Browse Lists

Published source ranges of the internet-wide scanning organisation 360 Quake (quake.360.net), as tracked by https://git…

Published source ranges of the internet-wide scanning organisation A10 Networks (a10protects.com / a10networks.com), as…

Published source ranges of the internet-wide scanning organisation Academy for Internet Research (academyforinternetres…

Published source ranges of the internet-wide scanning organisation Adscore (adscore.com), as tracked by https://github.…

List containing IP ranges associated with Alpha Strike Labs scanning infrastructure. Alpha Strike Labs GmbH (AS208843) …

List containing IP's associated with the Alphastrike research scanners. This scanner CIDR range is extracted from CIRCL…

Published source ranges of the internet-wide scanning organisation BinaryEdge (binaryedge.io / binaryedge.ninja), as tr…

Published source ranges of the internet-wide scanning organisation BitSight Technologies Inc. / Internet Census Group (…

List containing IP's associated with the Bufferover scanners. This scanner CIDR range is extracted from CIRCL Network T…

Published source ranges of the internet-wide scanning organisation bufferover.run / erbbysam (bufferover.run), as track…

Hostnames used by different desktop and mobile device operating systems for captive portal detection as documented by t…

List containing IP's associated with Censys scanning [https://support.censys.io/hc/en-us/articles/360043177092-Opt-Out-…

CIRCL IP address to conducting non-intrusive security scans on Luxembourg IP addresses

CIRCL IP address to conducting non-intrusive SSH scans

Umbrella blockpage hostnames

Cisco Umbrella blockpage in IPv4

Cisco Umbrella blockpage in IPv6

List containing IP's associated with the Coalition signals intelligence scanners. This scanner CIDR range is extracted …

A list of commonly used abuse and contact e-mail addresses, including the ones denoted in RFC2142.

The Cyber Threat Coalition's whitelist of COVID-19 related websites.

Krassimir's Covid-19 whitelist of known good Covid-19 related websites.

Published source ranges of the internet-wide scanning organisation Criminal IP / AiSpera (criminalip.com / aispera.com)…

Domains that belongs to CRL or OCSP

IP addresses that belongs to CRL or OCSP

Published source ranges of the internet-wide scanning organisation CrowdStrike Falcon Surface (crowdstrike.com), as tra…

Published source ranges of the internet-wide scanning organisation CyberCube (cybcube.com), as tracked by https://githu…

Published source ranges of the internet-wide scanning organisation CyberGreen Institute (cybergreen.net), as tracked by…

List containing IP's associated with the Cybergreen scanners. This scanner CIDR range is extracted from CIRCL Network T…

Published source ranges of the internet-wide scanning organisation CyberOK (cyberok.ru), as tracked by https://github.c…

Published source ranges of the internet-wide scanning organisation CyberResilience (cyberresilience.io), as tracked by …

List containing IP's associated with the Cyberresilience scanners. This scanner CIDR range is extracted from CIRCL Netw…

Published source ranges of the internet-wide scanning organisation Cyble ODIN (odin.io), as tracked by https://github.c…

Published source ranges of the internet-wide scanning organisation Cypex (cypex.ai), as tracked by https://github.com/O…

List containing IP's associated with the Cypex scanners. This scanner CIDR range is extracted from CIRCL Network Telesc…

Published source ranges of the internet-wide scanning organisation Dataplane.org (dataplane.org), as tracked by https:/…

Published source ranges of the internet-wide scanning organisation Detectify (detectify.com), as tracked by https://git…

Published source ranges of the internet-wide scanning organisation Edgewatch Security Intelligence (edgewatch.com), as …

Published source ranges of the internet-wide scanning organisation ESET Research (eset.com), as tracked by https://gith…

List containing IP's associated with the F6 scanners. This scanner CIDR range is extracted from CIRCL Network Telescope…

Fingerprint of known intermediate of trusted certificates taken from Mozilla's lists at https://wiki.mozilla.org/CA

Fingerprint of trusted CA certificates taken from Mozilla's lists at https://wiki.mozilla.org/CA

Published source ranges of the internet-wide scanning organisation FOFA Search Engine (fofa.info), as tracked by https:…

Cached Chrome Top Million Websites - top 1 million

Published source ranges of the internet-wide scanning organisation Group-IB (rnd.group-ib.com), as tracked by https://g…

Published source ranges of the internet-wide scanning organisation Hacker Target Pty Ltd (hackertarget.com / hackertarg…

Published source ranges of the internet-wide scanning organisation Hadrian (hdrn.nu / hadrian.io), as tracked by https:…

Hashes that are often included in IOC lists but are false positives.

