ipsum

About

IPsum is a threat intelligence feed based on 30+ different publicly available lists of suspicious and/or malicious IP addresses. All lists are automatically retrieved and parsed on a daily (every 24 hours) basis and the final result is pushed to this repository. The feed contains IP addresses plus an occurrence count (how many source lists each IP appears on). Higher counts generally mean higher confidence and fewer false positives when blocking inbound traffic. Also, list is sorted by occurrence count (highest to lowest).

As an example, to get a fresh and ready-to-deploy auto-ban list of "bad IPs" that appear on at least 3 (black)lists you can run:

curl -fsSL https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt 2>/dev/null | grep -v "^#" | grep -Ev '[[:space:]]([12])$' | cut -f 1

If you want to try it with ipset, you can do the following:

sudo -i
apt-get update && apt-get install -y iptables ipset
ipset -q flush ipsum
ipset -q create ipsum hash:ip
for ip in $(curl https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt 2>/dev/null | grep -v "#" | grep -Ev '[[:space:]]([12])$' | cut -f 1); do ipset add ipsum $ip; done
iptables -D INPUT -m set --match-set ipsum src -j DROP 2>/dev/null
iptables -I INPUT -m set --match-set ipsum src -j DROP

In directory levels you can find preprocessed raw IP lists based on number of blacklist occurrences (e.g. levels/3.txt holds IP addresses that can be found on 3 or more blacklists).

Wall of Shame (2026-04-07)

