IPsum is a threat intelligence feed based on 30+ different publicly available lists of suspicious and/or malicious IP addresses. All lists are automatically retrieved and parsed on a daily (24h) basis and the final result is pushed to this repository. List is made of IP addresses together with a total number of (black)list occurrence (for each). Greater the number, lesser the chance of false positive detection and/or dropping in (inbound) monitored traffic. Also, list is sorted from most (problematic) to least occurent IP addresses.
As an example, to get a fresh and ready-to-deploy auto-ban list of "bad IPs" that appear on at least 3 (black)lists you can run:
curl --compressed https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt 2>/dev/null | grep -v "#" | grep -v -E "\s[1-2]$" | cut -f 1
If you want to try it with ipset, you can do the following:
sudo su
apt -qq install iptables ipset
ipset -q flush ipsum
ipset -q create ipsum hash:net
for ip in $(curl --compressed https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt 2>/dev/null | grep -v "#" | grep -v -E "\s[1-2]$" | cut -f 1); do ipset add ipsum $ip; done
iptables -I INPUT -m set --match-set ipsum src -j DROP
In directory levels you can find preprocessed raw IP lists based on number of blacklist occurrences (e.g. levels/3.txt holds IP addresses that can be found on 3 or more blacklists).
| IP | DNS lookup | Number of (black)lists |
|---|---|---|
| 205.185.122.230 | server.jcolideles.com | 10 |
| 199.195.248.123 | - | 10 |
| 205.185.113.39 | - | 10 |
| 209.141.32.203 | - | 10 |
| 199.195.249.4 | - | 10 |
| 45.61.188.118 | - | 9 |
| 37.0.10.41 | - | 9 |
| 45.61.187.179 | - | 9 |
| 209.141.53.124 | mta3.doknewsletter.de | 9 |
| 209.141.43.141 | - | 9 |
| 199.195.253.187 | - | 9 |
| 171.25.193.78 | tor-exit4-readme.dfri.se | 9 |
| 104.244.76.25 | shy.bwmtech.com | 9 |
| 45.61.185.254 | - | 9 |
| 199.195.252.105 | mx2.amtderbeschwerde.org | 9 |
| 141.98.10.125 | - | 9 |
| 45.61.188.109 | - | 9 |
| 45.61.188.224 | - | 9 |
| 74.201.28.113 | zimmer.impactflower.com | 9 |
| 198.98.56.228 | - | 9 |
| 45.61.184.109 | - | 9 |
| 209.141.60.135 | smtp4.einfachdoktor.eu | 9 |
| 209.141.36.169 | bucket.googolplexed.net | 9 |
| 107.189.31.98 | - | 9 |
| 222.168.30.19 | - | 9 |
| 209.141.37.168 | - | 9 |
| 205.185.114.57 | - | 9 |
| 209.141.49.70 | - | 9 |
| 199.195.253.212 | - | 9 |
| 205.185.116.44 | smtp2.einfachdoktor.eu | 8 |
| 209.141.45.246 | cciccl11.cn | 8 |
| 209.141.60.28 | tagsmtp-60-28.whtned.com.br | 8 |
| 104.244.74.6 | - | 8 |
| 209.141.61.146 | default.com | 8 |
| 209.141.40.210 | - | 8 |
| 107.189.12.73 | - | 8 |
| 209.141.50.137 | news-mailing.org | 8 |
| 209.141.35.244 | - | 8 |
| 107.189.31.150 | mail5.groznyserver.de | 8 |
| 209.141.54.219 | - | 8 |
| 209.141.50.151 | - | 8 |
| 41.226.25.4 | - | 8 |
| 104.244.78.6 | - | 8 |
