stamparm/ipsum

About

IPsum is a threat intelligence feed based on 30+ different publicly available lists of suspicious and/or malicious IP addresses. All lists are automatically retrieved and parsed on a daily (every 24 hours) basis and the final result is pushed to this repository. The feed contains IP addresses plus an occurrence count (how many source lists each IP appears on). Higher counts generally mean higher confidence and fewer false positives when blocking inbound traffic. Also, list is sorted by occurrence count (highest to lowest).

As an example, to get a fresh and ready-to-deploy auto-ban list of "bad IPs" that appear on at least 3 (black)lists you can run:

curl -fsSL https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt 2>/dev/null | grep -v "^#" | grep -Ev '[[:space:]]([12])$' | cut -f 1

If you want to try it with ipset, you can do the following:

sudo -i
apt-get update && apt-get install -y iptables ipset
ipset -q flush ipsum
ipset -q create ipsum hash:ip
for ip in $(curl https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt 2>/dev/null | grep -v "#" | grep -Ev '[[:space:]]([12])$' | cut -f 1); do ipset add ipsum $ip; done
iptables -D INPUT -m set --match-set ipsum src -j DROP 2>/dev/null
iptables -I INPUT -m set --match-set ipsum src -j DROP

In directory levels you can find preprocessed raw IP lists based on number of blacklist occurrences (e.g. levels/3.txt holds IP addresses that can be found on 3 or more blacklists).

Wall of Shame (2026-07-20)

IP	DNS lookup	Number of (black)lists
77.90.185.20	-	11
195.178.110.137	-	11
159.65.143.47	-	9
185.65.202.199	-	9
2.57.121.25	hosting25.tronicsat.com	8
2.57.121.112	dns112.personaliseplus.com	8
31.58.244.121	Riosting.com	8
34.180.98.208	208.98.180.34.bc.googleusercontent.com	8
43.153.206.227	-	8
45.148.10.147	-	8
45.156.87.165	-	8
45.227.254.170	-	8
62.60.130.219	-	8
66.132.224.233	233.224.132.66.censys-scanner.com	8
71.6.146.185	pirate.census.shodan.io	8
71.6.165.200	census12.shodan.io	8
71.6.199.23	einstein.census.shodan.io	8
80.82.77.139	dojo.census.shodan.io	8
93.174.95.106	battery.census.shodan.io	8
94.154.43.50	-	8
107.189.10.124	gwlu.technofaq.org	8
120.236.49.131	-	8
144.31.156.249	-	8
167.94.146.51	51.146.94.167.censys-scanner.com	8
167.94.146.53	53.146.94.167.censys-scanner.com	8
167.94.146.59	59.146.94.167.censys-scanner.com	8
167.94.146.60	60.146.94.167.censys-scanner.com	8
171.243.150.226	dynamic-ip-adsl.viettel.vn	8
176.53.159.197	-	8
185.242.3.195	-	8
216.57.110.81	-	8
220.80.223.144	-	8
1.212.225.99	-	7
2.26.0.248	-	7
2.57.122.209	-	7
2.57.122.238	-	7
3.129.187.38	scan.visionheight.com	7
16.58.56.214	scan.visionheight.com	7
27.155.92.28	-	7
34.143.143.187	187.143.143.34.bc.googleusercontent.com	7
37.120.213.13	-	7
43.128.122.242	-	7
45.84.107.172	exit-08.tor.r0cket.net	7
45.91.64.7	scan.f6.security	7
45.148.10.141	-	7
45.148.10.151	-	7
45.148.10.152	-	7
45.148.10.157	-	7
45.148.10.240	-	7
51.159.30.56	51-159-30-56.rev.poneytelecom.eu	7
59.15.64.97	-	7
61.19.69.203	-	7
62.133.60.31	39628.ip-ptr.tech	7
64.226.126.224	-	7
65.49.1.182	-	7
66.132.172.45	45.172.132.66.censys-scanner.com	7
66.132.172.134	134.172.132.66.censys-scanner.com	7
66.132.172.137	137.172.132.66.censys-scanner.com	7
66.132.172.186	186.172.132.66.censys-scanner.com	7
66.132.172.190	190.172.132.66.censys-scanner.com	7
66.132.186.173	173.186.132.66.censys-scanner.com	7
66.132.186.186	186.186.132.66.censys-scanner.com	7
66.132.186.190	190.186.132.66.censys-scanner.com	7
66.132.186.192	192.186.132.66.censys-scanner.com	7
66.132.195.92	92.195.132.66.censys-scanner.com	7
66.132.195.94	94.195.132.66.censys-scanner.com	7
66.132.195.101	101.195.132.66.censys-scanner.com	7
66.132.224.84	84.224.132.66.censys-scanner.com	7
66.132.224.85	85.224.132.66.censys-scanner.com	7
66.132.224.86	86.224.132.66.censys-scanner.com	7
66.132.224.223	223.224.132.66.censys-scanner.com	7
66.132.224.228	228.224.132.66.censys-scanner.com	7
68.66.251.43	server.kidsairline.co	7
79.72.57.232	-	7
80.225.238.77	-	7
83.97.78.224	-	7
87.251.66.118	159723.ip-ptr.tech	7
89.126.211.166	-	7
89.248.172.11	no-reverse-dns-configured.com	7
92.118.39.50	-	7
92.118.39.77	-	7
94.102.49.193	cloud.census.shodan.io	7
94.154.43.77	-	7
95.47.246.223	-	7
95.79.108.51	dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru	7
101.36.104.242	-	7
102.220.160.41	-	7
103.167.88.166	-	7
103.251.143.14	-	7
109.105.210.65	zl-dfwc-us-gp1-wk108d.internet-census.org	7
110.35.80.116	IP-80-116.napinfo.net	7
118.26.111.107	-	7
121.178.185.141	-	7
130.12.182.110	-	7
143.198.115.76	portscanner-nyc1-03.prod.cyberresilience.io	7
148.66.142.9	9.142.66.148.host.secureserver.net	7
152.32.174.171	-	7
159.224.132.77	77.132.224.159.triolan.net	7
167.94.146.49	49.146.94.167.censys-scanner.com	7
167.94.146.55	55.146.94.167.censys-scanner.com	7
167.94.146.56	56.146.94.167.censys-scanner.com	7
167.94.146.57	57.146.94.167.censys-scanner.com	7
167.94.146.61	61.146.94.167.censys-scanner.com	7
176.53.159.198	-	7
185.70.109.79	-	7
193.24.211.76	-	7
193.46.255.86	-	7
195.161.62.64	-	7
195.178.110.228	-	7
195.222.57.183	-	7
198.235.24.184	-	7
199.45.154.113	113.154.45.199.censys-scanner.com	7
199.45.154.137	137.154.45.199.censys-scanner.com	7
199.45.154.147	147.154.45.199.censys-scanner.com	7
199.45.155.67	67.155.45.199.censys-scanner.com	7
199.45.155.91	91.155.45.199.censys-scanner.com	7
199.45.155.95	95.155.45.199.censys-scanner.com	7
199.45.155.100	100.155.45.199.censys-scanner.com	7
199.45.155.106	106.155.45.199.censys-scanner.com	7
203.55.81.2	-	7
222.134.147.66	-	7