Explore all the warning lists in misp-warninglists. These lists identify indicators that may be known, benign, or potential false positives, such as public DNS resolvers, private networks, popular domains, and internet scanners.
Search by name or description and filter by match type or MISP attribute type. Each card includes the list version, entry count, matching attributes, examples, and links to the complete source and JSON definition. ALL means a list applies to every attribute type.
A match provides context for analysis; it does not establish that an indicator is harmless. This catalogue describes upstream lists. The lists enabled in your own MISP instance depend on its configuration.
227 warning lists · 6,455,671 entries across lists
quake-scanning
Published source ranges of the internet-wide scanning organisation 360 Quake (quake.360.net), as tracked by https://github.com/OpenFilters/internet-scanners
503 entries · version 20261014
First 5 entries
1.192.192.4/321.192.192.6/321.192.192.8/321.192.195.11/321.192.195.5/32a10networks-scanning
Published source ranges of the internet-wide scanning organisation A10 Networks (a10protects.com / a10networks.com), as tracked by https://github.com/OpenFilters/internet-scanners
658 entries · version 20261014
First 5 entries
103.29.68.220/32103.3.63.60/32104.200.21.21/32104.200.30.136/32104.200.30.247/32academyforinternetresearch-scanning
Published source ranges of the internet-wide scanning organisation Academy for Internet Research (academyforinternetresearch.org), as tracked by https://github.com/OpenFilters/internet-scanners
62 entries · version 20261014
First 5 entries
104.156.155.0/24104.237.151.205/32139.162.119.12/32139.162.119.146/32139.162.119.196/32adscore-scanning
Published source ranges of the internet-wide scanning organisation Adscore (adscore.com), as tracked by https://github.com/OpenFilters/internet-scanners
15 entries · version 20261014
First 5 entries
185.200.118.32/32185.200.118.34/31185.200.118.36/30185.200.118.40/29185.200.118.48/29alphastrike-scanning
List containing IP ranges associated with Alpha Strike Labs scanning infrastructure. Alpha Strike Labs GmbH (AS208843) operates legitimate security research and internet-wide scanning services [https://ipinfo.io/AS208843]
5 entries · version 20261014
First 5 entries
158.94.187.0/24158.94.218.0/24194.187.176.0/222a0e:7b84::/3045.83.64.0/22alphastrike-research-nt-scanning
List containing IP's associated with the Alphastrike research scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08
22 entries · version 26100813
First 5 entries
194.187.176.1/32194.187.176.128/25194.187.176.16/28194.187.176.2/31194.187.176.32/27binaryedge-scanning
Published source ranges of the internet-wide scanning organisation BinaryEdge (binaryedge.io / binaryedge.ninja), as tracked by https://github.com/OpenFilters/internet-scanners
12,972 entries · version 20261014
First 5 entries
100.20.118.33/32100.20.138.123/32100.20.153.121/32100.20.177.21/32100.20.181.236/32bitsight-scanning
Published source ranges of the internet-wide scanning organisation BitSight Technologies Inc. / Internet Census Group (bitsight.com / internet-census.org), as tracked by https://github.com/OpenFilters/internet-scanners
6 entries · version 20261014
First 5 entries
109.105.208.0/21185.117.225.0/24185.180.140.0/22185.226.196.0/222a10:3c0::/29bufferover-nt-scanning
List containing IP's associated with the Bufferover scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08
31 entries · version 26100813
First 5 entries
139.144.235.132/32139.144.239.72/32139.144.239.74/32162.216.18.113/32170.187.163.117/32bufferoverrun-scanning
Published source ranges of the internet-wide scanning organisation bufferover.run / erbbysam (bufferover.run), as tracked by https://github.com/OpenFilters/internet-scanners
48 entries · version 20261014
First 5 entries
139.144.235.132/32139.144.239.72/32139.144.239.74/32162.216.18.113/32170.187.163.117/32captive-portals
Hostnames used by different desktop and mobile device operating systems for captive portal detection as documented by the Wireless Broadband Alliance.
21 entries · version 20230130
First 5 entries
android.clients.google.comapple.comcaptive.apple.comclients3.google.comclients4.google.comcensys-scanning
List containing IP's associated with Censys scanning [https://support.censys.io/hc/en-us/articles/360043177092-Opt-Out-of-Data-Collection#Can_I_opt_out_of_Censys_data_collection?]
23 entries · version 20261014
First 5 entries
162.142.125.0/24167.248.133.0/24167.94.138.0/24167.94.145.0/24167.94.146.0/24circl-security-scanning
CIRCL IP address to conducting non-intrusive security scans on Luxembourg IP addresses
20 entries · version 26081402
First 5 entries
185.194.94.170185.194.94.171185.194.94.172185.194.94.173185.194.94.174circl-ssh-scanning
CIRCL IP address to conducting non-intrusive SSH scans
2 entries · version 26081402
First 2 entries
185.194.93.1302a00:5980:93::130umbrella-blockpage-hostname
Umbrella blockpage hostnames
5 entries · version 20260811
First 5 entries
hit-adult.opendns.comhit-block.opendns.comhit-botnet.opendns.comhit-malware.opendns.comhit-phish.opendns.comumbrella-blockpage-v4
Cisco Umbrella blockpage in IPv4
6 entries · version 20260811
First 5 entries
146.112.61.104146.112.61.105146.112.61.106146.112.61.107146.112.61.108umbrella-blockpage-v6
Cisco Umbrella blockpage in IPv6
6 entries · version 20260811
First 5 entries
::ffff:9270:3d68::ffff:9270:3d69::ffff:9270:3d6a::ffff:9270:3d6b::ffff:9270:3d6ccoalition-signals-intelligence-nt-scanning
List containing IP's associated with the Coalition signals intelligence scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/08/10
1,307 entries · version 26081011
First 5 entries
100.20.177.21/32100.21.51.20/32100.22.0.89/32100.22.234.236/32104.237.139.124/32common-contact-emails
A list of commonly used abuse and contact e-mail addresses, including the ones denoted in RFC2142.
1 entries · version 20200226
First 1 entries
/^(security|noc|soc|abuse)\@.*\..*$/icovid-19-cyber-threat-coalition-whitelist
The Cyber Threat Coalition's whitelist of COVID-19 related websites.
753 entries · version 20260811
First 5 entries
2019novelcoronavirusoracle.com3d.nicovideo.jp3dcovid19.techaanvraagcoronapremie.beaccount.nicovideo.jpcovid-19-krassi-whitelist
Krassimir's Covid-19 whitelist of known good Covid-19 related websites.
