diff --git a/ransomware_feed.ipset b/ransomware_feed.ipset
index 92d5f1f881..1739d52215 100644
--- a/ransomware_feed.ipset
+++ b/ransomware_feed.ipset
@@ -19,15 +19,15 @@
 # Maintainer      : Abuse.ch
 # Maintainer URL  : https://ransomwaretracker.abuse.ch
 # List source URL : https://ransomwaretracker.abuse.ch/feeds/csv/
-# Source File Date: Sun Nov 20 11:20:12 UTC 2016
+# Source File Date: Sun Nov 20 11:28:11 UTC 2016
 #
 # Category        : malware
-# Version         : 32372
+# Version         : 32373
 #
-# This File Date  : Sun Nov 20 11:20:13 UTC 2016
+# This File Date  : Sun Nov 20 11:28:11 UTC 2016
 # Update Frequency: 5 mins 
 # Aggregation     : none
-# Entries         : 4034 unique IPs
+# Entries         : 4033 unique IPs
 #
 # Full list analysis, including geolocation map, history,
 # retention policy, overlaps with other lists, etc.
@@ -2081,6 +2081,7 @@
 113.207.48.168
 114.55.35.146
 114.80.193.10
+114.80.253.87
 114.108.128.208
 114.108.131.111
 114.215.138.114
@@ -2204,7 +2205,6 @@
 122.114.131.5
 122.114.131.6
 122.114.131.30
-122.114.137.245
 122.114.155.26
 122.114.157.33
 122.114.157.52
@@ -2602,7 +2602,6 @@
 166.62.28.123
 166.62.28.145
 166.62.28.147
-166.62.29.125
 166.62.30.149
 166.62.30.158
 166.62.41.12