IP	DNS lookup	Number of (black)lists
81.177.213.181	srv1.nononoasasddadno.com	10
159.223.73.209	-	10
80.66.66.70	-	9
165.154.227.162	-	9
213.209.159.158	-	9
2.27.46.115	vm961697.hosted-by.u1host.com	8
2.27.53.96	-	8
2.57.121.50	smtp50.kcmoa.com	8
2.57.121.86	mta86.soniideas.com	8
2.57.122.195	-	8
2.57.122.196	-	8
2.57.122.238	-	8
23.94.213.157	23-94-213-157-host.colocrossing.com	8
45.148.10.121	-	8
87.106.176.11	ip87-106-176-11.pbiaas.com	8
93.174.95.106	battery.census.shodan.io	8
163.7.9.54	-	8
167.94.146.49	49.146.94.167.censys-scanner.com	8
167.94.146.50	50.146.94.167.censys-scanner.com	8
167.94.146.57	57.146.94.167.censys-scanner.com	8
167.94.146.58	58.146.94.167.censys-scanner.com	8
178.104.133.1	static.1.133.104.178.clients.your-server.de	8
182.253.79.195	-	8
185.91.69.217	-	8
185.214.74.251	175562.ip-ptr.tech	8
197.5.145.8	-	8
199.45.155.92	92.155.45.199.censys-scanner.com	8
201.76.120.30	30.120.76.201.in-addr.arpa.verointernet.com.br	8
213.209.159.159	-	8
2.57.121.25	hosting25.tronicsat.com	7
2.57.121.112	dns112.personaliseplus.com	7
2.57.121.118	dns118.personaliseplus.com	7
2.57.122.189	-	7
2.57.122.194	-	7
2.57.122.199	-	7
5.101.64.6	scan.f6.security	7
14.63.196.175	-	7
14.63.217.28	-	7
18.116.101.220	scan.visionheight.com	7
20.64.105.74	azpdsgh2a9a3.stretchoid.com	7
27.79.5.224	localhost	7
27.111.32.174	-	7
34.175.118.185	185.118.175.34.bc.googleusercontent.com	7
35.222.117.243	243.117.222.35.bc.googleusercontent.com	7
36.255.3.203	-	7
37.120.213.13	-	7
41.59.86.232	232.86-59-41.static-zone.ttcldata.net	7
41.216.178.119	-	7
41.220.3.101	-	7
43.157.209.93	-	7
43.160.233.150	-	7
45.15.225.120	-	7
45.79.115.59	45-79-115-59.ip.linodeusercontent.com	7
45.91.64.6	scan.f6.security	7
45.91.64.7	scan.f6.security	7
45.148.10.141	-	7
45.148.10.151	-	7
45.148.10.157	-	7
45.207.199.93	-	7
45.227.254.170	-	7
47.180.114.229	47-180-114-229.944e76fe48.ip.frontiernet.net	7
50.99.170.152	d50-99-170-152.abhsia.telus.net	7
51.158.120.121	121-120-158-51.instances.scw.cloud	7
58.49.113.138	www.safecleen.com	7
66.132.172.138	138.172.132.66.censys-scanner.com	7
66.132.172.185	185.172.132.66.censys-scanner.com	7
66.132.224.223	223.224.132.66.censys-scanner.com	7
66.132.224.235	235.224.132.66.censys-scanner.com	7
66.240.192.138	census8.shodan.io	7
68.183.236.1	-	7
71.6.134.231	-	7
71.6.135.131	soda.census.shodan.io	7
71.6.199.23	einstein.census.shodan.io	7
79.3.96.178	host-79-3-96-178.business.telecomitalia.it	7
80.82.77.139	dojo.census.shodan.io	7
80.94.92.171	-	7
80.94.95.216	-	7
81.192.46.45	adsl-45-46-192-81.adsl.iam.net.ma	7
81.211.72.167	-	7
82.24.64.32	-	7
86.54.31.32	hat.census.shodan.io	7
87.103.126.54	54.126.103.87.rev.vodafone.pt	7
87.251.64.141	-	7
87.251.64.145	-	7
87.251.64.147	-	7
92.118.39.72	-	7
92.118.39.76	-	7
92.118.39.95	-	7
101.47.13.68	-	7
101.47.158.137	-	7
102.88.137.213	-	7
103.82.37.34	103.82.37.34.cloudfly.vn	7
103.171.85.124	103-171-85-124.cloud.leaseweb.net	7
103.183.74.214	ip103-183-74-214.cloudhost.web.id	7
103.211.217.182	103-211-217-182.webhostbox.net	7
115.191.32.57	-	7
115.241.83.2	-	7
117.50.51.119	-	7
118.37.92.184	-	7
118.194.234.8	-	7
121.165.204.105	-	7
125.20.210.182	-	7
129.159.149.21	-	7
136.228.161.66	-	7
138.197.107.71	-	7
147.182.194.60	-	7
152.52.15.213	-	7
163.7.1.156	-	7
163.7.8.88	-	7
163.7.8.90	-	7
163.7.9.84	-	7
165.154.6.34	-	7
165.154.205.128	-	7
165.232.137.75	-	7
165.245.211.56	-	7
167.94.146.59	59.146.94.167.censys-scanner.com	7
167.172.182.146	-	7
168.167.228.74	-	7
170.238.160.191	-	7
175.107.32.186	-	7
175.200.104.40	-	7
178.130.46.2	175197.ip-ptr.tech	7
179.124.29.29	-	7
180.76.202.69	-	7
182.23.36.166	-	7
182.93.50.90	n18293z50l90.static.ctmip.net	7
183.98.76.106	-	7
185.177.72.23	-	7
185.196.10.248	-	7
185.246.130.20	-	7
186.96.151.198	fixed-186-96-151-198.totalplay.net	7
187.210.77.100	customer-187-210-77-100.uninet-ide.com.mx	7
188.245.99.223	static.223.99.245.188.clients.your-server.de	7
193.46.255.86	hostingmailto239.statics.servermail.org	7
197.5.145.102	-	7
197.227.8.186	-	7
199.45.154.158	158.154.45.199.censys-scanner.com	7
199.45.155.64	64.155.45.199.censys-scanner.com	7
199.45.155.81	81.155.45.199.censys-scanner.com	7
199.45.155.82	82.155.45.199.censys-scanner.com	7
199.45.155.90	90.155.45.199.censys-scanner.com	7
199.45.155.96	96.155.45.199.censys-scanner.com	7
199.45.155.105	105.155.45.199.censys-scanner.com	7
199.45.155.107	107.155.45.199.censys-scanner.com	7
200.69.236.207	seldon.tecnologica.com.ar	7
203.221.12.133	203-221-12-133.tpgi.com.au	7
206.189.35.70	-	7
209.97.161.72	-	7
210.92.144.218	-	7
211.20.14.156	211-20-14-156.hinet-ip.hinet.net	7
213.232.204.83	-	7
216.57.110.81	-	7
216.108.236.45	lasvegas-nv-datacenter.serverpoint.com	7
219.78.63.235	n219078063235.netvigator.com	7
220.80.223.144	-	7
220.247.224.226	-	7
221.156.126.1	-	7
222.107.156.227	-	7