Published source ranges of the internet-wide scanning organisation Hunter Search Engine (hunter.how / hunter.qianxin.co…

Published source ranges of the internet-wide scanning organisation Infrawatch (infrawat.ch / infrawatch.com / infrawatc…

List containing IP's associated with the Internet census scanners. This scanner CIDR range is extracted from CIRCL Netw…

Published source ranges of the internet-wide scanning organisation Internet Measurement Research (internetmeasurementre…

Published source ranges of the internet-wide scanning organisation Internet Metrics (internet-metrics.com), as tracked …

Published source ranges of the internet-wide scanning organisation Internet Research Project (internet-research-project…

Published source ranges of the internet-wide scanning organisation InterneTTL (internettl.org), as tracked by https://g…

Published source ranges of the internet-wide scanning organisation Intrinsec (intrinsec.com), as tracked by https://git…

List containing IP's associated with the Intrinsec scanners. This scanner CIDR range is extracted from CIRCL Network Te…

Published source ranges of the internet-wide scanning organisation Intruder (intruder.io), as tracked by https://github…

Published source ranges of the internet-wide scanning organisation IPinfo Internet Census Data Collection (ipinfo.io), …

List containing IP's associated with the Ipinfo scanners. This scanner CIDR range is extracted from CIRCL Network Teles…

Published source ranges of the internet-wide scanning organisation IPIP (ipip.net), as tracked by https://github.com/Op…

List containing IP's associated with the Ipip scanners. This scanner CIDR range is extracted from CIRCL Network Telesco…

Published source ranges of the internet-wide scanning organisation KI3 (ki3.org.cn), as tracked by https://github.com/O…

Published source ranges of the internet-wide scanning organisation Knoq (knoq.nl), as tracked by https://github.com/Ope…

Published source ranges of the internet-wide scanning organisation LeakIX (leakix.org / leakix.net), as tracked by http…

List of Azure Application IDs (https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/verify-first-party…

List of disposable email domains

Event contains one or more entries based on hashes for EICAR test virus

Event contains one or more entries part of the IPv6 link local prefix (RFC 4291)

Akamai IP ranges from BGP search

Alibaba Cloud (Aliyun) IPv4 and IPv6 ranges, from the prefixes its verified autonomous systems announce, read live from…

Amazon AWS IP address ranges (https://ip-ranges.amazonaws.com/ip-ranges.json)

Hosts that Apple products need to access on enterprise networks, merged from Apple's support article (https://support.a…

IP ranges assigned to Apple

Apple IPv4 ranges announced by AS714 and AS6185

Apple IPv6 ranges announced by AS714 and AS6185

Event contains one or more entries of known banking website

List of known Bunny.net CDN IP ranges (https://support.bunny.net/hc/en-us/articles/115003578911-How-to-detect-when-Bunn…

CacheFly IP address ranges (https://cachefly.cachefly.net/ips/cdn.txt)

CDN77 IP address ranges (https://prefixlists.tools.cdn77.com/public_lmax_prefixes.json)

check-host IP addresses (https://check-host.net/nodes/ips)

List of known Cloudflare IP ranges (https://www.cloudflare.com/ips/)

CoreWeave IP address ranges, from the prefixes announced by the autonomous systems held by CoreWeave, Inc (AS33425, AS4…

Event contains one or more entries of known dax30 webpages

DigitalOcean IP address ranges, from their published RFC 8805 geofeed (https://digitalocean.com/geo/google.csv)

Event contains one or more entries of known 'what's my ip' domains

Domains used by automated malware analysis services & security vendors

Driftnet / Internet-Measurement IP address ranges (https://internet-measurement.com/)

Event contains one or more entries of known dynamic DNS domains.

