IPsum is a threat intelligence feed based on 30+ different publicly available lists of suspicious and/or malicious IP addresses. All lists are automatically retrieved and parsed on a daily (24h) basis and the final result is pushed to this repository. List is made of IP addresses together with a total number of (black)list occurrence (for each). Greater the number, lesser the chance of false positive detection and/or dropping in (inbound) monitored traffic. Also, list is sorted from most (problematic) to least occurent IP addresses.
As an example, to get a fresh and ready-to-deploy auto-ban list of "bad IPs" that appear on at least 3 (black)lists you can run:
curl https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt 2>/dev/null | grep -v "#" | grep -v -E "\s[1-2]$" | cut -f 1
If you want to try it with ipset, you can do the following:
sudo su
apt-get -qq install iptables ipset
ipset -q flush ipsum
ipset -q create ipsum hash:ip
for ip in $(curl https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt 2>/dev/null | grep -v "#" | grep -v -E "\s[1-2]$" | cut -f 1); do ipset add ipsum $ip; done
iptables -D INPUT -m set --match-set ipsum src -j DROP 2>/dev/null
iptables -I INPUT -m set --match-set ipsum src -j DROP
In directory levels you can find preprocessed raw IP lists based on number of blacklist occurrences (e.g. levels/3.txt holds IP addresses that can be found on 3 or more blacklists).
| IP | DNS lookup | Number of (black)lists |
|---|---|---|
| 193.32.162.157 | - | 11 |
| 80.82.77.139 | dojo.census.shodan.io | 10 |
| 92.118.39.95 | - | 10 |
| 71.6.199.23 | einstein.census.shodan.io | 9 |
| 72.167.37.60 | 60.37.167.72.host.secureserver.net | 9 |
| 80.82.77.33 | sky.census.shodan.io | 9 |
| 93.174.95.106 | battery.census.shodan.io | 9 |
| 167.94.146.52 | - | 9 |
| 185.93.89.118 | - | 9 |
| 196.251.88.103 | - | 9 |
| 3.137.73.221 | scan.cypex.ai | 8 |
| 14.63.196.175 | - | 8 |
| 27.254.192.185 | - | 8 |
| 59.34.57.200 | - | 8 |
| 66.240.192.138 | census8.shodan.io | 8 |
| 80.82.77.202 | rnd.group-ib.com | 8 |
| 82.207.8.154 | 154-8-207-82.pool.ukrtel.net | 8 |
| 86.54.31.38 | blue2.census.shodan.io | 8 |
| 89.97.218.142 | 89-97-218-142.ip19.fastwebnet.it | 8 |
| 89.248.172.16 | house.census.shodan.io | 8 |
| 95.182.115.26 | - | 8 |
| 103.39.93.93 | - | 8 |
| 103.188.82.254 | - | 8 |
| 103.237.144.204 | - | 8 |
| 103.246.42.72 | rw-0072-42.246.103.rcil.gov.in | 8 |
| 104.244.77.50 | - | 8 |
| 128.199.157.145 | - | 8 |
| 162.142.125.125 | scanner-20.ch1.censys-scanner.com | 8 |
| 162.157.117.92 | d162-157-117-92.abhsia.telus.net | 8 |
| 165.154.163.10 | - | 8 |
| 165.227.210.57 | - | 8 |
| 167.94.146.60 | - | 8 |
| 167.94.146.61 | - | 8 |
| 178.176.250.39 | - | 8 |
| 185.156.73.233 | - | 8 |
