Data Sources
Open dataset
System Health and Status
Data Sources
IP Threat Intelligence Feeds
Our IP pool refreshes automatically every 30 minutes from the following open, redistribution-licensed threat-intelligence sources.
- 44 of 44 sources fetched cleanly on the last run.
- Lists published by the same operator count as a single vote in the score.
Active sources44
Entries in pool352,693
Threat categories16
Last refresh
2026-11-09 23:19
Attack Source
165,634 entries| Source | Entries | Fetched | License |
|---|---|---|---|
| Data-Shield IPv4 Blocklist Independent observation | 108,668 | 2026-11-09 23:19 | Data-Shield IPv4 Blocklist — GPL-3.0 (redistribution only under GPL) |
| Blocklist.de (all) Independent observation | 23,874 | 2026-11-09 23:17 | blocklist.de — free for use |
| IP-DB Sensor Network Independent observation | 10,760 | 2026-11-09 23:19 | IP-DB Sensor Network — our own honeypot observations, CC BY-SA 4.0 |
| CZ.NIC Turris Sentinel Greylist Independent observation | 9,449 | 2026-11-09 23:17 | CZ.NIC Turris Sentinel Greylist — CC BY-NC-SA 4.0; commercial offerings via info@turris.cz |
| ShadowWhisperer Threats Independent observation | 7,380 | 2026-11-09 23:19 | ShadowWhisperer/IPs — Unlicense (public domain) |
| GreenSnow Independent observation | 2,737 | 2026-11-09 23:17 | GreenSnow — all rights reserved, 'reproduction or republication strictly prohibited' |
| GPF Comics DNSBL Independent observation | 996 | 2026-11-09 23:17 | GPF Comics via iplists.firehol.org — 'IP lists are a property of their maintainers' |
| Blocklist.de SIP / VoIP Independent observation | 898 | 2026-11-09 23:19 | blocklist.de — free for use |
| Blocklist.de Brute-Force Login Independent observation | 811 | 2026-11-09 23:19 | blocklist.de — free for use |
| Blocklist.de FTP Independent observation | 41 | 2026-11-09 23:19 | blocklist.de — free for use |
| SANS ISC DShield Block List Independent observation | 20 | 2026-11-09 23:17 | SANS ISC DShield — site data CC BY-NC-SA 4.0 (non-commercial, no redistribution here) |
Malicious Activity
75,677 entries| Source | Entries | Fetched | License |
|---|---|---|---|
| Malicious IP (romainmarcoux) Aggregator | 40,000 | 2026-11-09 23:18 | romainmarcoux/malicious-ip — MIT licence |
| CINS Army List Independent observation | 15,000 | 2026-11-09 23:17 | CI Army — 'use in any way you see fit' for firewalls; no explicit redistribution grant |
| ThreatView High Confidence Independent observation | 14,767 | 2026-11-09 23:17 | ThreatView.io — free community feed, no stated licence (best-effort) |
| TweetFeed (infosec community IOCs) Independent observation | 2,204 | 2026-11-09 23:19 | 0xDanielLopez/TweetFeed — CC0 1.0 (public domain) |
| Binary Defense Banlist Independent observation | 1,920 | 2026-11-09 23:17 | Binary Defense ATIF — 'public use only', no commercial resale or use in paid products |
| Emerging Threats Block IPs Independent observation | 1,786 | 2026-11-09 23:17 | Proofpoint ET Open — free ruleset |
SSH Brute Force
21,208 entries| Source | Entries | Fetched | License |
|---|---|---|---|
| James Brine Brute-Force Hosts Independent observation | 14,479 | 2026-11-09 23:17 | jamesbrine.com.au — free honeypot feed, no stated licence |
| Blocklist.de SSH Independent observation | 4,347 | 2026-11-09 23:17 | blocklist.de — free for use |
| Rutgers University DROP Independent observation | 1,883 | 2026-11-09 23:17 | Rutgers University OIRT — free public attacker list, no stated licence |
| BruteForceBlocker Independent observation | 499 | 2026-11-09 23:17 | danger.rulez.sk BruteForceBlocker — free public list, no stated licence |
Mail Abuse
18,559 entries| Source | Entries | Fetched | License |
|---|---|---|---|
| Blocklist.de Mail Independent observation | 13,758 | 2026-11-09 23:17 | blocklist.de — free for use |
| Blocklist.de IMAP Independent observation | 4,801 | 2026-11-09 23:19 | blocklist.de — free for use |
Aggregated List (Medium Confidence)
16,329 entries| Source | Entries | Fetched | License |
|---|---|---|---|
| FireHOL Level 2 Aggregator | 16,329 | 2026-11-09 23:18 | FireHOL — composed of other maintainers' lists, each keeps its own terms |
Aggregated List (High Confidence)
13,554 entries| Source | Entries | Fetched | License |
|---|---|---|---|
| IPsum (4+ lists) Aggregator | 8,905 | 2026-11-09 23:18 | stamparm/ipsum — Unlicense (public domain), aggregated from 30+ public lists |
| FireHOL Level 1 Aggregator | 4,649 | 2026-11-09 23:18 | FireHOL — composed of other maintainers' lists, each keeps its own terms |
Aggregated List (Low Confidence)
12,714 entries| Source | Entries | Fetched | License |
|---|---|---|---|
