
111.132.5.132
112.53.68.114
113.69.130.243
113.69.130.244
114.99.130.7
114.99.130.86
114.99.131.78
114.99.131.80
114.99.131.86
114.99.131.118
114.112.161.155
116.196.108.9
119.123.73.19
121.11.98.127
124.205.139.75
141.98.10.136
141.98.10.143
141.98.10.183
141.98.10.192
141.98.80.87
143.110.226.219
143.110.234.124
143.110.234.191
143.110.234.229
151.80.237.221
156.96.56.41
159.65.5.106
161.35.224.231
161.35.231.176
161.35.231.244
176.31.24.26
176.111.173.11
178.32.144.167
180.101.145.234
183.251.87.5
185.36.81.33
185.234.216.63
185.234.216.64
185.234.216.66
185.234.219.11
185.234.219.12
185.234.219.13
185.234.219.14
185.234.219.227
185.234.219.228
185.234.219.229
185.234.219.230
185.244.41.10
185.244.41.14
185.244.41.18
185.244.41.19
185.244.41.21
185.244.41.32
185.244.41.33
185.244.41.34
185.244.41.40
185.244.41.41
185.244.41.43
185.244.41.44
185.244.41.45
188.166.247.25
188.166.250.224
190.80.159.189
191.53.193.185
191.232.165.34
193.56.28.33
193.56.28.82
193.56.28.239
193.56.28.249
193.169.252.60
193.169.252.205
193.169.253.118
193.169.253.190
193.169.254.105
193.169.254.109
202.186.172.191
206.189.149.43
206.189.158.102
212.70.149.53
212.70.149.84
218.4.239.146
218.25.161.226
221.237.189.26
222.223.203.3
223.241.54.81

37
bi_postfix-sasl_1_7d.ipset Normal file
View File

@ -0,0 +1,37 @@
#
# bi_postfix-sasl_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# postfix-sasl with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/postfix-sasl/1?age=7d
# Source File Date: Sun Dec 13 15:44:20 UTC 2020
#
# Category : attacks
# Version : 1867
#
# This File Date : Sun Dec 13 15:44:20 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 7 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_postfix-sasl_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
37.49.225.15
37.49.225.123
37.49.225.161
58.221.55.221
58.241.124.154
60.167.20.135
60.169.114.163

36
bi_postfix-sasl_2_30d.ipset Normal file
View File

@ -0,0 +1,36 @@
#
# bi_postfix-sasl_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# postfix-sasl with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/postfix-sasl/2?age=30d
# Source File Date: Sat Dec 12 11:20:24 UTC 2020
#
# Category : attacks
# Version : 636
#
# This File Date : Sat Dec 12 11:20:25 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 6 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_postfix-sasl_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
37.49.225.15
37.49.225.123
37.49.225.161
58.241.124.154
91.245.28.37
217.217.179.17