Fastly IP address ranges (https://api.fastly.com/public-ip-list)

Gcore CDN IP address ranges (https://api.gcore.com/cdn/public-net-list)

GCP (Google Cloud Platform) IP address ranges (https://www.gstatic.com/ipranges/cloud.json)

GitHub IP address ranges (https://api.github.com/meta)

List of known Gmail sending IP ranges (https://support.google.com/a/answer/27642?hl=en)

GoDaddy IP address ranges, collected from the prefixes announced by the autonomous systems of GoDaddy.com, LLC and GoDa…

Google Bot IP address ranges (https://developers.google.com/search/apis/ipranges/googlebot.json)

Event contains one or more entries of known google domains, merged from Google's own supported_domains list, the nicksp…

Event contains one or more benign files based on known hashes, see https://github.com/RichieB2B/nioc

Event contains one or more entries of empty files based on known hashed

List of known Windows binaries based on hashes from winbindex (https://github.com/m417z/winbindex)

Event contains one or more entries with common false-positives

Hetzner Online GmbH IP address ranges, from their published RFC 8805 geofeed (https://www.hetzner.com/geofeed.csv). Thi…

Event contains one or more entries of known hostname querying your source IP.

Huawei Cloud IP address ranges, from the RFC 8805 geofeed Huawei publishes for its cloud regions (https://res-static.hc…

IBM Cloud (ex-SoftLayer) IP address ranges, from the prefixes announced by its autonomous systems AS36351, AS46702, AS4…

iCloud Private Relay egress IP address ranges (https://developer.apple.com/support/prepare-your-network-for-icloud-priv…

Imperva (Incapsula) IP address ranges (https://my.imperva.com/api/integration/v1/ips)

OpenAI gptbot crawler (https://openai.com/gptbot.json)

Palo Alto Networks Cortex Xpanse (https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity)

Event contains one or more public IPv4 DNS resolvers as attribute with an IDS flag set

Event contains one or more public IPv6 DNS resolvers as attribute with an IDS flag set

Leaseweb IP address ranges, from the prefixes announced by the autonomous systems held by the Leaseweb group, as report…

Event contains one or more entries of known Link in bio domains. Those shorten links are a reference to a list of links.

Linode (Akamai Connected Cloud) IP address ranges, from their published RFC 8805 geofeed (https://geoip.linode.com/)

Microsoft Azure China Datacenter IP Ranges

Microsoft Azure Datacenter IP Ranges

Microsoft Azure Germany Datacenter IP Ranges

Microsoft Azure US Government Cloud Datacenter IP Ranges

Microsoft Defender for Cloud Apps (MDCA/MCAS) hostnames (https://learn.microsoft.com/en-us/defender-cloud-apps/troubles…

Event contains one or more entries of known microsoft domains

Office 365 URLs and IP address ranges used for their attack simulator in Office 365 Threat Intelligence

Office 365 IP address ranges

Office 365 IP address ranges in China

Office 365 URLs and IP address ranges

Oracle Cloud Infrastructure (OCI) IP address ranges (https://docs.oracle.com/en-us/iaas/Content/General/Concepts/addres…

OVH Cluster IP address (https://docs.ovhcloud.com/en/guides/web-cloud/web-hosting/clusters-and-shared-hosting-ip)

Palo Alto Cortex Cloud IP address ranges (https://docs.ovhcloud.com/en/guides/web-cloud/web-hosting/clusters-and-shared…

Event contains one or more public DNS resolvers (expressed as hostname) as attribute with an IDS flag set

Event contains one or more entries of known public IPFS gateways

Rackspace IP address ranges, from the prefixes announced by the Rackspace autonomous systems (RIPEstat announced-prefix…

Salesforce IP address ranges, from their published ip-ranges endpoint (https://ip-ranges.salesforce.com/ip-ranges.json)…

Scaleway (formerly Online SAS) IP address ranges, from the ranges Scaleway documents itself (https://www.scaleway.com/e…

Event contains one or more entries of known security providers/vendors blog domain with an IDS flag set

List of known sinkholes

List of IP addresses for known SMTP servers.