| FireHOL Level 3 Aggregator | 12,714 | 2026-11-09 23:18 | FireHOL — composed of other maintainers' lists, each keeps its own terms |
Web Server Attack
10,447 entries| Source | Entries | Fetched | License |
|---|---|---|---|
| Blocklist.de Web/Apache Independent observation | 9,461 | 2026-11-09 23:17 | blocklist.de — free for use |
| FireHOL Web Server Attackers Aggregator | 986 | 2026-11-09 23:18 | FireHOL — composed of other maintainers' lists, each keeps its own terms |
Bot Activity
4,187 entries| Source | Entries | Fetched | License |
|---|---|---|---|
| Blocklist.de Bots Independent observation | 3,046 | 2026-11-09 23:17 | blocklist.de — free for use |
| MyIP.ms Blacklist Independent observation | 1,113 | 2026-11-09 23:17 | myip.ms — copyrighted list, no redistribution grant |
| BotScout Independent observation | 28 | 2026-11-09 23:17 | BotScout via iplists.firehol.org — 'IP lists are a property of their maintainers' |
Tor Exit Node
3,371 entries| Source | Entries | Fetched | License |
|---|---|---|---|
| Tor Exit Nodes (IPv6) Independent observation | 2,123 | 2026-11-09 23:17 | Mirror of the Tor Project exit list — CC0 data |
| Tor Exit Nodes Independent observation | 1,248 | 2026-11-09 23:17 | The Tor Project — CC0 (metrics.torproject.org) |
Bogon (Unallocated Space)
3,020 entries| Source | Entries | Fetched | License |
|---|---|---|---|
| Team Cymru Fullbogons (IPv4) Independent observation | 3,020 | 2026-11-09 23:18 | Team Cymru — free Bogon Reference, see team-cymru.com/bogon-reference |
Repeat Offender
2,370 entries| Source | Entries | Fetched | License |
|---|---|---|---|
| IPThreat Community Reports Independent observation | 2,074 | 2026-11-09 23:19 | IPThreat.net — CC BY-SA 4.0, commercial use allowed, attribution with link required |
| Blocklist.de Repeat Offenders Independent observation | 296 | 2026-11-09 23:17 | blocklist.de — free for use |
Hijacked Network
1,851 entries| Source | Entries | Fetched | License |
|---|---|---|---|
| Spamhaus DROP Independent observation | 1,761 | 2026-11-09 05:17 | Spamhaus DROP — free for use with credit; fetch at most once a day |
| Spamhaus DROPv6 Independent observation | 90 | 2026-11-09 05:17 | Spamhaus DROPv6 — free for use with credit; fetch at most once a day |
Open Proxy
1,697 entries| Source | Entries | Fetched | License |
|---|---|---|---|
| Open SOCKS Proxies Independent observation | 1,308 | 2026-11-09 23:17 | iplists.firehol.org proxy tracker — 'IP lists are a property of their maintainers' |
| Open SSL Proxies Independent observation | 389 | 2026-11-09 23:17 | iplists.firehol.org proxy tracker — 'IP lists are a property of their maintainers' |
Malware C2
1,564 entries| Source | Entries | Fetched | License |
|---|---|---|---|
| USOM (TR National CERT) Independent observation | 1,048 | 2026-11-09 23:19 | T.C. Siber Güvenlik Ba?kanl??? (USOM) address API, published for firewall/SIEM integration; 'önceden yaz?l? izin al?nmadan ve kaynak gösterilmeden ... yeniden yay?mlanamaz, da??t?lamaz' |
| CyberCrime Tracker Independent observation | 516 | 2026-11-09 23:17 | CyberCrime Tracker via iplists.firehol.org — 'IP lists are a property of their maintainers' |
Compromised Host
511 entries| Source | Entries | Fetched | License |
|---|---|---|---|
| Emerging Threats Compromised Hosts Independent observation | 511 | 2026-11-09 23:17 | Proofpoint ET Open — free ruleset |
Operator-Level List
454 ASNSpamhaus ASN-DROP names not individual addresses but 454 autonomous systems assessed as being run for abuse as a whole. This data is not part of the reputation score either; it appears as its own finding on IP and ASN pages.
Network Classification Datasets
76,613 RangesThese ranges are not part of the abuse pool and do not affect the reputation score — they only label what kind of network an address sits on.
| Dataset | Connection Type | Ranges | License |
|---|---|---|---|
| aws | Hosting / Datacenter | 11,477 | Amazon Web Services — published IP ranges |
| gcp | Hosting / Datacenter | 1,153 | Google Cloud — published IP ranges |
| oracle_cloud | Hosting / Datacenter | 1,118 | Oracle Cloud Infrastructure — published IP ranges |
| cloudflare_v4 | Hosting / Datacenter | 15 | Cloudflare — published IP ranges |
| cloudflare_v6 | Hosting / Datacenter | 7 | Cloudflare — published IP ranges |
| digitalocean | Hosting / Datacenter | 1,239 | DigitalOcean — published geofeed |
| linode | Hosting / Datacenter | 5,505 | Akamai/Linode — published geofeed |
| x4bnet_vpn_v4 | VPN / Proxy | 11,130 | X4BNet/lists_vpn — MIT licensed |
| x4bnet_datacenter_v4 | Hosting / Datacenter | 44,969 | X4BNet/lists_vpn — MIT licensed |