GitPedia

IPs

IP lists for malware, bots, scanners, etc.

From ShadowWhisperer·Updated June 23, 2026·View on GitHub·

> [!IMPORTANT] > **The `Lists/` folder is the only actively maintained section.** > `BruteForce/`, `Malware/`, `Other/` are legacy and no longer updated. Please update any hardcoded URLs to use `Lists/` instead. > > This project has grown from counting Cowrie logs to a custom honeypot stack and log analyzer. > Lists now include a .csv version with extended details. Terminology is now correct. > The project is distributed under the The Unlicense license, first published in 2021. Key topics include: blocklist, botnet, bruteforce, fail2ban, filter.

[!IMPORTANT]
The Lists/ folder is the only actively maintained section.
BruteForce/, Malware/, Other/ are legacy and no longer updated. Please update any hardcoded URLs to use Lists/ instead.

This project has grown from counting Cowrie logs to a custom honeypot stack and log analyzer.
Lists now include a .csv version with extended details. Terminology is now correct.


Threat feed collected from honeypots running across multiple locations.
This repo is updated hourly and compressed periodically to keep the size small. Diffs, pull requests, etc are cleared.


FileInfo
AdsServes advertisements
DNSCommon DNS resolvers
ProbesProbed, but not full connect (5+ time)
ScannersInternet scanning companies
ThreatsActive threats - exploit attempts, compromised systems, malware droppers, etc
Threats_UnclassifiedSeen, but not classified
TrackersUsed to track user activity
TunnelsProxies & VPNs

<a href="https://www.abuseipdb.com/user/51407" title="AbuseIPDB is an IP address blacklist for webmasters and sysadmins to report IP addresses engaging in abusive behavior on their networks"> <img src="https://www.abuseipdb.com/contributor/51407.svg" alt="AbuseIPDB Contributor Badge" style="width: 312px;"> </a>
This article is auto-generated from ShadowWhisperer/IPs via the GitHub API.Last fetched: 6/23/2026