99 entries · version 20260811
First 5 entries
akkure4covid.comapi.contracovid.com.brapp.contracovid.com.brauxilio.caixa.gov.brbag-coronavirus.chcriminalip-scanning
Published source ranges of the internet-wide scanning organisation Criminal IP / AiSpera (criminalip.com / aispera.com), as tracked by https://github.com/OpenFilters/internet-scanners
1 entries · version 20261014
First 1 entries
185.242.226.0/24crl-hostname
Domains that belongs to CRL or OCSP
220 entries · version 20261005
First 5 entries
br-root-ca1-2020.ocsp.d-trust.netc.pki.googcdn.d-trust-cloudcrl.netcdp-ldap.intranet.eon.comcdp.disig.skcrl-ip
IP addresses that belongs to CRL or OCSP
385 entries · version 20261005
First 5 entries
103.165.181.22104.18.20.226104.18.21.226104.18.38.233106.120.110.60crowdstrikefalconsurface-scanning
Published source ranges of the internet-wide scanning organisation CrowdStrike Falcon Surface (crowdstrike.com), as tracked by https://github.com/OpenFilters/internet-scanners
6 entries · version 20261014
First 5 entries
18.97.19.128/2518.97.26.0/2418.97.5.0/2544.220.185.0/2444.220.188.0/24cybcube-scanning
Published source ranges of the internet-wide scanning organisation CyberCube (cybcube.com), as tracked by https://github.com/OpenFilters/internet-scanners
5 entries · version 20261014
First 5 entries
66.240.223.214/3266.240.223.240/3266.240.236.109/3266.240.236.116/3271.6.199.87/32cybergreen-scanning
Published source ranges of the internet-wide scanning organisation CyberGreen Institute (cybergreen.net), as tracked by https://github.com/OpenFilters/internet-scanners
1 entries · version 20261014
First 1 entries
52.73.169.169/32cybergreen-nt-scanning
List containing IP's associated with the Cybergreen scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2025/12/10
1 entries · version 25121023
First 1 entries
52.73.169.169/32cyberok-scanning
Published source ranges of the internet-wide scanning organisation CyberOK (cyberok.ru), as tracked by https://github.com/OpenFilters/internet-scanners
1 entries · version 20261014
First 1 entries
85.142.100.0/24cyberresilience-scanning
Published source ranges of the internet-wide scanning organisation CyberResilience (cyberresilience.io), as tracked by https://github.com/OpenFilters/internet-scanners
15 entries · version 20261014
First 5 entries
104.248.206.108/32143.198.115.76/32159.223.217.240/32159.89.1.53/32161.35.108.63/32cyberresilience-nt-scanning
List containing IP's associated with the Cyberresilience scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08
14 entries · version 26100813
First 5 entries
104.248.206.108/32137.184.75.34/32137.184.78.203/32138.68.73.85/32142.93.49.93/32odin-scanning
Published source ranges of the internet-wide scanning organisation Cyble ODIN (odin.io), as tracked by https://github.com/OpenFilters/internet-scanners
484 entries · version 20261014
First 5 entries
104.248.122.5/32104.248.138.26/32104.248.20.160/32104.248.22.153/32104.248.23.98/32cypex-scanning
Published source ranges of the internet-wide scanning organisation Cypex (cypex.ai), as tracked by https://github.com/OpenFilters/internet-scanners
21 entries · version 20261014
First 5 entries
18.117.57.162/3218.190.163.148/3218.217.194.148/3218.221.137.47/3218.223.104.85/32cypex-nt-scanning
List containing IP's associated with the Cypex scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/04/09
10 entries · version 26040915
First 5 entries
18.117.57.162/3218.190.163.148/3218.217.194.148/3218.221.137.47/3218.223.104.85/32dataplane-scanning
Published source ranges of the internet-wide scanning organisation Dataplane.org (dataplane.org), as tracked by https://github.com/OpenFilters/internet-scanners
4 entries · version 20261014
First 4 entries
204.130.133.143/32204.130.133.193/322607:fae0:f202:44c::143/1282607:fae0:f202:44c::193/128detectify-scanning
Published source ranges of the internet-wide scanning organisation Detectify (detectify.com), as tracked by https://github.com/OpenFilters/internet-scanners
11 entries · version 20261014
First 5 entries
107.20.158.220/3213.126.5.12/323.234.180.95/323.7.157.159/323.7.173.162/32edgewatch-scanning
Published source ranges of the internet-wide scanning organisation Edgewatch Security Intelligence (edgewatch.com), as tracked by https://github.com/OpenFilters/internet-scanners
1 entries · version 20261014
First 1 entries
185.114.175.0/24eset-scanning
Published source ranges of the internet-wide scanning organisation ESET Research (eset.com), as tracked by https://github.com/OpenFilters/internet-scanners
1 entries · version 20261014
First 1 entries
142.93.146.198/32f6-nt-scanning
List containing IP's associated with the F6 scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08
2 entries · version 26100813
First 2 entries
46.161.50.108/315.101.64.6/32mozilla-IntermediateCA
Fingerprint of known intermediate of trusted certificates taken from Mozilla's lists at https://wiki.mozilla.org/CA
7,701 entries · version 20261005
First 5 entries
0020d198028d12c73a2872376e24fbd73a39e39bf09338ac3b6495dd785df678002393fa0a6825f77ef686e208620b97177791f02f07db2518480fbe37ce7bd800250c293689880075fe9a82715e602877d53b5e0029aecf433fc4c7c61ce2f20c66c557002e6d642c2ee639b40fbed1020ee7beedf2e521f9b2bde46c958d32e6353e9dmozilla-CA
Fingerprint of trusted CA certificates taken from Mozilla's lists at https://wiki.mozilla.org/CA
516 entries · version 20260811
First 5 entries
010c0695a6981914ffbf5fc6b0b695ea29e912a6018e13f0772532cf809bd1b17281867283fc48c6e13be9c69812854a490c1b05022d0582fa88ce140c0679de7f1410e945d7a56d02ed0eb28c14da45165c566791700d6451d7fb56f0b2ab1d3b8eb070e56edff50552e6f83fdf65e8fa9670e666df28a4e21340b510cbe52566f97c4fb94b2bd1fofa-scanning
Published source ranges of the internet-wide scanning organisation FOFA Search Engine (fofa.info), as tracked by https://github.com/OpenFilters/internet-scanners
318 entries · version 20261014
First 5 entries
101.36.106.109/32101.36.106.75/32101.36.107.46/32101.36.108.178/32101.36.108.184/32google-chrome-crux-1million
Cached Chrome Top Million Websites - top 1 million
998,688 entries · version 20260908
First 5 entries
0-1.ir0.freebasics.com0.nbastrakhan.net0.torrentoyunindir.com000-leo.x.yupoo.comgroupib-scanning
Published source ranges of the internet-wide scanning organisation Group-IB (rnd.group-ib.com), as tracked by https://github.com/OpenFilters/internet-scanners
7 entries · version 20261014
First 5 entries
80.82.70.118/3280.82.70.133/3280.82.70.228/3280.82.77.202/3289.248.171.23/32hackertarget-scanning
Published source ranges of the internet-wide scanning organisation Hacker Target Pty Ltd (hackertarget.com / hackertarget.io), as tracked by https://github.com/OpenFilters/internet-scanners
3 entries · version 20261014
First 3 entries
143.198.179.104/32159.223.98.198/32198.211.109.100/32hadrian-scanning
Published source ranges of the internet-wide scanning organisation Hadrian (hdrn.nu / hadrian.io), as tracked by https://github.com/OpenFilters/internet-scanners
7 entries · version 20261014
First 5 entries
145.220.91.19/322001:67c:6ec:2913:145:220:91:19/12851.15.115.141/3251.15.44.6/3251.15.56.200/32ti-falsepositives
Hashes that are often included in IOC lists but are false positives.
