MISP Warning Lists

Put your indicators in context

Explore all the warning lists in misp-warninglists. These lists identify indicators that may be known, benign, or potential false positives, such as public DNS resolvers, private networks, popular domains, and internet scanners.

Search by name or description and filter by match type or MISP attribute type. Each card includes the list version, entry count, matching attributes, examples, and links to the complete source and JSON definition. ALL means a list applies to every attribute type.

A match provides context for analysis; it does not establish that an indicator is harmless. This catalogue describes upstream lists. The lists enabled in your own MISP instance depend on its configuration.

227 warning lists · 6,455,671 entries across lists

cidr · known

360 Quake (quake.360.net) IP ranges used for scanning

quake-scanning

Published source ranges of the internet-wide scanning organisation 360 Quake (quake.360.net), as tracked by https://github.com/OpenFilters/internet-scanners

503 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 1.192.192.4/32
  • 1.192.192.6/32
  • 1.192.192.8/32
  • 1.192.195.11/32
  • 1.192.195.5/32
View source for 360 Quake (quake.360.net) IP ranges used for scanningFull JSON for 360 Quake (quake.360.net) IP ranges used for scanning
cidr · known

A10 Networks (a10protects.com / a10networks.com) IP ranges used for scanning

a10networks-scanning

Published source ranges of the internet-wide scanning organisation A10 Networks (a10protects.com / a10networks.com), as tracked by https://github.com/OpenFilters/internet-scanners

658 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 103.29.68.220/32
  • 103.3.63.60/32
  • 104.200.21.21/32
  • 104.200.30.136/32
  • 104.200.30.247/32
View source for A10 Networks (a10protects.com / a10networks.com) IP ranges used for scanningFull JSON for A10 Networks (a10protects.com / a10networks.com) IP ranges used for scanning
cidr · known

Academy for Internet Research (academyforinternetresearch.org) IP ranges used for scanning

academyforinternetresearch-scanning

Published source ranges of the internet-wide scanning organisation Academy for Internet Research (academyforinternetresearch.org), as tracked by https://github.com/OpenFilters/internet-scanners

62 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 104.156.155.0/24
  • 104.237.151.205/32
  • 139.162.119.12/32
  • 139.162.119.146/32
  • 139.162.119.196/32
View source for Academy for Internet Research (academyforinternetresearch.org) IP ranges used for scanningFull JSON for Academy for Internet Research (academyforinternetresearch.org) IP ranges used for scanning
cidr · known

Adscore (adscore.com) IP ranges used for scanning

adscore-scanning

Published source ranges of the internet-wide scanning organisation Adscore (adscore.com), as tracked by https://github.com/OpenFilters/internet-scanners

15 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 185.200.118.32/32
  • 185.200.118.34/31
  • 185.200.118.36/30
  • 185.200.118.40/29
  • 185.200.118.48/29
View source for Adscore (adscore.com) IP ranges used for scanningFull JSON for Adscore (adscore.com) IP ranges used for scanning
cidr · known

Alpha Strike Labs IP Ranges Used for Scanning

alphastrike-scanning

List containing IP ranges associated with Alpha Strike Labs scanning infrastructure. Alpha Strike Labs GmbH (AS208843) operates legitimate security research and internet-wide scanning services [https://ipinfo.io/AS208843]

5 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-dst|port, ip-src|port

First 5 entries

  • 158.94.187.0/24
  • 158.94.218.0/24
  • 194.187.176.0/22
  • 2a0e:7b84::/30
  • 45.83.64.0/22
View source for Alpha Strike Labs IP Ranges Used for ScanningFull JSON for Alpha Strike Labs IP Ranges Used for Scanning
cidr · known

Alphastrike research IP Ranges Used for Scanning

alphastrike-research-nt-scanning

List containing IP's associated with the Alphastrike research scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08

