About

IPsum is a threat intelligence feed based on 30+ different publicly available lists of suspicious and/or malicious IP addresses. All lists are automatically retrieved and parsed on a daily (24h) basis and the final result is pushed to this repository. List is made of IP addresses together with a total number of (black)list occurrence (for each). Greater the number, lesser the chance of false positive detection and/or dropping in (inbound) monitored traffic. Also, list is sorted from most (problematic) to least occurent IP addresses.

As an example, to get a fresh and ready-to-deploy auto-ban list of "bad IPs" that appear on at least 3 (black)lists you can run:

curl --compressed https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt 2>/dev/null | grep -v "#" | grep -v -E "\s[1-2]$" | cut -f 1

If you want to try it with

ipset

sudo su
apt -qq install iptables ipset
ipset -q flush ipsum
ipset -q create ipsum hash:net
for ip in $(curl --compressed https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt 2>/dev/null | grep -v "#" | grep -v -E "\s[1-2]$" | cut -f 1); do ipset add ipsum $ip; done
iptables -I INPUT -m set --match-set ipsum src -j DROP

In directory levels you can find preprocessed raw IP lists based on number of blacklist occurrences (e.g. levels/3.txt holds IP addresses that can be found on 3 or more blacklists).

Wall of Shame (2021-12-04)