| 107.189.1.167 | - | 8 |
| 107.189.1.130 | - | 8 |
| 205.185.125.212 | lv.vultr.cyou | 8 |
| 209.141.61.220 | - | 8 |
| 171.25.193.77 | tor-exit1-readme.dfri.se | 8 |
| 185.220.101.4 | - | 8 |
| 185.220.101.3 | - | 8 |
| 124.79.244.108 | 108.244.79.124.broad.xw.sh.dynamic.163data.com.cn | 8 |
| 45.154.255.147 | cust-147.keff.org | 8 |
| 222.187.254.41 | - | 8 |
| 205.185.113.22 | - | 8 |
| 107.189.1.133 | - | 8 |
| 209.141.32.175 | - | 8 |
| 104.244.78.182 | - | 8 |
| 205.185.114.127 | - | 8 |
| 185.220.100.255 | tor-exit-4.zbau.f3netze.de | 8 |
| 107.189.5.24 | amazon.service-note.com | 8 |
| 107.189.14.253 | - | 8 |
| 205.185.118.120 | - | 8 |
| 185.220.101.22 | - | 8 |
| 87.241.1.186 | - | 8 |
| 107.189.12.174 | - | 8 |
| 107.189.31.247 | - | 8 |
| 205.185.122.135 | - | 8 |
| 107.189.2.131 | - | 8 |
| 107.189.14.166 | - | 8 |
| 179.43.141.99 | - | 8 |
| 205.185.117.112 | dns2.las.bvm.novae.tel | 8 |
| 209.141.59.249 | icthub.info | 8 |
| 107.189.12.139 | - | 8 |
| 176.10.104.240 | tor1e1.digitale-gesellschaft.ch | 8 |
| 205.185.121.155 | - | 8 |
| 107.189.4.10 | - | 8 |
| 116.98.167.0 | dynamic-ip-adsl.viettel.vn | 8 |
| 209.141.59.228 | - | 8 |
| 209.141.52.113 | - | 8 |
| 107.189.30.104 | - | 8 |
| 107.189.29.64 | - | 8 |
| 107.189.12.62 | - | 8 |
| 205.185.121.179 | - | 8 |
| 205.185.121.175 | mail.lovexstore.com | 8 |
| 222.187.254.36 | - | 8 |
| 104.244.77.100 | hosted.by.everly.to | 8 |
| 209.141.33.39 | mail.pomoc-poczta.cloud | 8 |
| 171.25.193.25 | tor-exit5-readme.dfri.se | 8 |
| 209.141.61.174 | lv.soleohost.com | 8 |
| 205.185.123.128 | www1.cloudscene.com | 8 |
| 209.141.54.202 | - | 8 |
| 209.141.61.41 | bellagio.mujicloud.com | 8 |
| 199.19.224.129 | web.salvrp.com | 8 |
| 205.185.127.100 | - | 8 |
| 45.61.187.180 | - | 8 |
| 222.186.30.76 | - | 8 |
| 104.244.76.13 | tor-exit-node.spongebob.nicdex.com | 8 |
| 2.56.59.30 | - | 8 |
| 205.185.121.102 | mail2.warumimmerblacklisted.org | 8 |
| 209.141.53.30 | - | 8 |
| 205.185.119.131 | - | 8 |
| 107.189.14.193 | - | 8 |
| 205.185.113.128 | - | 8 |
| 185.220.100.241 | tor-exit-14.zbau.f3netze.de | 8 |
| 205.185.116.103 | ares.latenightworks.com | 8 |
| 162.247.72.199 | - | 8 |
| 205.185.125.179 | - | 8 |
| 107.189.12.183 | - | 8 |
| 104.244.76.55 | - | 8 |
| 134.122.63.251 | - | 8 |
| 209.141.42.210 | - | 8 |
| 107.189.28.196 | - | 8 |
| 107.189.1.94 | - | 8 |
| 205.185.117.161 | lv.pl3xb0x.org | 8 |
| 199.19.224.41 | smtp2.gftvrsr.xyz | 8 |
| 209.141.52.86 | navy.wmail.id | 8 |
| 222.187.254.38 | - | 8 |
| 164.90.205.124 | - | 8 |
| 209.141.45.173 | exit04oxds.org | 8 |
| 205.185.117.109 | rufy.bbqd.org | 8 |
| 209.141.35.160 | mail.g3nius.org | 8 |
| 209.141.34.36 | - | 8 |
| 41.215.138.42 | - | 7 |
| 89.234.157.254 | marylou.nos-oignons.net | 7 |
| 209.141.57.50 | mail10.achdaswirdgehen.me | 7 |
| 185.107.47.215 | tor-exit.r1.darknet.dev | 7 |
