Reputation
IP reputation sources
34 malicious sources (267386 unique), 9 scanner sources (16917 unique).
Malicious IPs/ranges (unique)267386
Download (deduplicated, plain text)export.txt
SourceEntriesUpdated
AbuseIPDB — reported abusers, last 30 days1339952026-10-07 04:00
IPsum — aggregated threat intelligence from multiple sources1120662026-10-07 04:00
CleanTalk — spam/abuse network, last 30 days379192026-10-07 04:00
Blocklist.de — fail2ban-reported attackers (48h)175582026-10-07 04:00
Maltrail — network scanners168542026-10-07 04:00
CINS Army — poor-reputation hosts150002026-10-07 04:00
StopForumSpam — reported spammers, last 7 days126802026-10-07 04:00
Blocklist.de — mail/SMTP abuse reporters122632026-10-07 04:00
Blocklist.de — web server attack reporters83772026-10-07 04:00
Emerging Threats — Tor exit nodes69802026-10-07 04:00
dan.me.uk — Tor nodes67702026-10-07 04:00
GreenSnow — brute-force / scanning sources55912026-10-07 04:00
Blocklist.de — SSH brute-force reporters34762026-10-07 04:00
C2 Tracker — malware command-and-control servers24702026-10-07 04:00
BotScout — bot registration abuse, last 30 days24592026-10-07 04:00
Spamhaus DROP — hijacked / professional cybercrime netblocks15632026-10-07 04:00
Tor exit nodes13632026-10-07 04:00
Emerging Threats — known compromised hosts6212026-10-07 04:00
BruteForceBlocker — SSH brute-force attackers6022026-10-07 04:00
Blocklist.de — generic brute-force reporters4752026-10-07 04:00
Cybercrime-tracker.net — malware distribution/config hosts4732026-10-07 04:00
Spamhaus EDROP — extended DROP3362026-10-07 04:00
Open SOCKS proxies3022026-10-07 04:00
Open SSL/HTTPS proxies1022026-10-07 04:00
VXVault — malware distribution hosts682026-10-07 04:00
StopForumSpam — persistent toxic actors602026-10-07 04:00
PHP email-harvesting bots502026-10-07 04:00
PHP comment-spam bots492026-10-07 04:00
PHP dictionary/brute-force attackers492026-10-07 04:00
DShield — top attacking /24 networks202026-10-07 04:00
Bogon space — unallocated, should never appear in real traffic182026-10-07 04:00
CrowdSec — banned for HTTP abuse122026-10-07 23:30
CrowdSec — banned for SSH brute-force22026-10-07 23:30
Feodo Tracker — banking trojan C2 servers12026-10-07 04:00
KNOWN SCANNERS
Internet-wide research scanners (Censys, Shodan, and similar) — not malicious, but if you'd rather not be probed by them, this is who's doing it.
Scanner IPs/ranges (unique)16917
Download (deduplicated, plain text)scanners.txt
SourceEntriesUpdated
BinaryEdge — internet-wide research scanner81432026-10-07 04:00
Stretchoid — internet-wide research scanner50392026-10-07 04:00
Hunter.how — internet-wide research scanner35212026-10-07 04:00
LeakIX — internet-wide research scanner942026-10-07 04:00
Shodan — internet-wide research scanner762026-10-07 04:00
Censys — internet-wide research scanner162026-10-07 04:00
ZoomEye — internet-wide research scanner132026-10-07 04:00
Rapid7 (Project Sonar) — internet-wide research scanner92026-10-07 04:00
Onyphe — internet-wide research scanner62026-10-07 04:00