|IP|DNS lookup|Number of (black)lists| |---|---|--:| 185.220.102.244|185-220-102-244.torservers.net|11 185.31.175.220|florentius-tor-exit-relays.florentius.net|10 205.185.122.230|server.jcolideles.com|10 171.25.193.78|tor-exit4-readme.dfri.se|10 185.220.101.1|berlin01.tor-exit.artikel10.org|10 45.88.137.253|-|10 212.192.241.37|-|10 141.98.10.246|while-alerte.flightcrown.com|10 171.25.193.20|tor-exit0-readme.dfri.se|10 80.67.172.162|algrothendieck.nos-oignons.net|10 185.31.175.215|florentius-tor-exit-relays.florentius.net|10 163.172.213.212|trenecito.noconname.org|10 185.31.175.226|florentius-tor-exit-relays.florentius.net|9 23.183.81.249|-|9 89.234.157.254|marylou.nos-oignons.net|9 176.111.173.237|-|9 162.247.74.74|wiebe.tor-exit.calyxinstitute.org|9 141.98.10.63|-|9 5.2.69.50|-|9 171.25.193.77|tor-exit1-readme.dfri.se|9 185.220.101.4|berlin01.tor-exit.artikel10.org|9 23.183.81.136|-|9 178.20.55.18|marcuse-2.nos-oignons.net|9 81.17.18.61|block1-che.interlayer.co.uk|9 212.192.241.124|-|9 185.220.100.254|tor-exit-3.zbau.f3netze.de|9 89.163.249.244|srv1264.dedicated.server-hosting.expert|9 185.31.175.252|florentius-tor-exit-relays.florentius.net|9 199.249.230.119|tor3.quintex.com|9 222.187.238.58|-|9 205.185.120.71|-|9 116.105.217.54|-|9 221.131.165.33|-|9 171.25.193.25|tor-exit5-readme.dfri.se|9 185.100.86.74|-|9 221.131.165.75|-|9 185.38.175.132|-|9 213.202.216.189|h176.helix.dedi.server-hosting.expert|9 2.56.59.114|-|9 185.220.102.253|tor-exit-relay-7.anonymizing-proxy.digitalcourage.de|9 45.13.104.179|nosoignons.cust.milkywan.net|9 116.110.252.176|-|9 221.131.165.50|-|9 209.141.32.141|smtp9.dfsfasfasf.xyz|9 185.100.87.129|-|9 23.183.81.54|-|9 209.141.47.245|-|9 185.31.175.247|florentius-tor-exit-relays.florentius.net|9 23.183.82.180|-|9 221.181.185.111|-|9 209.141.62.185|-|9 37.123.163.58|h-37-123-163-58.a785.priv.bahnhof.se|9 167.172.43.16|-|9 209.141.53.74|-|9 89.163.252.230|ca262.calcit.dedicated.server-hosting.expert|8 80.82.77.33|sky.census.shodan.io|8 136.144.41.139|-|8 185.117.215.9|tor3.digineo.de|8 205.185.115.39|mx.learnmorefun.org|8 209.141.41.46|club8.yt663.club|8 185.107.47.215|tor-exit.r1.ci.ax|8 185.220.102.246|185-220-102-246.torservers.net|8 185.220.102.243|185-220-102-243.torservers.net|8 185.220.102.248|tor-exit-relay-2.anonymizing-proxy.digitalcourage.de|8 104.248.85.104|-|8 167.99.223.124|-|8 205.185.114.149|-|8 136.144.41.3|-|8 205.185.125.72|-|8 185.107.47.171|tor-exit.r2.ci.ax|8 137.184.49.249|-|8 23.129.64.210|-|8 18.27.197.252|wholesomeserver.media.mit.edu|8 212.192.241.95|-|8 134.209.205.40|-|8 23.183.81.116|-|8 165.22.195.82|-|8 178.20.55.16|marcuse-1.nos-oignons.net|8 5.199.143.202|ca235.calcit.dedicated.server-hosting.expert|8 162.247.72.199|-|8 5.2.73.229|-|8 209.141.48.248|las.e4ward.com|8 209.141.33.193|mx.chinadomainregistry.org|8 45.153.160.129|-|8 185.220.100.253|tor-exit-2.zbau.f3netze.de|8 185.220.100.252|tor-exit-1.zbau.f3netze.de|8 185.220.100.255|tor-exit-4.zbau.f3netze.de|8 94.230.208.147|tor3e1.digitale-gesellschaft.ch|8 185.220.102.4|communityexit.torservers.net|8 185.130.44.108|tor-exit-se1.privex.cc|8 45.153.160.140|-|8 209.141.34.220|meshlv02.oxds.org|8 185.31.175.213|florentius-tor-exit-relays.florentius.net|8 89.163.243.88|ca011.calcit.dedicated.server-hosting.expert|8 23.183.82.135|-|8 185.31.175.235|florentius-tor-exit-relays.florentius.net|8 185.31.175.231|florentius-tor-exit-relays.florentius.net|8 23.183.82.117|-|8 162.247.74.217|perry.fellwock.tor-exit.calyxinstitute.org|8 195.133.18.24|slot0.epaperitaliait.com|8 209.141.33.121|-|8 185.220.102.254|tor-exit-relay-8.anonymizing-proxy.digitalcourage.de|8 185.220.102.251|tor-exit-relay-5.anonymizing-proxy.digitalcourage.de|8 185.220.102.250|tor-exit-relay-4.anonymizing-proxy.digitalcourage.de|8 64.113.32.29|tor.t-3.net|8 23.154.177.2|-|8 89.163.154.91|srv1258.dedicated.server-hosting.expert|8 185.56.80.65|onion.xor.sc|8 62.102.148.68|-|8 104.244.76.13|tor-exit-node.spongebob.nicdex.com|8 185.220.101.61|tor-exit-61.for-privacy.net|8 185.31.175.207|florentius-tor-exit-relays.florentius.net|8 185.31.175.188|florentius-tor-exit-relays.florentius.net|8 176.10.99.200|accessnow.org|8 137.184.49.88|-|8 185.220.102.245|185-220-102-245.torservers.net|8 45.153.160.133|-|8 45.153.160.132|-|8 45.153.160.131|-|8 45.153.160.130|-|8 45.153.160.136|-|8 45.153.160.138|-|8 185.220.100.242|tor-exit-15.zbau.f3netze.de|8 81.17.18.59|block1-che.interlayer.co.uk|8 45.88.137.100|-|8 185.31.175.240|florentius-tor-exit-relays.florentius.net|8 