24,645 entries · version 20251216
First 5 entries
00014cb6ebc0e2fb3f83dec061fc8ac100040c682b12de3c33ef3a1839260d4851073c94ce49ab32ac38dbd13c16e1c2000b86c93a586d1055074acbb05d93bbfc548d9380663e140721938696b9ef84000d32692ba88d6938780304c28fdba7000f5b33c5eb8d847c173df5da504fcf4fff4ac07265e1b5efcbc9354f123a11hunter-scanning
Published source ranges of the internet-wide scanning organisation Hunter Search Engine (hunter.how / hunter.qianxin.com), as tracked by https://github.com/OpenFilters/internet-scanners
3,521 entries · version 20261014
First 5 entries
101.200.243.197/32101.201.38.226/32106.15.238.36/32111.7.106.104/30111.7.96.149/32infrawatch-scanning
Published source ranges of the internet-wide scanning organisation Infrawatch (infrawat.ch / infrawatch.com / infrawatch.app), as tracked by https://github.com/OpenFilters/internet-scanners
31 entries · version 20261014
First 5 entries
154.16.44.0/24185.216.145.160/27185.223.235.0/26188.240.59.0/26193.124.20.224/27internet-census-nt-scanning
List containing IP's associated with the Internet census scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08
253 entries · version 26100813
First 5 entries
109.105.209.10/32109.105.209.12/30109.105.209.17/32109.105.209.18/31109.105.209.2/31internetmeasurementresearch-scanning
Published source ranges of the internet-wide scanning organisation Internet Measurement Research (internetmeasurementresearch.com), as tracked by https://github.com/OpenFilters/internet-scanners
10 entries · version 20261014
First 5 entries
209.188.108.0/24209.237.154.0/242620:96:a000::/462620:96:a004::/472620:96:a006::/48internetmetrics-scanning
Published source ranges of the internet-wide scanning organisation Internet Metrics (internet-metrics.com), as tracked by https://github.com/OpenFilters/internet-scanners
2 entries · version 20261014
First 2 entries
50.116.30.197/3296.126.112.111/32internetresearchproject-scanning
Published source ranges of the internet-wide scanning organisation Internet Research Project (internet-research-project.net), as tracked by https://github.com/OpenFilters/internet-scanners
11 entries · version 20261014
First 5 entries
104.237.150.176/32104.237.151.244/32172.104.210.143/32172.104.211.111/32172.104.23.19/32internettl-scanning
Published source ranges of the internet-wide scanning organisation InterneTTL (internettl.org), as tracked by https://github.com/OpenFilters/internet-scanners
1 entries · version 20261014
First 1 entries
104.152.52.0/24intrinsec-scanning
Published source ranges of the internet-wide scanning organisation Intrinsec (intrinsec.com), as tracked by https://github.com/OpenFilters/internet-scanners
5 entries · version 20261014
First 5 entries
213.32.122.80/2846.105.132.32/2751.254.59.112/2851.38.12.12/3051.38.12.20/30intrinsec-nt-scanning
List containing IP's associated with the Intrinsec scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08
3 entries · version 26100813
First 3 entries
46.105.132.32/3051.38.12.12/3051.38.12.20/30intruder-scanning
Published source ranges of the internet-wide scanning organisation Intruder (intruder.io), as tracked by https://github.com/OpenFilters/internet-scanners
36 entries · version 20261014
First 5 entries
13.115.104.128/2513.210.1.64/2613.213.79.0/2413.56.21.128/2513.59.252.0/25ipinfo-scanning
Published source ranges of the internet-wide scanning organisation IPinfo Internet Census Data Collection (ipinfo.io), as tracked by https://github.com/OpenFilters/internet-scanners
3,062 entries · version 20261014
First 5 entries
102.130.49.212/32102.164.61.103/32102.164.62.251/32102.177.72.174/32102.18.119.21/32ipinfo-nt-scanning
List containing IP's associated with the Ipinfo scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08
15 entries · version 26100813
First 5 entries
146.185.219.214/32146.185.248.89/3237.9.35.222/325.188.133.153/325.188.168.53/32ipip-scanning
Published source ranges of the internet-wide scanning organisation IPIP (ipip.net), as tracked by https://github.com/OpenFilters/internet-scanners
55 entries · version 20261014
First 5 entries
103.16.130.243/32103.16.131.136/32103.203.56.0/22103.230.157.150/32103.29.69.181/32ipip-nt-scanning
List containing IP's associated with the Ipip scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08
21 entries · version 26100813
First 5 entries
103.203.56.0/32103.203.57.0/32103.203.57.13/32103.203.57.15/32103.203.57.16/31ki3-scanning
Published source ranges of the internet-wide scanning organisation KI3 (ki3.org.cn), as tracked by https://github.com/OpenFilters/internet-scanners
8 entries · version 20261014
First 5 entries
101.132.145.132/32112.74.38.239/3247.89.154.16/3247.91.125.252/328.208.10.94/32knoq-scanning
Published source ranges of the internet-wide scanning organisation Knoq (knoq.nl), as tracked by https://github.com/OpenFilters/internet-scanners
1 entries · version 20261014
First 1 entries
88.80.189.24/32leakix-scanning
Published source ranges of the internet-wide scanning organisation LeakIX (leakix.org / leakix.net), as tracked by https://github.com/OpenFilters/internet-scanners
188 entries · version 20261014
First 5 entries
104.237.130.38/32128.199.182.152/32128.199.182.55/32128.199.182.77/32134.122.28.88/32microsoft-azure-appid
List of Azure Application IDs (https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in)
4 entries · version 20260811
First 4 entries
14d82eec-204b-4c2f-b7e8-296a70dab67e5572c4c0-d078-44ce-b81c-6cbf8d3ed39e7ae974c5-1af7-4923-af3a-fb1fd14dcb7ede8bc8b5-d9f9-48b1-a8ad-b748da725064disposable-email
List of disposable email domains
9,205 entries · version 20261014
First 5 entries
0-mail.com0-mailer.dynv6.net000-webmail.myhome-server.de000000000000000.theworkpc.com000000000000000000.dynv6.neteicar.com
Event contains one or more entries based on hashes for EICAR test virus
15 entries · version 20200403
First 5 entries
2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f3395856ce81f2b7382dee72602f798b642f1414044d88612fea8a8f36de82e1278abb02f6ce6f415d8475545be5ba114f208b0ffipv6-linklocal
Event contains one or more entries part of the IPv6 link local prefix (RFC 4291)
1 entries · version 20220705
First 1 entries
FE80::/10akamai
Akamai IP ranges from BGP search
346 entries · version 20261014
First 5 entries
103.11.223.0/24103.12.23.0/24103.13.37.0/24103.15.143.0/24103.16.197.0/24alibaba-cloud
Alibaba Cloud (Aliyun) IPv4 and IPv6 ranges, from the prefixes its verified autonomous systems announce, read live from the RIPEstat Data API (https://stat.ripe.net/). Alibaba Cloud publishes no address-space feed of its own. This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.
334 entries · version 20261014
First 5 entries
101.132.0.0/15101.200.0.0/15101.37.0.0/16103.135.210.0/23103.173.12.0/23amazon-aws
Amazon AWS IP address ranges (https://ip-ranges.amazonaws.com/ip-ranges.json)
4,083 entries · version 20261014
First 5 entries
1.178.1.0/241.178.100.0/221.178.16.0/201.178.172.0/231.178.174.0/24apple-domains
Hosts that Apple products need to access on enterprise networks, merged from Apple's support article (https://support.apple.com/en-us/101555) and the v2fly domain-list-community 'apple' data set (and its includes).
1,891 entries · version 20260829
First 5 entries
100beatscheap.com12diasdepresentesdeitunes.com12diasderegalosdeitunes.cl12diasderegalosdeitunes.co12diasderegalosdeitunes.co.crapple
IP ranges assigned to Apple
4 entries · version 20241023
First 4 entries
17.0.0.0/8192.12.74.0/24192.42.249.0/24204.79.190.0/24apple-ipv4
Apple IPv4 ranges announced by AS714 and AS6185
5 entries · version 20260829
First 5 entries
139.178.128.0/18144.178.0.0/1817.0.0.0/857.102.0.0/1565.199.22.0/23apple-ipv6
Apple IPv6 ranges announced by AS714 and AS6185
5 entries · version 20260829
First 5 entries
2403:300::/322620:0:1b00::/482620:149::/322a01:b740::/322a01:b747::/32bank-website
Event contains one or more entries of known banking website
2,226 entries · version 20260414
First 5 entries
.02bancorp.com.1822direkt.com.1stbk.com.1stfed.com.1stfedvw.combunny-net
List of known Bunny.net CDN IP ranges (https://support.bunny.net/hc/en-us/articles/115003578911-How-to-detect-when-BunnyCDN-PoP-servers-are-accessing-your-backend)
908 entries · version 20261014
First 5 entries
102.219.126.20102.67.138.155103.108.229.5103.108.231.41103.135.249.250cachefly
CacheFly IP address ranges (https://cachefly.cachefly.net/ips/cdn.txt)
10 entries · version 20261014
First 5 entries
167.71.238.159/32167.88.158.0/24195.191.102.0/23204.93.142.0/23204.93.150.0/24cdn77
CDN77 IP address ranges (https://prefixlists.tools.cdn77.com/public_lmax_prefixes.json)
36 entries · version 20261014
First 5 entries
109.61.88.160/27109.61.90.128/25143.244.33.128/26143.244.51.0/26143.244.51.192/26check-host-net
check-host IP addresses (https://check-host.net/nodes/ips)
59 entries · version 20261014
First 5 entries
103.125.218.226/32103.214.169.52/32103.42.116.205/32104.28.192.94/32107.149.201.15/32cloudflare
List of known Cloudflare IP ranges (https://www.cloudflare.com/ips/)
22 entries · version 20261014
First 5 entries
103.21.244.0/22103.22.200.0/22103.31.4.0/22104.16.0.0/13104.24.0.0/14coreweave
CoreWeave IP address ranges, from the prefixes announced by the autonomous systems held by CoreWeave, Inc (AS33425, AS46992) as reported by the RIPEstat Data API. This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.