| 185.156.73.234 | - | 8 |
| 185.165.191.27 | red.census.shodan.io | 8 |
| 193.32.162.141 | - | 8 |
| 193.32.162.143 | - | 8 |
| 193.32.162.146 | - | 8 |
| 198.199.71.30 | - | 8 |
| 199.45.154.159 | scanner-205.hk2.censys-scanner.com | 8 |
| 211.253.10.96 | - | 8 |
| 217.182.230.0 | ip0.ip-217-182-230.eu | 8 |
| 223.130.11.165 | - | 8 |
| 2.229.29.110 | 2-229-29-110.ip194.fastwebnet.it | 7 |
| 3.130.96.91 | scan.cypex.ai | 7 |
| 12.156.67.18 | - | 7 |
| 14.29.198.130 | - | 7 |
| 24.45.135.64 | ool-182d8740.dyn.optonline.net | 7 |
| 27.111.32.174 | - | 7 |
| 27.254.235.3 | - | 7 |
| 27.254.235.4 | - | 7 |
| 34.64.41.134 | 134.41.64.34.bc.googleusercontent.com | 7 |
| 34.66.72.251 | 251.72.66.34.bc.googleusercontent.com | 7 |
| 34.85.163.94 | 94.163.85.34.bc.googleusercontent.com | 7 |
| 34.142.110.144 | 144.110.142.34.bc.googleusercontent.com | 7 |
| 34.175.118.185 | 185.118.175.34.bc.googleusercontent.com | 7 |
| 36.50.216.75 | - | 7 |
| 36.66.16.233 | - | 7 |
| 36.255.3.203 | - | 7 |
| 45.43.33.210 | colby.probe.onyphe.net | 7 |
| 45.43.33.218 | chen.probe.onyphe.net | 7 |
| 45.79.181.251 | guernsey.scan.bufferover.run | 7 |
| 45.82.78.254 | - | 7 |
| 45.84.107.17 | exit-12.tor.r0cket.net | 7 |
| 45.118.146.109 | - | 7 |
| 45.131.155.254 | - | 7 |
| 45.172.152.74 | - | 7 |
| 45.232.73.84 | - | 7 |
| 46.101.210.71 | - | 7 |
| 46.238.32.247 | ip-46-238-32-247.home.megalan.bg | 7 |
| 47.180.114.229 | 47-180-114-229.944e76fe48b133ae6f88b784db937d44.ip.frontiernet.net | 7 |
| 50.192.223.205 | - | 7 |
| 51.68.226.87 | vps-fc0b2823.vps.ovh.net | 7 |
| 51.75.64.35 | vps-3d54f2a3.vps.ovh.net | 7 |
| 51.75.124.228 | vps-edcbbc9b.vps.ovh.net | 7 |
| 51.75.194.10 | vps-f8f463b5.vps.ovh.net | 7 |
| 51.77.246.7 | ns3139592.ip-51-77-246.eu | 7 |
| 51.83.98.100 | vps-7c4217f7.vps.ovh.net | 7 |
| 51.195.46.102 | vps-7201bce5.vps.ovh.net | 7 |
| 51.210.243.91 | vps-204029ff.vps.ovh.net | 7 |
| 58.147.171.11 | 58.148.171-11.aitlbd.net | 7 |
| 60.199.224.2 | 60-199-224-2.static.tfn.net.tw | 7 |
| 61.99.254.192 | - | 7 |
| 61.188.205.76 | 76.205.188.61.broad.nj.sc.dynamic.163data.com.cn | 7 |
| 62.36.40.104 | mail1.prevecam.es | 7 |
| 62.210.131.177 | 62-210-131-177.rev.poneytelecom.eu | 7 |
| 69.139.42.36 | c-69-139-42-36.hsd1.fl.comcast.net | 7 |
| 71.6.135.131 | soda.census.shodan.io | 7 |
| 71.6.167.142 | census9.shodan.io | 7 |
| 80.82.70.133 | rnd.group-ib.com | 7 |
| 81.211.72.167 | - | 7 |
| 82.65.43.136 | 82-65-43-136.subs.proxad.net | 7 |
| 86.54.31.32 | hat.census.shodan.io | 7 |
| 86.54.31.34 | wine.census.shodan.io | 7 |
| 87.248.226.146 | 87.248.226.146.pool.sknt.ru | 7 |
| 89.248.167.131 | mason.census.shodan.io | 7 |
| 91.196.152.101 | ruth.probe.onyphe.net | 7 |
| 91.205.219.185 | - | 7 |