116.110.156.69|-|8 23.183.81.227|-|8 162.247.73.192|mario-louis-sylvester-lap.tor-exit.calyxinstitute.org|8 209.141.44.236|-|8 134.209.95.47|-|8 198.98.51.189|tor.teitel.net|8 221.10.33.104|-|8 107.189.10.137|exitrelay21.medvideos-tor.org|7 185.31.175.228|florentius-tor-exit-relays.florentius.net|7 20.206.86.43|-|7 128.31.0.13|tor-exit.csail.mit.edu|7 209.14.131.233|209-14-131-233.as270353.com.br|7 162.247.74.202|djb.tor-exit.calyxinstitute.org|7 162.247.74.200|kiriakou.tor-exit.calyxinstitute.org|7 162.247.74.206|rosaluxemburg.tor-exit.calyxinstitute.org|7 162.247.74.204|billsf.tor-exit.calyxinstitute.org|7 134.209.198.229|-|7 58.222.83.94|-|7 5.183.209.217|-|7 71.6.199.23|einstein.census.shodan.io|7 222.186.30.112|-|7 23.129.64.130|-|7 89.163.249.192|srv1116.dedicated.server-hosting.expert|7 60.171.208.199|-|7 161.35.153.169|-|7 161.35.153.160|-|7 45.144.225.119|-|7 185.220.102.247|185-220-102-247.torservers.net|7 185.220.102.240|185-220-102-240.torservers.net|7 185.220.102.242|185-220-102-242.torservers.net|7 185.220.102.249|tor-exit-relay-3.anonymizing-proxy.digitalcourage.de|7 69.49.244.54|69-49-244-54.unifiedlayer.com|7 185.100.87.41|-|7 23.236.146.162|-|7 211.22.65.18|211-22-65-18.hinet-ip.hinet.net|7 141.98.10.60|-|7 221.131.165.62|-|7 221.131.165.65|-|7 38.91.102.84|84-102-91-38.clients.gthost.com|7 107.189.10.237|tor-exit-readme.donpablo.me|7 164.92.242.66|-|7 45.148.10.235|edc37.app-autht.com|7 23.129.64.219|-|7 23.129.64.213|-|7 23.129.64.217|-|7 45.153.160.2|-|7 45.154.255.147|cust-147.keff.org|7 185.220.101.46|tor-exit-46.for-privacy.net|7 80.82.77.139|dojo.census.shodan.io|7 221.181.185.94|-|7 185.31.175.191|florentius-tor-exit-relays.florentius.net|7 81.17.18.62|block1-che.interlayer.co.uk|7 185.42.170.203|exit01.tor.anduin.net|7 104.244.78.183|luxembourgtor34.lu|7 222.186.42.137|-|7 116.110.96.81|-|7 192.160.102.170|ogopogo.relay.coldhak.com|7 195.254.135.76|-|7 91.219.237.21|178911033-dedicated.serverastra.com|7 209.141.58.95|mta4.gxnsmtp.xyz|7 185.90.136.69|ksort-fi41-sort.betmam.com|7 94.230.208.148|tor3e3.digitale-gesellschaft.ch|7 162.247.74.213|snowden.tor-exit.calyxinstitute.org|7 185.165.168.229|-|7 192.42.116.16|tor-exit.hartvoorinternetvrijheid.nl|7 192.42.116.15|this-is-a-tor-exit-node-hviv115.hviv.nl|7 166.70.207.2|this.is.a.tor.node.xmission.com|7 185.220.102.8|185-220-102-8.torservers.net|7 23.129.64.216|-|7 5.8.10.202|-|7 38.91.102.38|-|7 93.123.93.104|mail.motolife.bg|7 137.184.51.62|-|7 172.106.16.74|unassigned.psychz.net|7 185.220.101.137|tor-exit-137.relayon.org|7 179.43.147.67|mail.alliancestratamanagement.com|7 107.189.5.248|luxembourg12tor.org|7 93.174.95.106|battery.census.shodan.io|7 222.186.180.130|-|7 94.232.46.202|-|7 185.220.103.8|mariellefranco.tor-exit.calyxinstitute.org|7 38.91.102.77|77-102-91-38.clients.gthost.com|7 198.98.57.230|-|7 162.247.74.216|phoolandevi.tor-exit.calyxinstitute.org|7 178.73.215.171|178-73-215-171-static.glesys.net|7 222.186.42.7|-|7 222.187.254.41|-|7 188.166.60.8|-|7 167.71.10.210|-|7 185.233.100.23|elenagb.nos-oignons.net|7 161.35.153.152|-|7 20.206.109.196|-|7 104.244.73.169|luxembourgtor21.lu|7 185.67.82.114|tor-ou.effi.org|7 104.244.73.205|luxembourgtor5.lu|7 221.131.165.56|-|7 199.195.250.77|ny1.exit.tor.alkyl.eu.org|7 92.255.85.237|-|7 107.189.30.23|luxembourgtor13.lu|7 222.186.30.76|-|7 164.92.250.114|-|7 179.43.187.37|-|7 72.167.48.55|ip-72-167-48-55.ip.secureserver.net|7 185.220.101.190|tor-exit-190.relayon.org|7 104.244.72.120|luxembourgtor28.lu|7 62.102.148.69|-|7 221.181.185.151|-|7 221.181.185.159|-|7 199.195.254.81|newyorktor1.uk|7 185.129.61.1|tor-project-exit1.dotsrc.org|7 185.129.61.4|tor-project-exit4.dotsrc.org|7 167.99.39.128|-|7 209.141.55.26|tor-exit|7 92.255.85.37|-|7 94.142.244.16|tor-exit.vrij-heid.nl|7 45.153.160.137|-|7 45.153.160.135|-|7 45.153.160.134|-|7 45.153.160.139|-|7 185.220.100.243|tor-exit-16.zbau.f3netze.de|7 185.220.100.240|tor-exit-13.zbau.f3netze.de|7 185.165.190.34|red.census.shodan.io|7 209.127.17.234|-|7 222.186.42.13|-|7 222.187.232.39|-|7 104.244.77.80|luxembourgtor45.lu|7 164.90.206.120|-|7 209.141.52.25|jsebean.com|7 209.141.62.233|hhb8.cn|7 109.227.63.3|srv-109-227-63-3.static.a1.hr|7 185.220.100.245|tor-exit-6.zbau.f3netze.de|7 107.189.28.84|luxembourgtor49.lu|7 185.220.102.252|tor-exit-relay-6.anonymizing-proxy.digitalcourage.de|7 94.153.161.234|94-153-161-234.ip.kyivstar.net|7 107.189.30.134|smtp4.achtungumbedingt.de|7 212.192.246.95|programssearch.earacheevince.com|7