| 139.59.39.39 | - | 7 |
| 51.210.80.127 | tor-exit-fr.letztermensch.com | 7 |
| 82.156.105.156 | - | 7 |
| 162.247.74.74 | - | 7 |
| 209.141.40.252 | - | 7 |
| 205.185.122.83 | youtianxia23.sendingmail.club | 7 |
| 169.239.73.106 | - | 7 |
| 185.107.47.171 | tor-exit.r2.darknet.dev | 7 |
| 185.220.101.1 | - | 7 |
| 45.9.20.15 | - | 7 |
| 186.122.149.6 | host6.186-122-149.telmex.net.ar | 7 |
| 172.248.49.109 | cpe-172-248-49-109.socal.res.rr.com | 7 |
| 130.149.80.199 | tor.dsi.tu-berlin.de | 7 |
| 134.122.55.221 | - | 7 |
| 185.220.101.9 | - | 7 |
| 209.141.54.197 | exit-3.tor.prevarinite.com | 7 |
| 202.96.98.106 | - | 7 |
| 104.244.78.183 | luxembourgtor34.lu | 7 |
| 185.107.70.202 | tor-exit.r3.darknet.dev | 7 |
| 64.225.73.18 | - | 7 |
| 91.219.237.21 | 178911033-dedicated.serverastra.com | 7 |
| 185.100.87.72 | iclnm.worlpeed.net | 7 |
| 94.230.208.147 | tor3e1.digitale-gesellschaft.ch | 7 |
| 185.220.101.24 | - | 7 |
| 192.42.116.16 | tor-exit.hartvoorinternetvrijheid.nl | 7 |
| 198.144.120.234 | - | 7 |
| 166.70.207.2 | this.is.a.tor.node.xmission.com | 7 |
| 176.111.173.156 | - | 7 |
| 185.130.44.108 | tor-exit-se1.privex.cc | 7 |
| 139.59.104.133 | - | 7 |
| 121.5.162.8 | - | 7 |
| 220.130.178.136 | lily.master.org.tw | 7 |
| 198.144.121.93 | - | 7 |
| 104.244.77.4 | - | 7 |
| 45.153.160.140 | - | 7 |
| 77.247.181.165 | politkovskaja.torservers.net | 7 |
| 77.247.181.163 | lumumba.torservers.net | 7 |
| 107.189.4.31 | smtprdns3.werschreitdersiegt.de | 7 |
| 106.12.132.47 | - | 7 |
| 179.43.147.67 | mail.alliancestratamanagement.com | 7 |
| 209.141.46.232 | - | 7 |
| 162.247.74.27 | turing.tor-exit.calyxinstitute.org | 7 |
| 209.141.36.53 | - | 7 |
| 109.104.151.106 | - | 7 |
| 179.43.176.53 | - | 7 |
| 171.25.193.20 | tor-exit0-readme.dfri.se | 7 |
| 176.10.99.200 | accessnow.org | 7 |
| 189.113.131.44 | 189-113-131-44.telecall.com.br | 7 |
| 104.248.170.45 | ubuntu-18.04-broyce | 7 |
| 209.141.60.134 | - | 7 |
| 213.202.216.189 | h176.helix.dedi.server-hosting.expert | 7 |
| 64.113.32.29 | tor.t-3.net | 7 |
| 205.185.119.216 | - | 7 |
| 93.84.87.214 | static15.byfly.gomel.by | 7 |
| 199.195.250.77 | ny1.exit.tor.alkyl.eu.org | 7 |
| 163.172.213.212 | trenecito.noconname.org | 7 |
| 209.141.48.211 | smtpout104.9ninewest.com | 7 |
| 37.0.11.169 | - | 7 |
| 205.185.114.54 | coopernet.co.nz | 7 |
| 104.248.93.211 | - | 7 |
| 45.153.160.139 | - | 7 |
| 40.73.17.36 | - | 7 |
| 185.220.101.17 | - | 7 |
| 176.111.173.85 | - | 7 |
| 149.202.238.204 | 204.238.202.149.fr-sbg.flexcloud.seflow.it | 7 |
| 107.189.28.198 | - | 7 |
| 117.248.249.70 | - | 7 |
| 199.19.226.145 | lv01.0wn.net | 7 |
| 107.189.12.169 | - | 7 |
| 192.42.116.18 | this-is-a-tor-exit-node-hviv118.hviv.nl | 7 |
| 209.141.58.69 | - | 7 |
| 141.98.10.250 | - | 7 |
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent