IPs
IP lists for malware, bots, scanners, etc.
> [!IMPORTANT] > **The `Lists/` folder is the only actively maintained section.** > `BruteForce/`, `Malware/`, `Other/` are legacy and no longer updated. Please update any hardcoded URLs to use `Lists/` instead. > > This project has grown from counting Cowrie logs to a custom honeypot stack and log analyzer. > Lists now include a .csv version with extended details. Terminology is now correct. > The project is distributed under the The Unlicense license, first published in 2021. Key topics include: blocklist, botnet, bruteforce, fail2ban, filter.
[!IMPORTANT]
TheLists/folder is the only actively maintained section.
BruteForce/,Malware/,Other/are legacy and no longer updated. Please update any hardcoded URLs to useLists/instead.This project has grown from counting Cowrie logs to a custom honeypot stack and log analyzer.
Lists now include a .csv version with extended details. Terminology is now correct.
Threat feed collected from honeypots running across multiple locations.
This repo is updated hourly and compressed periodically to keep the size small. Diffs, pull requests, etc are cleared.
| File | Info |
|---|---|
| Ads | Serves advertisements |
| DNS | Common DNS resolvers |
| Probes | Probed, but not full connect (5+ time) |
| Scanners | Internet scanning companies |
| Threats | Active threats - exploit attempts, compromised systems, malware droppers, etc |
| Threats_Unclassified | Seen, but not classified |
| Trackers | Used to track user activity |
| Tunnels | Proxies & VPNs |
<a href="https://www.abuseipdb.com/user/51407" title="AbuseIPDB is an IP address blacklist for webmasters and sysadmins to report IP addresses engaging in abusive behavior on their networks"> <img src="https://www.abuseipdb.com/contributor/51407.svg" alt="AbuseIPDB Contributor Badge" style="width: 312px;"> </a>
