IPsum is a threat intelligence feed based on 30+ different publicly available lists of suspicious and/or malicious IP addresses. All lists are automatically retrieved and parsed on a daily (24h) basis and the final result is pushed to this repository. List is made of IP addresses together with a total number of (black)list occurrence (for each). Greater the number, lesser the chance of false positive detection and/or dropping in (inbound) monitored traffic. Also, list is sorted from most (problematic) to least occurent IP addresses.
As an example, to get a fresh and ready-to-deploy auto-ban list of "bad IPs" that appear on at least 3 (black)lists you can run:
curl --compressed https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt 2>/dev/null | grep -v "#" | grep -v -E "\s[1-2]$" | cut -f 1
If you want to try it with ipset
, you can do the following:
sudo su
apt -qq install iptables ipset
ipset -q flush ipsum
ipset -q create ipsum hash:net
for ip in $(curl --compressed https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt 2>/dev/null | grep -v "#" | grep -v -E "\s[1-2]$" | cut -f 1); do ipset add ipsum $ip; done
iptables -I INPUT -m set --match-set ipsum src -j DROP
In directory levels you can find preprocessed raw IP lists based on number of blacklist occurrences (e.g. levels/3.txt holds IP addresses that can be found on 3 or more blacklists).
IP | DNS lookup | Number of (black)lists |
---|---|---|
209.141.62.234 | - | 9 |
209.141.53.227 | - | 9 |
209.141.61.31 | icefloe.qeast.net | 9 |
171.25.193.78 | tor-exit4-readme.dfri.se | 9 |
107.189.1.107 | - | 9 |
141.98.10.179 | er.includeswitche.com | 9 |
107.189.3.138 | - | 9 |
199.195.248.154 | - | 9 |
199.19.226.109 | - | 8 |
89.163.249.244 | srv1264.dedicated.server-hosting.expert | 8 |
205.185.127.25 | serveroperations.com | 8 |
209.141.48.157 | - | 8 |
205.185.125.109 | - | 8 |
107.189.3.151 | - | 8 |
209.141.32.149 | - | 8 |
205.185.117.79 | - | 8 |
221.181.185.159 | - | 8 |
209.141.54.66 | - | 8 |
45.133.1.153 | - | 8 |
205.185.126.160 | - | 8 |
209.141.54.238 | delta.tshost.no | 8 |
171.25.193.77 | tor-exit1-readme.dfri.se | 8 |
136.144.41.41 | - | 8 |
171.231.106.135 | dynamic-ip-adsl.viettel.vn | 8 |
209.141.59.86 | for2.qalabatina.club | 8 |
221.181.185.223 | - | 8 |
117.248.249.70 | - | 8 |
205.185.125.24 | - | 8 |
171.25.193.20 | tor-exit0-readme.dfri.se | 8 |
171.25.193.25 | tor-exit5-readme.dfri.se | 8 |
141.98.10.203 | - | 8 |
64.113.32.29 | tor.t-3.net | 8 |
205.185.127.240 | www.fusioncc.com | 7 |
205.185.119.90 | email-poczta.pl | 7 |
209.141.50.25 | peach.snapnode.com | 7 |
221.131.165.23 | - | 7 |
222.187.232.205 | - | 7 |
120.224.50.233 | - | 7 |
185.220.102.243 | 185-220-102-243.torservers.net | 7 |
107.189.1.161 | - | 7 |
199.19.225.151 | youtianxia22.sendingmail.club | 7 |
209.141.60.49 | - | 7 |
60.8.87.190 | - | 7 |
128.199.53.37 | - | 7 |
209.141.47.144 | seafoam.minuette.net | 7 |
221.181.185.140 | - | 7 |
221.181.185.143 | - | 7 |
209.141.42.147 | - | 7 |
185.220.100.253 | tor-exit-2.zbau.f3netze.de | 7 |
205.185.118.227 | google.com | 7 |
192.42.116.18 | this-is-a-tor-exit-node-hviv118.hviv.nl | 7 |
222.187.239.109 | - | 7 |
166.70.207.2 | this.is.a.tor.node.xmission.com | 7 |
182.73.123.118 | - | 7 |
82.64.46.144 | 82-64-46-144.subs.proxad.net | 7 |
209.141.50.121 | mta4.blmcola.de | 7 |
222.186.42.7 | - | 7 |
209.141.47.35 | - | 7 |
107.189.1.174 | - | 7 |
209.141.41.11 | ns1.hybriddns.com | 7 |
209.141.47.132 | tomoka.myconan.net | 7 |
221.181.185.153 | - | 7 |
221.181.185.151 | - | 7 |
45.153.160.139 | - | 7 |
205.185.113.76 | las.he.alrale.tk | 7 |
209.141.46.97 | s1.technisi.com | 7 |
209.141.32.39 | - | 7 |
45.153.160.2 | - | 7 |
209.141.35.200 | - | 7 |
205.185.123.156 | - | 7 |
221.181.185.198 | - | 7 |
36.112.171.51 | - | 7 |
222.186.30.112 | - | 7 |
221.181.185.19 | - | 7 |
107.189.1.180 | - | 7 |
5.2.69.50 | - | 7 |
209.141.43.166 | las.en.wtf | 7 |
143.244.169.230 | - | 7 |
185.220.101.1 | - | 7 |
62.210.37.82 | 62-210-37-82.rev.poneytelecom.eu | 7 |
222.186.42.213 | - | 7 |
222.186.42.137 | - | 7 |
167.172.33.233 | - | 7 |
222.186.42.13 | - | 7 |
221.181.185.220 | - | 7 |
209.141.45.85 | dzvirus | 7 |
209.141.53.250 | modernsubject.com | 7 |
222.186.180.130 | - | 7 |
179.43.175.125 | - | 7 |
66.230.230.230 | - | 7 |
176.10.99.200 | accessnow.org | 7 |
157.245.75.19 | - | 7 |
209.141.46.134 | - | 7 |
222.187.238.136 | - | 7 |
213.202.216.189 | h176.helix.dedi.server-hosting.expert | 7 |
85.95.191.186 | 85-95-191-186.saransk.ru | 7 |
221.131.165.56 | - | 7 |
222.168.30.19 | - | 7 |
222.186.30.76 | - | 7 |
142.93.78.168 | - | 7 |
174.138.10.171 | - | 7 |
188.166.7.249 | - | 7 |
222.102.232.146 | - | 7 |
209.141.46.72 | ms25.cimtk.com | 7 |
198.98.51.189 | tor.teitel.net | 7 |
221.181.185.135 | - | 7 |
80.67.172.162 | algrothendieck.nos-oignons.net | 7 |