7 entries · version 20261014
First 5 entries
166.19.0.0/16192.112.160.0/20198.176.96.0/20207.53.232.0/22216.153.48.0/20dax30
Event contains one or more entries of known dax30 webpages
13 entries · version 20200403
First 5 entries
.bmw.de.deutsche-boerse.com.innogy.com.linde.de.lufthansa.comdigitalocean
DigitalOcean IP address ranges, from their published RFC 8805 geofeed (https://digitalocean.com/geo/google.csv)
235 entries · version 20261014
First 5 entries
103.253.145.0/24103.253.146.0/23104.131.0.0/16104.236.0.0/16104.248.0.0/16whats-my-ip
Event contains one or more entries of known 'what's my ip' domains
234 entries · version 20260809
First 5 entries
2ip.ru2ip.toolsaboutmyip.comapi.ipify.orgapi.myip.comautomated-malware-analysis
Domains used by automated malware analysis services & security vendors
47 entries · version 20260904
First 5 entries
akana.mobiseclab.organalyze.intezer.comanlyz.ioapp.any.runapp.sndbox.comdriftnet
Driftnet / Internet-Measurement IP address ranges (https://internet-measurement.com/)
45 entries · version 20261014
First 5 entries
107.170.65.169/32128.199.8.140/32157.245.243.118/32157.245.245.246/32159.65.216.50/32dynamic-dns
Event contains one or more entries of known dynamic DNS domains.
45,603 entries · version 20261014
First 5 entries
.0000000000000000000000.com.0000004.xyz.00008192.xyz.00010010.org.0001124.xyzfastly
Fastly IP address ranges (https://api.fastly.com/public-ip-list)
21 entries · version 20261014
First 5 entries
103.244.50.0/24103.245.222.0/23103.245.224.0/24104.156.80.0/20140.248.128.0/17gcore
Gcore CDN IP address ranges (https://api.gcore.com/cdn/public-net-list)
322 entries · version 20261014
First 5 entries
1.37.77.96/28101.53.220.208/29102.130.69.140/30102.208.99.250/31102.216.238.168/29google-gcp
GCP (Google Cloud Platform) IP address ranges (https://www.gstatic.com/ipranges/cloud.json)
479 entries · version 20261014
First 5 entries
104.154.113.0/24104.154.114.0/23104.154.116.0/22104.154.120.0/23104.154.128.0/17github
GitHub IP address ranges (https://api.github.com/meta)
5,204 entries · version 20261014
First 5 entries
100.62.132.232/32100.62.139.158/32104.208.0.0/19104.208.128.0/17104.208.32.0/20google-gmail-sending-ips
List of known Gmail sending IP ranges (https://support.google.com/a/answer/27642?hl=en)
8 entries · version 20261014
First 5 entries
2001:4860:4864::/56209.85.128.0/172404:6800:4864::/562607:f8b0:4864::/562800:3f0:4864::/56godaddy
GoDaddy IP address ranges, collected from the prefixes announced by the autonomous systems of GoDaddy.com, LLC and GoDaddy Host Europe GmbH, via the RIPEstat Data API (https://stat.ripe.net/data/announced-prefixes/data.json). Note this is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.
161 entries · version 20261014
First 5 entries
103.44.220.0/24103.87.189.0/24103.87.190.0/23104.238.64.0/18107.180.0.0/17google
Event contains one or more entries of known google domains, merged from Google's own supported_domains list, the nickspaargaren/no-google community blocklist, and the v2fly domain-list-community 'google' data set.
7,556 entries · version 20261005
First 5 entries
0.chart.apis.google.com0.client-channel.google.com0.firebaseio.com0.fls.doubleclick.net00.firebaseio.comgooglebot
Google Bot IP address ranges (https://developers.google.com/search/apis/ipranges/googlebot.json)
59 entries · version 20260901
First 5 entries
192.178.4.0/24192.178.5.0/27192.178.6.0/232001:4860:4801:10::/602001:4860:4801:20::/59nioc-filehash
Event contains one or more benign files based on known hashes, see https://github.com/RichieB2B/nioc
197,415 entries · version 20210501
First 5 entries
00002c0f93816b3f8e432547b295ac290000a47b73c377a2ec61f78b196fb4480001098c33b66779505bc2e3b14d50c818e2abf25c99afa5194f954b07a454cf000184038785e19255c415e79e698ced83d8f0430001b55cfd0c5e837280da7d76743f0266c1a033empty-hashes
Event contains one or more entries of empty files based on known hashed
6 entries · version 20200403
First 5 entries
3::cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3ed14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42fd41d8cd98f00b204e9800998ecf8427eda39a3ee5e6b4b0d3255bfef95601890afd80709windows-binary-hashes
List of known Windows binaries based on hashes from winbindex (https://github.com/m417z/winbindex)
789,700 entries · version 20260709
First 5 entries
000031f59f1d81be876257834e2c4d9aa89b72cda2c2507a4d53003e8307850e0000340cd15afe3c5d3e5d1b9818e7fa02bf635dab41ee6656a905c302700ae4000069963845056a276aef2f22c604cb03242463b8a50ced76e9d285d64f4d2f000081ad1f098ba1f545b402161cdd3191ccce58f294102b62117caa76b721a50000b0742d5f72860d9f5f1178c9d992aa96e4d7c24da22683fd02a16630679ccommon-ioc-false-positive
Event contains one or more entries with common false-positives
69 entries · version 20200403
First 5 entries
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b048846ed8ed185a26394adeb3f63274d1029bbd59cffa8e73a4ef8b19456de1d06f7826c2862d184a49e3672c0aa6097b11e7771a4bf613ec37941236c1a8e2007c4c7ae2c4c7cb3ccd2ba9cd70a94382395ca8e2b0312c1631d09d790b6db330f343b0931126a20f133d67c2b018a3bhetzner
Hetzner Online GmbH IP address ranges, from their published RFC 8805 geofeed (https://www.hetzner.com/geofeed.csv). This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.
166,298 entries · version 20261014
First 5 entries
116.202.0.0/19116.202.112.0/21116.202.128.0/21116.202.136.0/25116.202.137.0/26findip-host
Event contains one or more entries of known hostname querying your source IP.
24 entries · version 20260809
First 5 entries
api.extralargecoffee.comapi.ipify.orghelper.rumble.networkip.circl.luip.dyn.bortzmeyer.frhuawei-cloud
Huawei Cloud IP address ranges, from the RFC 8805 geofeed Huawei publishes for its cloud regions (https://res-static.hc-cdn.cn/cloudbu-site/china/zh-cn/IP-location/google-geo-feed.csv), the file referenced by the geofeed: attribute of Huawei Cloud's own inetnum objects in APNIC whois. This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.
244 entries · version 20261014
First 5 entries
1.178.32.0/191.92.0.0/161.94.0.0/181.94.128.0/171.94.64.0/20ibm-cloud
IBM Cloud (ex-SoftLayer) IP address ranges, from the prefixes announced by its autonomous systems AS36351, AS46702, AS46703, AS46704 as reported by the RIPEstat Data API (https://stat.ripe.net/data/announced-prefixes/data.json). IBM publishes no unauthenticated machine-readable endpoint for these. Scoped to the SOFTLAYER-handle cloud fleet; IBM corporate address space is deliberately excluded. A minority of the announced prefixes are registered to third parties: those are customer / bring-your-own-IP ranges routed out of IBM Cloud's autonomous system and are kept on purpose. This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.