459
bi_postfix_0_1d.ipset Normal file
View File

@ -0,0 +1,459 @@
#
# bi_postfix_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# postfix with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/postfix/0?age=1d
# Source File Date: Mon Dec 14 14:09:49 UTC 2020
#
# Category : attacks
# Version : 38629
#
# This File Date : Mon Dec 14 14:09:49 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 429 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_postfix_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.53.137.84
1.245.61.144
3.94.201.196
5.79.109.48
5.180.107.220
5.188.206.202
5.196.72.11
12.169.96.50
13.74.46.65
14.21.36.84
14.165.125.174
14.169.235.185
18.219.102.85
23.95.242.14
23.129.64.210
23.129.64.216
27.71.231.81
37.57.37.213
37.123.101.68
37.187.102.31
41.85.189.66
42.118.26.104
42.192.77.59
42.192.83.189
42.235.175.95
43.242.246.50
45.55.219.114
45.125.65.39
45.125.65.105
45.127.133.61
45.141.58.107
45.141.58.192
45.142.120.11
45.142.120.20
45.142.120.34
45.142.120.57
45.142.120.59
45.142.120.60
45.142.120.62
45.142.120.63
45.142.120.65
45.142.120.82
45.142.120.87
45.142.120.93
45.142.120.99
45.142.120.121
45.142.120.133
45.142.120.135
45.142.120.138
45.142.120.147
45.142.120.149
45.142.120.180
45.142.120.209
45.142.120.215
45.142.124.76
45.146.166.76
45.150.206.40
45.150.206.113
45.150.206.114
45.150.206.115
45.150.206.116
45.150.206.117
45.150.206.119
45.154.35.211
45.166.22.79
45.169.24.2
45.175.179.230
45.176.208.50
45.225.90.118
46.16.226.6
46.48.93.16
46.101.220.225
46.172.69.163
46.177.153.82
49.68.146.211
49.68.147.129
49.81.217.146
49.82.192.56
49.88.112.70
49.130.53.148
49.206.18.102
49.233.216.158
49.234.50.247
49.235.227.17
50.3.238.195
50.3.238.197
50.3.238.199
50.3.238.201
50.31.75.125
50.207.130.198
51.68.44.154
51.77.193.245
51.77.202.151
51.89.149.241
51.91.100.120
51.158.190.194
54.36.165.239
54.37.65.76
54.38.156.63
54.39.75.171
58.17.200.197
58.33.160.139
58.87.76.77
58.149.49.186
59.55.37.32
59.99.207.23
60.167.52.15
60.254.104.109
61.191.55.33
62.234.41.136
63.80.89.137
63.80.89.170
63.80.89.171
63.80.89.172
63.80.89.174
65.60.44.2
67.205.167.26
68.183.228.203
69.94.151.52
69.94.152.75
69.94.152.78
69.94.152.95
69.94.152.96
69.94.152.126
69.94.152.129
69.94.152.130
71.6.135.131
71.6.199.23
77.40.2.151
77.40.2.205
77.40.3.58
77.40.18.149
77.40.25.99
77.48.137.3
77.233.10.37
78.128.113.66
80.15.14.46
80.73.9.10
81.29.143.12
81.68.167.79
81.70.157.186
82.147.120.30
83.103.206.60
84.246.150.251
89.19.175.117
89.28.32.203
89.71.241.168
89.133.95.177
89.236.239.25
91.144.142.19
92.222.180.221
93.174.95.106
94.23.179.193
94.43.85.6
96.82.74.134
101.32.45.10
101.32.68.55
101.32.204.213
101.78.149.142
101.78.209.39
103.27.4.161
103.40.241.21
103.48.192.48
103.55.36.28
103.95.97.186
103.95.164.68
103.113.3.146
103.205.5.176
103.220.6.254
103.242.56.137
103.253.42.54
104.41.28.236
104.131.13.199
104.131.55.236
104.152.52.21
104.236.52.94
104.236.182.223
104.244.76.245
104.248.13.190
106.12.85.128
106.12.160.17
106.13.138.253
106.53.192.15
106.55.37.132
106.75.97.141
106.121.4.178
107.173.209.244
109.100.123.228
109.102.229.26
111.21.255.2
111.198.48.204
111.229.58.117
112.26.113.106
112.213.106.45
113.31.104.89
113.31.118.68
113.65.230.30
113.204.228.66
114.233.168.21
115.84.92.198
115.164.45.120
116.68.96.241