| 92.27.101.99 | host-92-27-101-99.static.as13285.net | 7 |
| 92.55.190.215 | - | 7 |
| 92.118.39.92 | - | 7 |
| 93.123.109.191 | - | 7 |
| 93.185.76.242 | - | 7 |
| 94.190.208.173 | 94-190-208-173.static.imsbiz.com | 7 |
| 94.254.0.234 | h-94-254-0-234.na.cust.bahnhof.se | 7 |
| 95.58.255.251 | 95.58.255.251.static.telecom.kz | 7 |
| 95.167.225.76 | - | 7 |
| 101.47.72.59 | - | 7 |
| 101.226.180.6 | - | 7 |
| 102.140.97.134 | - | 7 |
| 102.210.80.6 | - | 7 |
| 103.25.47.94 | rainbowisp.in | 7 |
| 103.26.136.173 | mail.gshakti.org | 7 |
| 103.49.238.104 | ip103-49-238-104.cloudhost.web.id | 7 |
| 103.61.44.100 | - | 7 |
| 103.91.136.18 | - | 7 |
| 103.148.100.146 | - | 7 |
| 103.149.86.208 | - | 7 |
| 103.154.77.2 | dns.77.2.t2net.id | 7 |
| 103.168.135.106 | - | 7 |
| 103.252.170.58 | c58.ucndns.in | 7 |
| 110.49.30.83 | - | 7 |
| 112.95.227.2 | - | 7 |
| 112.120.228.189 | n112120228189.netvigator.com | 7 |
| 114.34.106.146 | 114-34-106-146.hinet-ip.hinet.net | 7 |
| 115.91.91.182 | - | 7 |
| 121.201.125.75 | 121.201.125.75 | 7 |
| 122.155.0.205 | www.phatan.go.th | 7 |
| 122.155.223.2 | - | 7 |
| 125.72.54.155 | - | 7 |
| 125.228.185.131 | 125-228-185-131.hinet-ip.hinet.net | 7 |
| 128.199.20.225 | - | 7 |
| 128.199.95.60 | - | 7 |
| 132.148.164.7 | 7.164.148.132.host.secureserver.net | 7 |
| 134.209.162.179 | - | 7 |
| 136.232.203.134 | - | 7 |
| 139.59.173.98 | - | 7 |
| 143.244.134.97 | - | 7 |
| 145.239.85.111 | vps-87a498e8.vps.ovh.net | 7 |
| 147.50.227.79 | - | 7 |
| 147.185.132.10 | xq91aeltlck | 7 |
| 152.32.145.111 | - | 7 |
| 154.221.27.234 | - | 7 |
| 156.241.0.211 | - | 7 |
| 157.245.9.67 | cityofmarion.in.gov | 7 |
| 158.51.126.147 | - | 7 |
| 160.174.129.232 | - | 7 |
| 162.142.125.35 | - | 7 |
| 162.142.125.45 | - | 7 |
| 162.142.125.46 | - | 7 |
| 162.142.125.194 | - | 7 |
| 162.142.125.197 | - | 7 |
| 162.142.125.198 | - | 7 |
| 162.142.125.203 | - | 7 |
| 162.142.125.210 | scanner-05.ch1.censys-scanner.com | 7 |
| 162.142.125.219 | scanner-25.ch1.censys-scanner.com | 7 |
| 162.142.125.220 | scanner-25.ch1.censys-scanner.com | 7 |
| 162.240.238.27 | server.ikr.kkt.mybluehostin.me | 7 |
| 162.243.168.76 | - | 7 |
| 162.251.63.12 | 12-63-251-162.clients.gthost.com | 7 |
| 165.154.105.128 | - | 7 |
| 167.94.138.114 | scanner-27.ch1.censys-scanner.com | 7 |
| 167.94.145.96 | - | 7 |
| 167.94.145.98 | - | 7 |
| 167.94.145.99 | - | 7 |
| 167.94.145.101 | - | 7 |
| 167.94.145.102 | - | 7 |
| 167.94.145.103 | - | 7 |
| 167.94.145.106 | - | 7 |
| 167.94.145.107 | - | 7 |
| 167.94.145.108 | - | 7 |
| 167.94.145.109 | - | 7 |
| 167.94.145.110 | - | 7 |
| 167.94.146.48 | - | 7 |
| 167.94.146.49 | - | 7 |
| 167.94.146.50 | - | 7 |
| 167.94.146.54 | - | 7 |
| 167.94.146.56 | - | 7 |
| 167.94.146.57 | - | 7 |