217 entries · version 20261014
First 5 entries
103.106.108.0/24103.193.4.0/22103.197.160.0/22103.53.196.0/24103.70.48.0/24icloud-private-relay
iCloud Private Relay egress IP address ranges (https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay/)
14,070 entries · version 20261014
First 5 entries
104.28.100.10/31104.28.100.106/31104.28.100.108/30104.28.100.12/30104.28.100.16/32imperva
Imperva (Incapsula) IP address ranges (https://my.imperva.com/api/integration/v1/ips)
12 entries · version 20261014
First 5 entries
103.28.248.0/22107.154.0.0/16131.125.128.0/17149.126.72.0/21185.11.124.0/22openai-gptbot
OpenAI gptbot crawler (https://openai.com/gptbot.json)
15 entries · version 20261005
First 5 entries
132.196.86.0/24172.182.202.0/25172.182.207.0/2520.125.66.80/2820.171.206.0/23palo-alto-networks-cortex-xpanse
Palo Alto Networks Cortex Xpanse (https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity)
10 entries · version 20261014
First 5 entries
144.86.173.0/24147.185.132.0/22162.216.148.0/22172.105.147.0/24198.235.24.0/24vpn-ipv4
IPv4 networks belonging to common VPN providers, from https://raw.githubusercontent.com/X4BNet/lists_vpn/main/output/vpn/ipv4.txt
11,052 entries · version 20261014
First 5 entries
102.128.164.0/23102.129.132.0/24102.129.141.0/24102.129.143.0/24102.129.145.130/31datacenter-ipv4
IPv4 networks belonging to datacenters and VPN providers, from https://raw.githubusercontent.com/X4BNet/lists_vpn/main/output/datacenter/ipv4.txt
44,428 entries · version 20261014
First 5 entries
1.116.0.0/151.118.3.0/241.12.0.0/141.178.1.0/241.178.100.0/22public-dns-v4
Event contains one or more public IPv4 DNS resolvers as attribute with an IDS flag set
62,780 entries · version 20260829
First 5 entries
1.0.0.11.0.0.191.0.0.21.0.0.31.0.127.132vpn-ipv6
IPv6 networks belonging to common VPN providers, from https://raw.githubusercontent.com/X4BNet/lists_vpn/main/output/vpn/ipv6.txt
498 entries · version 20261014
First 5 entries
2001:550:1d05::/482001:678:8b4::/482001:978:2305::/482001:978:3400::/482001:ac8::/32datacenter-ipv6
IPv6 networks belonging to datacenters and VPN providers, from https://raw.githubusercontent.com/X4BNet/lists_vpn/main/output/datacenter/ipv6.txt
8,752 entries · version 20261014
First 5 entries
2001:1520::/322001:1598::/322001:15e8::/322001:1608::/322001:1638::/32public-dns-v6
Event contains one or more public IPv6 DNS resolvers as attribute with an IDS flag set
358 entries · version 20260829
First 5 entries
2001:148f:fffe::12001:148f:ffff::12001:1608:10:25::1c04:b12f2001:1608:10:25::9249:d69b2001:19f0:5:3bd7:5400:4ff:fe05:da83leaseweb
Leaseweb IP address ranges, from the prefixes announced by the autonomous systems held by the Leaseweb group, as reported by the RIPEstat Data API (https://stat.ripe.net). Leaseweb publishes no address-space feed of its own. This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.
1,386 entries · version 20261014
First 5 entries
103.101.128.0/22103.119.218.0/23103.138.32.0/24103.139.48.0/23103.139.50.0/24link-in-bio
Event contains one or more entries of known Link in bio domains. Those shorten links are a reference to a list of links.
91 entries · version 20261014
First 5 entries
alllink.ioartist.linkbeacons.aibio.fmbio.sitelinode
Linode (Akamai Connected Cloud) IP address ranges, from their published RFC 8805 geofeed (https://geoip.linode.com/)
279 entries · version 20261014
First 5 entries
103.29.68.0/22103.3.60.0/22104.105.0.0/16104.111.0.0/18104.200.16.0/20microsoft-azure-china
Microsoft Azure China Datacenter IP Ranges
156 entries · version 20261014
First 5 entries
103.9.10.0/24139.217.0.0/19139.217.128.0/19139.217.160.0/26139.217.160.128/28microsoft-azure
Microsoft Azure Datacenter IP Ranges
2,337 entries · version 20261014
First 5 entries
102.133.0.0/16102.37.0.0/16103.25.156.0/24103.255.140.0/23103.36.96.0/24microsoft-azure-germany
Microsoft Azure Germany Datacenter IP Ranges
36 entries · version 20261014
First 5 entries
2a01:4180:2000::/402a01:4180:2400::/402a01:4180:4050:400::/642a01:4180:4050:800::/642a01:4180:4051:400::/64microsoft-azure-us-gov
Microsoft Azure US Government Cloud Datacenter IP Ranges
161 entries · version 20261014
First 5 entries
104.210.16.0/20104.212.32.0/23104.212.34.0/24104.212.43.0/24104.212.44.0/23microsoft-mdca-proxy
Microsoft Defender for Cloud Apps (MDCA/MCAS) hostnames (https://learn.microsoft.com/en-us/defender-cloud-apps/troubleshooting-proxy-url)
16 entries · version 20260819
First 5 entries
.admin-mcas-df.ms.admin-mcas-gov-df.ms.admin-mcas-gov-df.us.admin-mcas-gov.ms.admin-mcas-gov.usmicrosoft
Event contains one or more entries of known microsoft domains
322 entries · version 20260908
First 5 entries
.aadrm.cn.aadrm.com.aadrm.us.acompli.net.admin.onedrive.usmicrosoft-attack-simulator
Office 365 URLs and IP address ranges used for their attack simulator in Office 365 Threat Intelligence
141 entries · version 20260405
First 5 entries
52.168.52.134portal.docdeliveryapp.comportal.docdeliveryapp.netportal.docstoreinternal.comportal.hardwarecheck.netmicrosoft-office365-ip
Office 365 IP address ranges
82 entries · version 20261014
First 5 entries
104.146.128.0/17104.47.0.0/1713.107.128.0/2213.107.136.0/2213.107.140.6/32microsoft-office365-cn
Office 365 IP address ranges in China
67 entries · version 20261014
First 5 entries
101.28.252.0/24103.9.8.0/22112.25.33.0/24115.231.150.0/24123.150.49.0/24microsoft-office365
Office 365 URLs and IP address ranges
183 entries · version 20260811
First 5 entries
aadrm.comaccount.activedirectory.windowsazure.comaccount.live.comaccounts.accesscontrol.windows.netacompli.netoracle-oci
Oracle Cloud Infrastructure (OCI) IP address ranges (https://docs.oracle.com/en-us/iaas/Content/General/Concepts/addressranges.htm)
798 entries · version 20261014
First 5 entries
129.144.0.0/16129.145.16.0/21129.145.74.0/23129.145.76.0/22129.146.0.0/21ovh-cluster
OVH Cluster IP address (https://docs.ovhcloud.com/en/guides/web-cloud/web-hosting/clusters-and-shared-hosting-ip)
622 entries · version 20261014
First 5 entries
137.74.180.117137.74.229.68137.74.234.211137.74.48.119145.239.222.45palo-alto-networks-cortex-cloud
Palo Alto Cortex Cloud IP address ranges (https://docs.ovhcloud.com/en/guides/web-cloud/web-hosting/clusters-and-shared-hosting-ip)
276 entries · version 20261014
First 5 entries
104.155.131.72104.199.223.229136.110.132.208136.110.146.246159.183.150.248public-dns-hostname
Event contains one or more public DNS resolvers (expressed as hostname) as attribute with an IDS flag set
34,783 entries · version 20240615
First 5 entries
-250.starlink.ru0.it4tech.ru003-077-128-083.dynamic.caiway.nl0040.extnet.it006.132.48.116.static.netvigator.compublic-ipfs-gateways
Event contains one or more entries of known public IPFS gateways
100 entries · version 20261014
First 5 entries
4everland.io5d6zyscsdarzytpbi3mypv37uoaro2to7oqru4a3oga42bwt3jkof4qd.onionalexdav.idapac.orbitor.devaragon.venturesrackspace
Rackspace IP address ranges, from the prefixes announced by the Rackspace autonomous systems (RIPEstat announced-prefixes). Note this is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.
153 entries · version 20261014
First 5 entries
103.4.112.0/23104.130.0.0/18104.130.112.0/21104.130.120.0/22104.130.160.0/19salesforce
Salesforce IP address ranges, from their published ip-ranges endpoint (https://ip-ranges.salesforce.com/ip-ranges.json). These are fixed SaaS service endpoints rather than rentable compute, which makes them cleaner warninglist material: the addresses stay tied to Salesforce's own platform instead of to whichever tenant rented them today.
37 entries · version 20261014
First 5 entries
129.77.12.0/23141.163.192.0/23141.163.195.0/24141.163.196.0/23141.163.199.0/24scaleway
Scaleway (formerly Online SAS) IP address ranges, from the ranges Scaleway documents itself (https://www.scaleway.com/en/docs/account/reference-content/scaleway-network-information.md). This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.