116.72.12.145
116.193.218.18
116.196.108.9
117.2.22.85
117.44.60.96
117.69.47.93
117.69.239.236
117.71.159.174
117.107.213.244
118.24.154.33
118.25.195.244
118.69.77.91
118.89.108.152
119.41.206.233
119.45.50.126
119.45.193.252
119.45.246.61
119.123.153.74
119.252.143.6
120.92.111.13
121.11.98.127
122.55.190.12
123.6.5.104
123.133.133.22
123.206.95.243
124.65.117.38
124.156.154.173
125.99.120.166
128.199.158.12
129.122.129.238
131.255.32.45
132.232.79.28
134.73.146.54
137.74.173.182
138.68.94.173
138.99.95.22
138.197.89.212
138.219.247.6
139.59.68.61
139.59.101.84
139.59.114.121
139.199.103.55
140.143.39.186
141.98.10.136
141.98.10.143
141.98.10.183
141.98.10.192
141.98.80.87
142.93.235.47
145.239.188.172
152.136.204.118
157.0.134.164
157.230.14.38
157.230.45.31
157.245.91.229
157.245.184.148
159.69.246.40
159.89.48.31
159.89.115.126
159.89.236.71
160.155.113.19
161.35.5.183
161.35.30.208
161.35.57.121
161.35.193.16
162.142.125.53
164.132.73.220
165.227.23.158
165.227.163.85
167.172.163.162
168.138.221.133
168.138.238.2
169.239.236.101
171.251.233.104
172.93.165.84
172.104.146.188
174.138.40.185
175.24.81.207
175.43.176.182
176.31.162.82
176.98.95.132
176.111.173.12
176.122.161.175
176.123.5.108
176.194.189.39
177.1.214.207
177.7.17.230
177.21.19.87
177.21.37.106
178.20.225.183
178.20.225.186
178.20.225.187
178.20.226.86
178.20.226.87
178.20.226.88
178.20.226.91
178.20.226.93
178.20.226.94
178.20.227.201
178.20.227.204
178.20.227.207
178.32.192.85
179.63.254.90
180.76.246.38
180.119.181.130
182.71.111.138
183.177.132.29
185.9.156.165
185.9.156.166
185.9.156.168
185.9.156.169
185.9.156.171
185.9.156.177
185.9.156.179
185.36.81.33
185.51.92.103
185.75.5.158
185.86.6.216
185.156.74.65
185.244.41.21
185.244.41.32
185.244.41.36
185.244.41.38
185.244.41.39
185.244.41.42
185.244.41.44
185.247.224.14
186.35.214.223
186.67.27.174
186.105.93.174
186.193.2.22
186.225.124.90
187.12.181.106
187.44.110.157
188.131.129.58
188.138.25.14
188.165.235.21
188.166.185.236
189.112.179.115
189.202.53.132
190.24.6.162
190.117.186.171
190.121.136.3
190.128.171.250
190.184.144.170
190.196.20.166
190.215.18.121
192.95.6.110
192.241.217.83
193.56.28.30
193.111.76.195
193.111.76.196
193.111.76.197
193.111.76.201
193.112.202.61
193.169.252.208
193.169.253.52
193.169.253.56
193.169.253.118
193.169.254.106
194.146.26.208
194.146.26.210
194.146.26.227
194.146.26.254
194.146.47.239
194.146.50.226
195.9.80.22
195.29.155.98
195.117.107.190
195.144.21.56
195.154.243.19
195.223.211.242
196.242.244.238
197.5.145.27
198.27.82.155
200.29.109.112
200.71.72.14
200.111.101.242
200.118.57.238
200.206.63.34
201.235.60.56
202.155.228.207
203.130.242.68
203.172.76.4
203.177.71.254
203.202.253.186
210.245.51.15
210.245.51.19
210.245.51.43
211.22.154.223
212.70.149.53
212.70.149.84
212.95.137.19
213.6.33.110
213.144.147.149
213.222.34.200
213.230.107.202
217.21.54.221
217.182.170.138
218.4.239.146
218.68.0.42
218.93.207.94
220.95.209.146
220.179.210.57
220.179.210.125
221.131.165.80
221.131.165.86
221.131.165.87
221.181.185.19
221.181.185.29
221.181.185.36
221.181.185.135
221.181.185.198
221.181.185.222
221.181.185.223
221.237.189.26
222.174.213.178
222.187.222.53
222.187.222.55
222.187.232.77
222.187.238.57
222.187.239.42
222.188.136.2
223.199.17.243
223.241.117.74
223.241.247.214
223.245.212.13