| 167.94.146.59 | - | 7 |
| 167.94.146.62 | - | 7 |
| 170.64.166.123 | - | 7 |
| 175.100.24.139 | - | 7 |
| 176.65.148.10 | hosted-by.pfcloud.io | 7 |
| 180.76.202.69 | - | 7 |
| 182.44.72.96 | - | 7 |
| 182.93.50.90 | n18293z50l90.static.ctmip.net | 7 |
| 182.215.66.232 | - | 7 |
| 185.157.223.126 | 185-157-223-126-static.glesys.net | 7 |
| 185.216.116.99 | - | 7 |
| 186.118.142.216 | - | 7 |
| 186.124.22.55 | host55.186-124-22.telecom.net.ar | 7 |
| 186.233.208.13 | - | 7 |
| 187.45.100.0 | - | 7 |
| 188.166.106.38 | - | 7 |
| 189.7.17.61 | bd07113d.virtua.com.br | 7 |
| 189.112.0.11 | 189-112-000-011.static.ctbctelecom.com.br | 7 |
| 190.85.15.251 | - | 7 |
| 190.171.189.85 | 190-171-189-85.empresas.movistar.cl | 7 |
| 192.241.155.120 | portscanner-nyc1-04.prod.cyberresilience.io | 7 |
| 193.32.162.145 | - | 7 |
| 193.32.162.151 | - | 7 |
| 193.70.87.152 | 152.ip-193-70-87.eu | 7 |
| 193.123.114.34 | - | 7 |
| 194.9.56.139 | - | 7 |
| 195.3.221.137 | smtp9.munxkey.com.com | 7 |
| 196.251.80.92 | undefined.hostname.localhost | 7 |
| 197.5.145.8 | - | 7 |
| 197.5.145.102 | - | 7 |
| 197.227.8.186 | - | 7 |
| 198.12.114.232 | 198-12-114-232-host.colocrossing.com | 7 |
| 198.24.79.245 | syn-198-024-079-245.biz.spectrum.com | 7 |
| 198.46.207.98 | 198-46-207-98-host.colocrossing.com | 7 |
| 199.45.154.120 | scanner-201.hk2.censys-scanner.com | 7 |
| 199.45.154.131 | scanner-203.hk2.censys-scanner.com | 7 |
| 199.45.154.134 | scanner-203.hk2.censys-scanner.com | 7 |
| 199.45.155.71 | scanner-202.hk2.censys-scanner.com | 7 |
| 199.45.155.78 | scanner-202.hk2.censys-scanner.com | 7 |
| 199.45.155.86 | scanner-204.hk2.censys-scanner.com | 7 |
| 199.45.155.90 | scanner-204.hk2.censys-scanner.com | 7 |
| 199.45.155.105 | scanner-206.hk2.censys-scanner.com | 7 |
| 199.45.155.106 | scanner-206.hk2.censys-scanner.com | 7 |
| 199.45.155.109 | scanner-206.hk2.censys-scanner.com | 7 |
| 200.69.236.207 | seldon.tecnologica.com.ar | 7 |
| 200.189.192.3 | spo.dts.gemalto.com.br | 7 |
| 202.157.177.33 | mail.simaster-brebeskab.id | 7 |
| 202.157.177.161 | - | 7 |
| 203.69.37.212 | 203-69-37-212.hinet-ip.hinet.net | 7 |
| 203.150.107.244 | 244.107.150.203.sta.inet.co.th | 7 |
| 203.196.8.245 | - | 7 |
| 209.38.228.147 | core1.bbe.masterit-dev.cloud | 7 |
| 210.91.73.167 | - | 7 |
| 210.113.70.126 | - | 7 |
| 210.114.22.126 | - | 7 |
| 211.105.223.49 | - | 7 |
| 213.155.195.169 | 213-155-195-x.dynamic.b-domolink.net | 7 |
| 216.10.250.218 | server.digitalspoint.com | 7 |
| 218.56.160.82 | - | 7 |
| 220.80.223.144 | - | 7 |
| 220.81.148.101 | - | 7 |
| 220.169.107.60 | - | 7 |
| 221.161.235.168 | - | 7 |
| 221.229.218.50 | - | 7 |
| 222.172.32.246 | - | 7 |
| 223.197.186.7 | 223-197-186-7.static.imsbiz.com | 7 |