Need help with ipsum?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

692 Stars 96 Forks The Unlicense 1 Commits 2 Opened issues


Daily feed of bad IPs (with blacklist hit scores)

Services available


Need anything else?

Contributors list

# 245
1 commit




IPsum is a threat intelligence feed based on 30+ different publicly available lists of suspicious and/or malicious IP addresses. All lists are automatically retrieved and parsed on a daily (24h) basis and the final result is pushed to this repository. List is made of IP addresses together with a total number of (black)list occurrence (for each). Greater the number, lesser the chance of false positive detection and/or dropping in (inbound) monitored traffic. Also, list is sorted from most (problematic) to least occurent IP addresses.

As an example, to get a fresh and ready-to-deploy auto-ban list of "bad IPs" that appear on at least 3 (black)lists you can run:

curl --compressed 2>/dev/null | grep -v "#" | grep -v -E "\s[1-2]$" | cut -f 1

If you want to try it with

, you can do the following:
sudo su
apt -qq install iptables ipset
ipset -q flush ipsum
ipset -q create ipsum hash:net
for ip in $(curl --compressed 2>/dev/null | grep -v "#" | grep -v -E "\s[1-2]$" | cut -f 1); do ipset add ipsum $ip; done
iptables -I INPUT -m set --match-set ipsum src -j DROP

In directory levels you can find preprocessed raw IP lists based on number of blacklist occurrences (e.g. levels/3.txt holds IP addresses that can be found on 3 or more blacklists).

Wall of Shame (2021-12-04)

|IP|DNS lookup|Number of (black)lists| |---|---|--:|||11||10||10||10||10|-|10|-|10||10||10||10||10||10||9|-|9||9|-|9||9|-|9|-|9||9||9|-|9||9||9|-|9||9||9||9||9|-|9|-|9|-|9|-|9||9|-|9|-|9|-|9||9|-|9||9||9|-|9|-|9||9|-|9|-|9|-|9||9|-|9|-|9|-|9||9|-|9|-|9||8||8|-|8||8||8||8||8||8||8||8|-|8|-|8|-|8|-|8|-|8||8|-|8|-|8||8|-|8|-|8|-|8|-|8||8||8|-|8|-|8||8||8|-|8||8||8||8||8||8||8|-|8||8||8||8|-|8||8||8|-|8||8||8|-|8||8||8||8||8|-|8||8||8|-|8||8||8||8||8||8|-|8||8|-|8|-|8|-|8|-|8|-|8|-|8||8||8|-|8||8|-|8|-|8||8|-|8|-|8||8|-|8||7||7|-|7||7||7||7||7||7||7|-|7|-|7|-|7||7|-|7|-|7||7|-|7|-|7|-|7|-|7||7||7||7||7||7|-|7|-|7||7|-|7|-|7|-|7||7||7|-|7||7|-|7|-|7|-|7|-|7||7||7||7|-|7||7||7||7||7|-|7|-|7||7|-|7||7||7||7||7||7|-|7||7||7||7||7|-|7|-|7|-|7||7|-|7||7||7||7||7||7|-|7|-|7||7||7|-|7||7||7|-|7|-|7|-|7|-|7||7|-|7|-|7||7||7||7|-|7||7|-|7||7|-|7|-|7|-|7||7||7||7|-|7|-|7|-|7||7||7||7|-|7|tor-exit|7|-|7||7|-|7|-|7|-|7|-|7||7||7||7|-|7|-|7|-|7||7|-|7||7||7||7||7||7||7||7||7||7

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.