57
bi_postfix_1_7d.ipset Normal file
View File

@ -0,0 +1,57 @@
#
# bi_postfix_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# postfix with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/postfix/1?age=7d
# Source File Date: Mon Dec 14 10:08:38 UTC 2020
#
# Category : attacks
# Version : 3351
#
# This File Date : Mon Dec 14 10:08:38 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 27 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_postfix_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
36.37.180.59
37.49.225.161
60.167.113.133
60.167.113.245
60.167.118.60
60.167.119.99
66.240.192.138
71.6.135.131
71.6.165.200
80.82.77.33
80.82.77.139
82.127.124.78
82.208.65.46
92.154.95.236
93.174.95.106
103.47.14.246
112.221.173.170
114.237.155.139
185.43.206.103
188.165.235.21
193.188.254.67
197.156.97.73
198.20.69.98
208.100.26.233
208.100.26.237
220.178.107.242
221.230.1.113

62
bi_postfix_2_30d.ipset Normal file
View File

@ -0,0 +1,62 @@
#
# bi_postfix_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# postfix with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/postfix/2?age=30d
# Source File Date: Mon Dec 14 11:44:44 UTC 2020
#
# Category : attacks
# Version : 861
#
# This File Date : Mon Dec 14 11:44:44 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 32 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_postfix_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
36.37.180.59
37.49.225.123
37.49.225.161
37.49.225.164
37.49.225.186
66.240.192.138
71.6.135.131
71.6.146.186
71.6.165.200
80.82.70.118
80.82.77.33
80.82.77.139
82.208.65.46
92.154.95.236
93.174.95.106
103.47.14.246
112.133.248.100
112.196.43.202
138.186.179.16
139.162.99.243
164.52.24.168
188.165.235.21
193.188.254.67
197.156.97.73
198.20.69.98
201.140.110.78
201.174.182.158
208.100.26.233
208.100.26.237
219.143.72.21
220.178.107.242
221.230.1.113

63
bi_proftpd_0_1d.ipset Normal file
View File

@ -0,0 +1,63 @@
#
# bi_proftpd_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# proftpd with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/proftpd/0?age=1d
# Source File Date: Mon Dec 14 13:32:46 UTC 2020
#
# Category : attacks
# Version : 31027
#
# This File Date : Mon Dec 14 13:32:46 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 33 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_proftpd_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.58.47.108
31.184.199.114
36.37.124.100
36.90.42.132
51.89.107.21
58.33.174.203
58.228.50.98
61.142.20.22
61.177.172.158
85.26.234.177
87.241.1.186
94.78.193.73
110.87.80.53
111.225.205.11
111.231.226.216
113.70.242.159
113.87.201.163
116.96.128.232
116.236.91.34
118.31.187.234
119.126.143.0
121.10.3.83
134.175.133.109
144.123.160.129
165.84.180.37
180.247.51.198
183.190.9.36
185.239.242.225
194.61.24.177
194.105.205.42
202.78.232.138
219.91.168.167
221.203.23.107

31
bi_proftpd_1_7d.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bi_proftpd_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# proftpd with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/proftpd/1?age=7d
# Source File Date: Fri Dec 11 18:04:56 UTC 2020
#
# Category : attacks
# Version : 1417
#
# This File Date : Fri Dec 11 18:04:56 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_proftpd_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
221.13.7.50

31
bi_proftpd_2_30d.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bi_proftpd_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# proftpd with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/proftpd/2?age=30d
# Source File Date: Fri Dec 11 18:04:56 UTC 2020
#
# Category : attacks
# Version : 456
#
# This File Date : Fri Dec 11 18:04:56 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_proftpd_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
221.13.7.50