List of IP ranges for known SMTP servers.

Empty: StackPath wound down its CDN and the generator's only source (https://k3t9x2h3.map2.ssl.hwcdn.net/ipblocks.txt) …

Sucuri Website Firewall IP address ranges, scraped from https://docs.sucuri.net/website-firewall/sucuri-firewall-troubl…

Telegram IP address ranges (https://core.telegram.org/resources/cidr.txt)

Tenable IPv4 Cloud Sensor addresses used for scanning Internet-facing infrastructure

Tenable IPv6 Cloud Sensor addresses used for scanning Internet-facing infrastructure

Tencent Cloud IP address ranges, from the prefixes announced by Tencent's autonomous systems as reported by the RIPEsta…

Specialized list of IPv4 addresses belonging to Tor exit nodes, from https://github.com/X4BNet/lists_torexit

Event contains one or more entries of known Shorteners domains

Vultr (Constant Company, LLC) IP address ranges, from their published RFC 8805 geofeed (https://geofeed.constant.com/).…

Wikimedia address ranges (https://wikitech.wikimedia.org/w/api.php?action=parse&page=IP_and_AS_allocations&format=json&…

Event contains one or more entries of known Windows 10 connection endpoints (https://docs.microsoft.com/en-us/windows/p…

Event contains one or more entries of known Windows 11 connection endpoints (https://learn.microsoft.com/en-us/windows/…

Zscaler IP address ranges (https://config.zscaler.com/api/zscaler.net/hubs/cidr/json/recommended)

List of popular legitimate domains from LOTS (Living Off Trusted Sites) Project used to conduct phishing, C&C, exfiltra…

Internet Cleanup Foundation scaninfo (https://internetcleanup.foundation/scaninfo/)

Modat Scanner (https://www.modat.io/)

Onyphe Scanner (https://www.onyphe.io/)

Event contains one or more entries part of the private network CIDR blocks (RFC 1918)

Event contains one or more entries part of the IPv6 documentation prefix (RFC 3849)

Event contains one or more entries part of the Special Use IPv4 Addresses CIDR blocks (RFC 5735)

Event contains one or more entries part of the RFC 5771 multicast CIDR blocks

Event contains one or more entries part of the Shared Address Space CIDR blocks (RFC 6598)

Event contains one or more entries part of the Special-Use Domain Names (RFC 6761)

Published source ranges of the internet-wide scanning organisation Mandiant ASM / GTI (mandiant.com), as tracked by htt…

List containing IP's associated with the Modat scanners. This scanner CIDR range is extracted from CIRCL Network Telesc…

Published source ranges of the internet-wide scanning organisation Netlas (netlas.io), as tracked by https://github.com…

Published source ranges of the internet-wide scanning organisation NETSCOUT (internet-albedo.net), as tracked by https:…

List of NetSecScan.net scanners

List containing IP's associated with the Netsecscan scanners. This scanner CIDR range is extracted from CIRCL Network T…

Published source ranges of the internet-wide scanning organisation Nokia Deepfield (deepfield.net), as tracked by https…

Published source ranges of the internet-wide scanning organisation ONLYSCANS (onlyscans.com / onlyscans.net), as tracke…

List containing IP's associated with the Onyphe scanners. This scanner CIDR range is extracted from CIRCL Network Teles…

OSINT DigitalSide Threat-Intel Repository - MISP Warninglist - List of domains should be marked as false positive in th…

List of parking domain's ip adresses

List of parking domain's name server

Published source ranges of the internet-wide scanning organisation pocnroll (pocnroll.com), as tracked by https://githu…

List containing IP's associated with the Probethenet scanners. This scanner CIDR range is extracted from CIRCL Network …

Published source ranges of the internet-wide scanning organisation ProbeTheNet Project / mThreat Technology Inc. (probe…

List containing IP's associated with the Rapid7 scanners. This scanner CIDR range is extracted from CIRCL Network Teles…