12 entries · version 20261014
First 5 entries
151.115.0.0/16163.172.0.0/16195.154.0.0/162001:bc8::/32212.129.0.0/18security-provider-blogpost
Event contains one or more entries of known security providers/vendors blog domain with an IDS flag set
647 entries · version 20241204
First 5 entries
0x1338.blogspot.be2014.hack.lu2014.zeronights.ruabout-threats.trendmicro.comaccess.redhat.comsinkholes
List of known sinkholes
203 entries · version 20261014
First 5 entries
104.155.11.149104.21.27.14104.21.65.18104.236.150.45104.236.158.189smtp-receiving-ips
List of IP addresses for known SMTP servers.
279 entries · version 20261005
First 5 entries
103.129.252.43103.129.252.44103.129.252.65103.168.172.216103.168.172.217smtp-sending-ips
List of IP ranges for known SMTP servers.
1,021 entries · version 20261014
First 5 entries
1.201.15.0/241.95.21.0/27100.24.127.128/25100.25.99.0/25101.226.139.0/25stackpath
Empty: StackPath wound down its CDN and the generator's only source (https://k3t9x2h3.map2.ssl.hwcdn.net/ipblocks.txt) is dead (NXDOMAIN); hwcdn.net is now a parked domain-for-sale page. The formerly-listed IP ranges are being reassigned to new owners, so they are no longer safe to whitelist.
0 entries · version 20261014
This list has no entries.
sucuri
Sucuri Website Firewall IP address ranges, scraped from https://docs.sucuri.net/website-firewall/sucuri-firewall-troubleshooting-guide/ (no machine-readable API is published)
5 entries · version 20261014
First 5 entries
185.93.228.0/22192.88.134.0/23208.109.0.0/222a02:fe80::/2966.248.200.0/22telegram-ips
Telegram IP address ranges (https://core.telegram.org/resources/cidr.txt)
14 entries · version 20261014
First 5 entries
149.154.160.0/20185.76.151.0/242001:67c:4e8::/482001:b28:f23c::/482001:b28:f23d::/48tenable-cloud-ipv4
Tenable IPv4 Cloud Sensor addresses used for scanning Internet-facing infrastructure
39 entries · version 20261014
First 5 entries
13.115.104.128/2513.210.1.64/2613.213.79.0/2413.56.21.128/2513.59.252.0/25tenable-cloud-ipv6
Tenable IPv6 Cloud Sensor addresses used for scanning Internet-facing infrastructure
17 entries · version 20261014
First 5 entries
2406:da14:e76:5b00::/562406:da17:524:dd00::/562406:da18:844:7100::/562406:da1a:5b2:8500::/562406:da1c:20f:2f00::/56tencent-cloud
Tencent Cloud IP address ranges, from the prefixes announced by Tencent's autonomous systems as reported by the RIPEstat Data API (https://stat.ripe.net/). Tencent publishes no machine-readable address-space file, so the address space is derived from BGP. This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.
259 entries · version 20261014
First 5 entries
1.116.0.0/151.12.0.0/141.201.184.0/221.201.188.0/23101.32.0.0/18tor-exit-nodes
Specialized list of IPv4 addresses belonging to Tor exit nodes, from https://github.com/X4BNet/lists_torexit
831 entries · version 20261014
First 5 entries
102.130.113.9/32102.130.117.167/32102.130.127.117/32102.211.56.20/32102.68.99.63/32url-shortener
Event contains one or more entries of known Shorteners domains
255 entries · version 20261014
First 5 entries
1url.com2h.ae2ly.link2no.co2uuu.mevultr
Vultr (Constant Company, LLC) IP address ranges, from their published RFC 8805 geofeed (https://geofeed.constant.com/). This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.
145 entries · version 20261014
First 5 entries
103.43.72.0/22104.156.224.0/19104.207.128.0/19104.238.128.0/18107.191.32.0/19wikimedia
Wikimedia address ranges (https://wikitech.wikimedia.org/w/api.php?action=parse&page=IP_and_AS_allocations&format=json&prop=wikitext)
10 entries · version 20260819
First 5 entries
103.102.166.0/24185.15.56.0/22193.46.90.0/24195.200.68.0/24198.35.26.0/23microsoft-win10-connection-endpoints
Event contains one or more entries of known Windows 10 connection endpoints (https://docs.microsoft.com/en-us/windows/privacy/manage-windows-endpoints)
144 entries · version 20220816
First 5 entries
.1.msftsrvcs.vo.llnwi.net.a-msedge.net.akamai.net.akamaiedge.net.b.akamaiedge.netmicrosoft-win11-connection-endpoints
Event contains one or more entries of known Windows 11 connection endpoints (https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints)
152 entries · version 20260829
First 5 entries
.api.cdp.microsoft.com.blob.core.windows.net.delivery.mp.microsoft.com.displaycatalog.mp.microsoft.com.dl.delivery.mp.microsoft.comzscaler
Zscaler IP address ranges (https://config.zscaler.com/api/zscaler.net/hubs/cidr/json/recommended)
78 entries · version 20261014
First 5 entries
101.2.192.0/18104.129.192.0/20112.196.99.180/32136.226.0.0/16137.31.0.0/16lots-project
List of popular legitimate domains from LOTS (Living Off Trusted Sites) Project used to conduct phishing, C&C, exfiltration or downloading tools to evade detection
175 entries · version 20261014
First 5 entries
.000webhostapp.com.amazonaws.com.appspot.com.atlassian.net.axshare.cominternetcleanup-scanner
Internet Cleanup Foundation scaninfo (https://internetcleanup.foundation/scaninfo/)
6 entries · version 20261014
First 5 entries
145.220.76.240/32145.220.91.28/31185.71.61.126/31185.71.61.129/32185.71.61.140/32modat-scanner
Modat Scanner (https://www.modat.io/)
39 entries · version 20261014
First 5 entries
142.91.102.186/31185.2.80.252/31212.73.148.0/27212.73.148.32/29212.73.148.40/31onyphe-scanner
Onyphe Scanner (https://www.onyphe.io/)
9 entries · version 20261014
First 5 entries
195.184.76.0/242001:41d0:33a:a00::400/1242001:41d0:33d:9200::400/1242a14:f100::/2951.254.49.96/28rfc1918
Event contains one or more entries part of the private network CIDR blocks (RFC 1918)
3 entries · version 20220705
First 3 entries
10.0.0.0/8172.16.0.0/12192.168.0.0/16rfc3849
Event contains one or more entries part of the IPv6 documentation prefix (RFC 3849)
1 entries · version 20220705
First 1 entries
2001:DB8::/32rfc5735
Event contains one or more entries part of the Special Use IPv4 Addresses CIDR blocks (RFC 5735)
15 entries · version 20220705
First 5 entries
0.0.0.0/810.0.0.0/8127.0.0.0/8169.254.0.0/16172.16.0.0/12multicast
Event contains one or more entries part of the RFC 5771 multicast CIDR blocks
16 entries · version 20240422
First 5 entries
224.0.0.0/8225.0.0.0/8226.0.0.0/8227.0.0.0/8228.0.0.0/8rfc6598
Event contains one or more entries part of the Shared Address Space CIDR blocks (RFC 6598)
1 entries · version 20220705
First 1 entries
100.64.0.0/10rfc6761
Event contains one or more entries part of the Special-Use Domain Names (RFC 6761)
25 entries · version 20260908
First 5 entries
10.in-addr.arpa16.172.in-addr.arpa168.192.in-addr.arpa17.172.in-addr.arpa18.172.in-addr.arpamandiantasm-scanning
Published source ranges of the internet-wide scanning organisation Mandiant ASM / GTI (mandiant.com), as tracked by https://github.com/OpenFilters/internet-scanners
105 entries · version 20261014
First 5 entries
103.66.28.0/2213.58.114.74/3213.58.203.73/3213.58.84.198/3213.59.120.77/32modat-nt-scanning
List containing IP's associated with the Modat scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08
37 entries · version 26100813
First 5 entries
212.73.148.0/32212.73.148.11/32212.73.148.14/32212.73.148.16/32212.73.148.2/32netlas-scanning
Published source ranges of the internet-wide scanning organisation Netlas (netlas.io), as tracked by https://github.com/OpenFilters/internet-scanners
11 entries · version 20261014
First 5 entries
93.123.109.120/3093.123.109.124/3193.123.109.17/3293.123.109.18/3193.123.109.20/30netscout-scanning
Published source ranges of the internet-wide scanning organisation NETSCOUT (internet-albedo.net), as tracked by https://github.com/OpenFilters/internet-scanners
1 entries · version 20261014
First 1 entries
146.88.240.0/23netsecscan-nt-scanning
List containing IP's associated with the Netsecscan scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2025/12/10
11 entries · version 25121023
First 5 entries
89.248.167.132/3189.248.167.135/3289.248.167.139/3289.248.167.140/3289.248.167.147/32netsecscan-scanning
List of NetSecScan.net scanners
11 entries · version 20261014
First 5 entries