38
bi_pureftpd_0_1d.ipset Normal file
View File

@ -0,0 +1,38 @@
#
# bi_pureftpd_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# pureftpd with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/pureftpd/0?age=1d
# Source File Date: Mon Dec 14 13:32:46 UTC 2020
#
# Category : attacks
# Version : 22930
#
# This File Date : Mon Dec 14 13:32:46 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 8 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_pureftpd_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
1.83.55.142
14.236.17.205
58.22.93.115
61.142.21.29
111.61.177.158
113.87.100.93
113.116.171.105
223.165.150.21

31
bi_pureftpd_1_7d.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bi_pureftpd_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# pureftpd with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/pureftpd/1?age=7d
# Source File Date: Thu Dec 10 18:58:09 UTC 2020
#
# Category : attacks
# Version : 934
#
# This File Date : Thu Dec 10 18:58:09 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_pureftpd_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
221.202.168.254

31
bi_pureftpd_2_30d.ipset Normal file
View File

@ -0,0 +1,31 @@
#
# bi_pureftpd_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# pureftpd with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/pureftpd/2?age=30d
# Source File Date: Thu Dec 10 18:58:09 UTC 2020
#
# Category : attacks
# Version : 354
#
# This File Date : Thu Dec 10 18:58:10 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 1 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_pureftpd_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
221.202.168.254

33
bi_qmail-smtp_0_1d.ipset Normal file
View File

@ -0,0 +1,33 @@
#
# bi_qmail-smtp_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# qmail-smtp with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/qmail-smtp/0?age=1d
# Source File Date: Mon Dec 14 14:16:21 UTC 2020
#
# Category : attacks
# Version : 18547
#
# This File Date : Mon Dec 14 14:16:21 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 3 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_qmail-smtp_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
77.40.74.105
185.244.41.44
185.244.41.46

37
bi_rdp_0_1d.ipset Normal file
View File

@ -0,0 +1,37 @@
#
# bi_rdp_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# rdp with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/rdp/0?age=1d
# Source File Date: Mon Dec 14 14:09:51 UTC 2020
#
# Category : attacks
# Version : 7000
#
# This File Date : Mon Dec 14 14:09:51 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 7 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_rdp_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
36.99.192.34
60.214.157.134
64.227.30.51
89.248.165.22
103.89.90.24
139.180.154.59
213.82.20.134

154
bi_sasl_0_1d.ipset Normal file
View File

@ -0,0 +1,154 @@
#
# bi_sasl_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# sasl with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/sasl/0?age=1d
# Source File Date: Mon Dec 14 14:09:51 UTC 2020
#
# Category : attacks
# Version : 38598
#
# This File Date : Mon Dec 14 14:09:51 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 124 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_sasl_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.188.206.202
20.58.48.57
20.71.248.128
42.235.175.95
45.125.65.105
45.142.120.11
45.142.120.20
45.142.120.34
45.142.120.57
45.142.120.59
45.142.120.60
45.142.120.62
45.142.120.63
45.142.120.65
45.142.120.82
45.142.120.87
45.142.120.93
45.142.120.99
45.142.120.121
45.142.120.133
45.142.120.135
45.142.120.138
45.142.120.147
45.142.120.149
45.142.120.180
45.142.120.209
45.142.120.215
45.150.206.40
45.150.206.113
45.150.206.114
45.150.206.115
45.150.206.116
45.150.206.117
45.150.206.119
47.91.185.206
51.144.172.83
51.144.174.31
58.57.4.238
59.39.183.34
60.19.64.4
60.167.20.135
60.167.112.151
60.167.117.44
60.167.117.232
60.167.118.197
60.167.119.30
60.167.119.211
60.169.94.8
61.150.115.117
61.180.64.243
61.182.227.245
77.40.2.43
77.40.74.105
78.128.113.66
87.246.7.40
87.246.7.53
96.44.162.82
103.133.109.40
103.141.136.70
103.253.42.54
106.75.174.6
111.75.149.221
111.132.5.132
112.53.68.114
113.31.104.89
113.69.130.243
113.69.130.244
113.173.130.184
114.67.168.0
114.99.131.78
114.99.131.118
114.112.161.155
114.118.16.78
116.196.108.9
117.44.46.220
117.63.255.84
121.11.98.127
124.205.139.75
132.145.150.210
141.98.80.87
151.80.237.221
154.117.169.26
165.231.143.46
165.231.143.108
175.174.62.4
176.31.24.26
176.111.173.11
178.32.144.167
178.217.71.41
183.251.87.5
185.234.219.14
185.244.41.7
185.244.41.10
185.244.41.20
185.244.41.21
185.244.41.33
185.244.41.34
185.244.41.38
185.244.41.43
185.244.41.45
187.157.32.35
193.56.28.205
193.56.28.225
193.56.28.249
193.56.29.19
193.169.252.60
193.169.252.206
193.169.253.52
193.169.253.56
193.169.253.118
193.169.253.128
193.169.253.136
193.169.254.105
193.169.254.106
196.242.244.238
201.134.205.138
210.92.18.163
212.70.149.53
212.70.149.84
218.4.239.146
218.25.161.226
218.73.134.197
221.237.189.26
222.223.203.3