Published source ranges of the internet-wide scanning organisation Rapid7 Project Sonar (rapid7.com), as tracked by htt…

Published source ranges of the internet-wide scanning organisation Recorded Future / SecurityTrails (securitytrails.com…

Published source ranges of the internet-wide scanning organisation Recyber (recyber.net), as tracked by https://github.…

List containing IP's associated with the Research scanner scanners. This scanner CIDR range is extracted from CIRCL Net…

Published source ranges of the internet-wide scanning organisation Research Scanner (research-scanner.com), as tracked …

Published source ranges of the internet-wide scanning organisation Root Evidence (rootevidence.com), as tracked by http…

Published source ranges of the internet-wide scanning organisation Scanners from various universities, as tracked by ht…

Event contains one or more second level TLDs as attribute with an IDS flag set.

Published source ranges of the internet-wide scanning organisation securityresearch.net, as tracked by https://github.c…

List of shadowforce.io scanners

List containing IP's associated with the Shadowforce scanners. This scanner CIDR range is extracted from CIRCL Network …

List of Shadowserver IP-Ranges. Potentially associated with Shadowserver scans. based on [https://bgp.he.net/search?sea…

List containing IP's associated with the Shadowserver scanners. This scanner CIDR range is extracted from CIRCL Network…

List of Shodan.io scanners

List containing IP's associated with the Shodan scanners. This scanner CIDR range is extracted from CIRCL Network Teles…

List containing IP's associated with the Skipa scanners. This scanner CIDR range is extracted from CIRCL Network Telesc…

Specialized list of vpn-ipv4 addresses belonging to common VPN providers and datacenters

Specialized list of vpn-ipv6 addresses belonging to common VPN providers and datacenters

List containing IP's associated with the Stretchoid scanners. This scanner CIDR range is extracted from CIRCL Network T…

Published source ranges of the internet-wide scanning organisation Stretchoid (stretchoid.com), as tracked by https://g…

Published source ranges of the internet-wide scanning organisation Tenable ASM (tenable.com / tenable.io), as tracked b…

Event contains one or more TLDs as attribute with an IDS flag set

List of top 1,000,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking…

Event contains one or more entries from the top 1,000,000 most-used sites (https://tranco-list.eu/).

Event contains one or more entries from the top 1 000 000 of the most used websites (Cisco Umbrella).

List of top 100,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-d…

List of top 10,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-da…

Event contains one or more entries from the top 10 000 of the most used websites (Cisco Umbrella).

Event contains one or more entries from the top 10000 of the most used websites (Majestic Million).

List of top 1,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-dat…

Event contains one or more entries from the top 1000 of the most used website (Alexa).

Event contains one or more entries from the top 1000 of the most used websites (Cisco Umbrella).

Event contains one or more entries from the top 10K most-used sites (https://tranco-list.eu/).

List of top 200,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-d…

List of top 20,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-da…

Event contains one or more entries from the top 20 000 of the most used websites (Cisco Umbrella).

List of top 2,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-dat…

List of top 200 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datas…

List of top 500,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-d…

List of top 50,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-da…

List of top 5,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-dat…

Event contains one or more entries from the top 5000 of the most used websites (Cisco Umbrella).

Event contains one or more entries from the top 500 of the most used domains from Moz.

Numbers that cannot be attributed because they reserved for different purposes.

List of University domains from https://raw.githubusercontent.com/Hipo/university-domains-list/master/world_universitie…

University of Michigan Computer Science and Engineering connection attempts page (https://cse.engin.umich.edu/about/res…

Maintained using different lists (such as Jaime Blasco's and Krassimir's lists).

Published source ranges of the internet-wide scanning organisation VisionHeight (visionheight.com), as tracked by https…

Published source ranges of the internet-wide scanning organisation XMCO Serenety (xmco.fr), as tracked by https://githu…

Published source ranges of the internet-wide scanning organisation ZERN (zern.io), as tracked by https://github.com/Ope…

Published source ranges of the internet-wide scanning organisation ZoomEye (zoomeye.ai), as tracked by https://github.c…