89.248.167.132/3189.248.167.135/3289.248.167.139/3289.248.167.140/3289.248.167.147/32deepfield-scanning
Published source ranges of the internet-wide scanning organisation Nokia Deepfield (deepfield.net), as tracked by https://github.com/OpenFilters/internet-scanners
48 entries · version 20261014
First 5 entries
195.178.110.162/322001:bc8:702:10ba::/1282001:bc8:702:11ad::/1282001:bc8:702:11f3::/1282001:bc8:702:1209::/128onlyscans-scanning
Published source ranges of the internet-wide scanning organisation ONLYSCANS (onlyscans.com / onlyscans.net), as tracked by https://github.com/OpenFilters/internet-scanners
16 entries · version 20261014
First 5 entries
104.105.18.64/32172.104.240.26/32172.104.42.54/32172.104.48.115/32172.105.92.211/32onyphe-nt-scanning
List containing IP's associated with the Onyphe scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08
167 entries · version 26100813
First 5 entries
195.184.76.0/28195.184.76.112/30195.184.76.116/32195.184.76.118/31195.184.76.120/29digitalside
OSINT DigitalSide Threat-Intel Repository - MISP Warninglist - List of domains should be marked as false positive in the related MISP event with IDS attribute not flagged
43 entries · version 20260811
First 5 entries
amazonaws.comarchive.orgassets-global.website-files.combackblaze.combackblazeb2.comparking-domain
List of parking domain's ip adresses
108 entries · version 20261014
First 5 entries
103.120.80.111/32103.139.0.32/32103.224.182.0/23103.224.212.0/23104.26.6.37/32parking-domain-ns
List of parking domain's name server
129 entries · version 20261014
First 5 entries
above.comafternic.comalter.combodis.combookmyname.compocnroll-scanning
Published source ranges of the internet-wide scanning organisation pocnroll (pocnroll.com), as tracked by https://github.com/OpenFilters/internet-scanners
1 entries · version 20261014
First 1 entries
45.79.38.219/32probethenet-nt-scanning
List containing IP's associated with the Probethenet scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/07/08
6 entries · version 26070810
First 5 entries
104.128.144.201/32104.128.144.202/31104.128.144.204/30104.128.144.208/29104.128.144.216/30probethenet-scanning
Published source ranges of the internet-wide scanning organisation ProbeTheNet Project / mThreat Technology Inc. (probethenet.com), as tracked by https://github.com/OpenFilters/internet-scanners
6 entries · version 20261014
First 5 entries
104.128.144.201/32104.128.144.202/31104.128.144.204/30104.128.144.208/29104.128.144.216/30rapid7-nt-scanning
List containing IP's associated with the Rapid7 scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08
18 entries · version 26100813
First 5 entries
109.123.117.228/30109.123.117.232/29109.123.117.240/29109.123.117.248/30109.123.117.252/31rapid7-scanning
Published source ranges of the internet-wide scanning organisation Rapid7 Project Sonar (rapid7.com), as tracked by https://github.com/OpenFilters/internet-scanners
11 entries · version 20261014
First 5 entries
109.123.117.224/27146.185.25.160/27173.255.225.139/322607:ff10:c5:522::/642a02:2498:e004:23::/64recordedfuture-scanning
Published source ranges of the internet-wide scanning organisation Recorded Future / SecurityTrails (securitytrails.com), as tracked by https://github.com/OpenFilters/internet-scanners
6 entries · version 20261014
First 5 entries
13.219.121.241/3218.235.110.182/323.233.59.216/3254.86.115.253/3298.84.1.175/32recyber-scanning
Published source ranges of the internet-wide scanning organisation Recyber (recyber.net), as tracked by https://github.com/OpenFilters/internet-scanners
10 entries · version 20261014
First 5 entries
89.248.163.0/2489.248.165.0/2489.248.173.170/3289.248.173.173/3289.248.173.177/32researchscanner-scanning
Published source ranges of the internet-wide scanning organisation Research Scanner (research-scanner.com), as tracked by https://github.com/OpenFilters/internet-scanners
25 entries · version 20261014
First 5 entries
138.197.101.95/32138.197.118.33/32138.68.249.116/32157.245.176.143/32157.245.252.5/32research-scanner-nt-scanning
List containing IP's associated with the Research scanner scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08
24 entries · version 26100813
First 5 entries
138.197.101.95/32138.197.118.33/32157.245.176.143/32157.245.252.5/32159.223.203.97/32rootevidence-scanning
Published source ranges of the internet-wide scanning organisation Root Evidence (rootevidence.com), as tracked by https://github.com/OpenFilters/internet-scanners
727 entries · version 20261014
First 5 entries
104.200.30.203/32104.200.30.246/32104.200.30.75/32104.200.30.79/32104.200.30.90/32university-scanning
Published source ranges of the internet-wide scanning organisation Scanners from various universities, as tracked by https://github.com/OpenFilters/internet-scanners
204 entries · version 20261014
First 5 entries
104.207.149.87/32104.238.185.11/32108.61.209.136/32108.61.241.199/32128.232.21.75/32second-level-tlds
Event contains one or more second level TLDs as attribute with an IDS flag set.
10,325 entries · version 20261005
First 5 entries
0.bg001.test.code-builder-stg.platform.salesforce.com0am.jp0e.vc0emm.comsecurityresearch-scanning
Published source ranges of the internet-wide scanning organisation securityresearch.net, as tracked by https://github.com/OpenFilters/internet-scanners
1 entries · version 20261014
First 1 entries
144.202.82.88/32shadowforce-nt-scanning
List containing IP's associated with the Shadowforce scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08
1 entries · version 26100813
First 1 entries
209.38.165.60/32shadowforce-scanning
List of shadowforce.io scanners
23 entries · version 20261014
First 5 entries
128.199.44.215/32142.93.135.160/32146.190.21.73/32152.42.136.22/32159.223.0.20/32shadowserver-nt-scanning
List containing IP's associated with the Shadowserver scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/07/08
9 entries · version 26070810
First 5 entries
184.105.247.194/31184.105.247.252/32216.218.206.67/3264.62.197.152/3264.62.197.17/32shadowserver
List of Shadowserver IP-Ranges. Potentially associated with Shadowserver scans. based on [https://bgp.he.net/search?search%5Bsearch%5D=shadowserver&commit=Search]
40 entries · version 20261014
First 5 entries
108.165.44.0/24146.19.20.0/24154.16.223.0/24154.16.230.0/24154.16.240.0/24shodan-nt-scanning
List containing IP's associated with the Shodan scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08
28 entries · version 26100813
First 5 entries
2.59.22.234/3266.240.192.138/3266.240.205.34/3266.240.219.146/3266.240.236.119/32shodan-scanning
List of Shodan.io scanners
104 entries · version 20261014
First 5 entries
134.209.95.237/32137.184.112.103/32137.184.112.192/32137.184.13.100/32137.184.190.194/32skipa-nt-scanning
List containing IP's associated with the Skipa scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/03/13
1 entries · version 26031315
First 1 entries
85.142.100.2/32stretchoid-scanning
Published source ranges of the internet-wide scanning organisation Stretchoid (stretchoid.com), as tracked by https://github.com/OpenFilters/internet-scanners
5,039 entries · version 20261014
First 5 entries
104.42.220.14/32128.203.200.147/32128.203.200.175/32128.203.200.182/32128.203.200.211/32stretchoid-nt-scanning
List containing IP's associated with the Stretchoid scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08
1,242 entries · version 26100813
First 5 entries
104.42.155.18/3213.83.164.24/3213.86.114.132/3213.86.114.16/3213.86.115.128/32tenableasm-scanning
Published source ranges of the internet-wide scanning organisation Tenable ASM (tenable.com / tenable.io), as tracked by https://github.com/OpenFilters/internet-scanners
139 entries · version 20261014
First 5 entries
13.115.104.128/2513.210.1.64/2613.213.79.0/2413.56.21.128/2513.59.252.0/25tlds
Event contains one or more TLDs as attribute with an IDS flag set
1,437 entries · version 20261005
First 5 entries
AAAAARPABBABBOTTABBVIEcisco_top1m
Event contains one or more entries from the top 1 000 000 of the most used websites (Cisco Umbrella).