36
bi_sasl_1_7d.ipset Normal file
View File

@ -0,0 +1,36 @@
#
# bi_sasl_1_7d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# sasl with score above 1 and age less than 7d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/sasl/1?age=7d
# Source File Date: Sun Dec 13 15:44:21 UTC 2020
#
# Category : attacks
# Version : 2957
#
# This File Date : Sun Dec 13 15:44:21 UTC 2020
# Update Frequency: 6 hours
# Aggregation : none
# Entries : 6 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_sasl_1_7d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
37.49.225.15
37.49.225.123
37.49.225.138
60.167.20.135
60.167.21.231
217.217.179.17

35
bi_sasl_2_30d.ipset Normal file
View File

@ -0,0 +1,35 @@
#
# bi_sasl_2_30d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# sasl with score above 2 and age less than 30d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/sasl/2?age=30d
# Source File Date: Wed Dec 9 10:45:01 UTC 2020
#
# Category : attacks
# Version : 807
#
# This File Date : Wed Dec 9 10:45:01 UTC 2020
# Update Frequency: 1 day
# Aggregation : none
# Entries : 5 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_sasl_2_30d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
37.49.225.15
37.49.225.102
37.49.225.123
37.49.225.138
217.217.179.17

53
bi_sip_0_1d.ipset Normal file
View File

@ -0,0 +1,53 @@
#
# bi_sip_0_1d
#
# ipv4 hash:ip ipset
#
# [BadIPs.com] (https://www.badips.com/) Bad IPs in category
# sip with score above 0 and age less than 1d
#
# Maintainer : BadIPs.com
# Maintainer URL : https://www.badips.com/
# List source URL : https://www.badips.com/get/list/sip/0?age=1d
# Source File Date: Mon Dec 14 10:52:22 UTC 2020
#
# Category : attacks
# Version : 11994
#
# This File Date : Mon Dec 14 10:52:22 UTC 2020
# Update Frequency: 30 mins
# Aggregation : none
# Entries : 23 unique IPs
#
# Full list analysis, including geolocation map, history,
# retention policy, overlaps with other lists, etc.
# available at:
#
# http://iplists.firehol.org/?ipset=bi_sip_0_1d
#
# Generated by FireHOL's update-ipsets.sh
# Processed with FireHOL's iprange
#
5.104.110.58
5.182.209.21
45.143.221.68
46.166.162.54
52.162.206.182
80.94.93.85
80.94.93.104
81.83.7.136
89.163.253.78
89.239.44.123
94.110.82.161
103.145.13.109
151.106.34.42
154.16.93.93
172.107.198.162
176.67.86.203
178.117.229.190
185.147.213.12
185.147.215.14
185.245.84.32
195.130.156.202
200.25.44.100
209.126.68.154

Some files were not shown because too many files have changed in this diff Show More