999,998 entries · version 20261005
First 5 entries
"amazon-adsystem.com"cn"com"images-na.ssl-images-amazon.com"media-amazon.comcloudflare-top1k
List of top 1,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)
1,001 entries · version 20260810
First 5 entries
0xrpc.io163.com1rx.io2gis.com2mdn.netcloudflare-top1m
List of top 1,000,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)
1,000,125 entries · version 20260810
First 5 entries
"com,thefatherofsalmon.com.host"0-0.pro0-0c.com0-1-2-1.ir0-1n.comtranco
Event contains one or more entries from the top 1,000,000 most-used sites (https://tranco-list.eu/).
1,000,000 entries · version 20261005
First 5 entries
0-0.asia0-1.ir0-24.jp0-55.ru0-57-26.buzzcisco_top10k
Event contains one or more entries from the top 10 000 of the most used websites (Cisco Umbrella).
10,000 entries · version 20261005
First 5 entries
-container.supertms.com0-bvs84irkvfpdbio14klg0d2um4mttanvfdm.canva-apps.cn0-courier.push.apple.com0-courier2.push.apple.com0-ejemplo.supertms.comcloudflare-top10k
List of top 10,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)
10,001 entries · version 20260810
First 5 entries
011st.com0x7c0.com0xrpc.io10010.com10086.cncloudflare-top100k
List of top 100,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)
100,001 entries · version 20260810
First 5 entries
0-0c.com0-h-g-l.com0-r-a-v.com000webhost.com001scrm.netalexa
Event contains one or more entries from the top 1000 of the most used website (Alexa).
1,000 entries · version 20230511
First 5 entries
10086.cn11467.com115.com11st.co.kr123pan.comcisco_top1000
Event contains one or more entries from the top 1000 of the most used websites (Cisco Umbrella).
1,000 entries · version 20261005
First 5 entries
1.connectivity-test.static.microsoft1.nflxso.net1d.tlu.dl.delivery.mp.microsoft.com1pst.e2ro.com1rx.iomajestic_million
Event contains one or more entries from the top 10000 of the most used websites (Majestic Million).
10,000 entries · version 20261005
First 5 entries
000webhostapp.com01net.com0577vr.cn104.com.tw10jqka.com.cntranco10k
Event contains one or more entries from the top 10K most-used sites (https://tranco-list.eu/).
10,000 entries · version 20261005
First 5 entries
0123tt.ru029whhg.com0lin.com0xrpc.io10086.cncloudflare-top2k
List of top 2,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)
2,001 entries · version 20260810
First 5 entries
0xrpc.io126.net163.com1905.com1drv.comcisco_top20k
Event contains one or more entries from the top 20 000 of the most used websites (Cisco Umbrella).
20,000 entries · version 20261005
First 5 entries
-container.supertms.com0-akali-comssets.create.wire.c.dev1--premisewww.lel.asia0-bvs84irkvfpdbio14klg0d2um4mttanvfdm.canva-apps.cn0-cloudappatepractice.canva-apps.cn0-courier.push.apple.comcloudflare-top20k
List of top 20,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)
20,001 entries · version 20260810
First 5 entries
004430.xyz007666.com011st.com0123456789nonexistent.com03k.orgcloudflare-top200
List of top 200 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)
201 entries · version 20260810
First 5 entries
2mdn.net3gppnetwork.orga2z.comaaplimg.comadnxs.comcloudflare-top200k
List of top 200,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)
200,001 entries · version 20260810
First 5 entries
0-0c.com0-h-g-l.com0-jayparts.com0-r-a-v.com000webhost.comcloudflare-top5k
List of top 5,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)
5,001 entries · version 20260810
First 5 entries
0x7c0.com0xrpc.io10086.cn10jqka.com.cn11st.co.krcloudflare-top50k
List of top 50,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)
50,001 entries · version 20260810
First 5 entries
004430.xyz007666.com00px.net01.org0101.co.jpmoz-top500
Event contains one or more entries from the top 500 of the most used domains from Moz.
500 entries · version 20261005
First 5 entries
123rf.com20minutos.es3ds.com4shared.comabc.escloudflare-top500k
List of top 500,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)
500,003 entries · version 20260810
First 5 entries
0-0.pro0-0c.com0-1n.com0-8-0-a.com0-9.clubcisco_top5k
Event contains one or more entries from the top 5000 of the most used websites (Cisco Umbrella).
5,000 entries · version 20261005
First 5 entries
-container.supertms.com0-courier2.push.apple.com0-ejemplo.supertms.com0-enakamai-lanwpradio-1ali-ali-s3.ali.gwfb.net0.amazon.pool.ntp.orgphone_numbers
Numbers that cannot be attributed because they reserved for different purposes.
33 entries · version 20260812
First 5 entries
/((?:\+|00)1)?([0-9]{3})55501([0-9]{2})//((?:\+|00)1)?55501([0-9]{2})//((?:\+|00)33?|0?)(19900|26191|35301|46571|53649|63998)([0-9]{4})//((?:\+|00)33?|0?)(999)([0-9]{6})//((?:\+|00)353)?02091([0-9]{5})/university_domains
List of University domains from https://raw.githubusercontent.com/Hipo/university-domains-list/master/world_universities_and_domains.json
10,588 entries · version 20261005
First 5 entries
29mayis.edu.tr4cd.edua-aarhus.dka2.keio.jpaabu.edu.joumich-cse-connection-attempts
University of Michigan Computer Science and Engineering connection attempts page (https://cse.engin.umich.edu/about/resources/connection-attempts/)
6 entries · version 20261014
First 5 entries
141.212.120.0/24141.212.121.0/24141.212.122.0/24141.212.123.0/24141.212.124.0/24covid
Maintained using different lists (such as Jaime Blasco's and Krassimir's lists).
319 entries · version 20200423
First 5 entries
3d.nicovideo.jpaatishb.comaccount.nicovideo.jpads.nicovideo.jpagainstcovid19.comvisionheight-scanning
Published source ranges of the internet-wide scanning organisation VisionHeight (visionheight.com), as tracked by https://github.com/OpenFilters/internet-scanners
210 entries · version 20261014
First 5 entries
100.28.153.226/32100.49.117.77/32100.50.17.159/3213.58.100.25/3213.58.208.166/32xmco-scanning
Published source ranges of the internet-wide scanning organisation XMCO Serenety (xmco.fr), as tracked by https://github.com/OpenFilters/internet-scanners
44 entries · version 20261014
First 5 entries
163.172.109.18/32163.172.99.21/32163.172.99.35/32163.172.99.60/32163.172.99.85/32zern-scanning
Published source ranges of the internet-wide scanning organisation ZERN (zern.io), as tracked by https://github.com/OpenFilters/internet-scanners
130 entries · version 20261014
First 5 entries
101.36.106.47/32101.36.119.4/32101.36.122.155/32101.36.122.89/32103.210.21.32/32zoomeye-scanning
Published source ranges of the internet-wide scanning organisation ZoomEye (zoomeye.ai), as tracked by https://github.com/OpenFilters/internet-scanners
13 entries · version 20261014
First 5 entries
148.153.188.246/32148.153.188.254/32148.153.189.62/32148.153.56.170/32148.153.56.174/32No warning lists match your search. Try fewer terms or reset the filters.
Generated from misp-warninglists · revision 154896d7bf00. Entry counts include duplicates across lists.
In MISP, open Warninglists under Input Filters, update the lists, and enable those relevant to your organisation. Review matches alongside the event’s context before deciding how to use an indicator.
Download catalogue metadata · Read the warning-list documentation · Contribute a warning list
© MISP project. Software released under approved open source licenses and content of this website released as CC BY-SA 3.0.
Template by Bootstrapious. Ported to Hugo by DevCows.