22 entries · version 26100813

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-dst|port, ip-src|port

First 5 entries

  • 194.187.176.1/32
  • 194.187.176.128/25
  • 194.187.176.16/28
  • 194.187.176.2/31
  • 194.187.176.32/27
View source for Alphastrike research IP Ranges Used for ScanningFull JSON for Alphastrike research IP Ranges Used for Scanning
cidr · known

BinaryEdge (binaryedge.io / binaryedge.ninja) IP ranges used for scanning

binaryedge-scanning

Published source ranges of the internet-wide scanning organisation BinaryEdge (binaryedge.io / binaryedge.ninja), as tracked by https://github.com/OpenFilters/internet-scanners

12,972 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 100.20.118.33/32
  • 100.20.138.123/32
  • 100.20.153.121/32
  • 100.20.177.21/32
  • 100.20.181.236/32
View source for BinaryEdge (binaryedge.io / binaryedge.ninja) IP ranges used for scanningFull JSON for BinaryEdge (binaryedge.io / binaryedge.ninja) IP ranges used for scanning
cidr · known

BitSight Technologies Inc. / Internet Census Group (bitsight.com / internet-census.org) IP ranges used for scanning

bitsight-scanning

Published source ranges of the internet-wide scanning organisation BitSight Technologies Inc. / Internet Census Group (bitsight.com / internet-census.org), as tracked by https://github.com/OpenFilters/internet-scanners

6 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 109.105.208.0/21
  • 185.117.225.0/24
  • 185.180.140.0/22
  • 185.226.196.0/22
  • 2a10:3c0::/29
View source for BitSight Technologies Inc. / Internet Census Group (bitsight.com / internet-census.org) IP ranges used for scanningFull JSON for BitSight Technologies Inc. / Internet Census Group (bitsight.com / internet-census.org) IP ranges used for scanning
cidr · known

Bufferover IP Ranges Used for Scanning

bufferover-nt-scanning

List containing IP's associated with the Bufferover scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08

31 entries · version 26100813

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-dst|port, ip-src|port

First 5 entries

  • 139.144.235.132/32
  • 139.144.239.72/32
  • 139.144.239.74/32
  • 162.216.18.113/32
  • 170.187.163.117/32
View source for Bufferover IP Ranges Used for ScanningFull JSON for Bufferover IP Ranges Used for Scanning
cidr · known

bufferover.run / erbbysam (bufferover.run) IP ranges used for scanning

bufferoverrun-scanning

Published source ranges of the internet-wide scanning organisation bufferover.run / erbbysam (bufferover.run), as tracked by https://github.com/OpenFilters/internet-scanners

48 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 139.144.235.132/32
  • 139.144.239.72/32
  • 139.144.239.74/32
  • 162.216.18.113/32
  • 170.187.163.117/32
View source for bufferover.run / erbbysam (bufferover.run) IP ranges used for scanningFull JSON for bufferover.run / erbbysam (bufferover.run) IP ranges used for scanning
string

Captive Portal Detection Hostnames

captive-portals

Hostnames used by different desktop and mobile device operating systems for captive portal detection as documented by the Wireless Broadband Alliance.

21 entries · version 20230130

List details
Matching attributes
hostname, domain, url, domain|ip

First 5 entries

  • android.clients.google.com
  • apple.com
  • captive.apple.com
  • clients3.google.com
  • clients4.google.com
View source for Captive Portal Detection HostnamesFull JSON for Captive Portal Detection Hostnames
cidr · known

Censys IP Ranges Used for Scanning

censys-scanning

List containing IP's associated with Censys scanning [https://support.censys.io/hc/en-us/articles/360043177092-Opt-Out-of-Data-Collection#Can_I_opt_out_of_Censys_data_collection?]

23 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-dst|port, ip-src|port

First 5 entries

  • 162.142.125.0/24
  • 167.248.133.0/24
  • 167.94.138.0/24
  • 167.94.145.0/24
  • 167.94.146.0/24
View source for Censys IP Ranges Used for ScanningFull JSON for Censys IP Ranges Used for Scanning
cidr · known

Coalition signals intelligence IP Ranges Used for Scanning

coalition-signals-intelligence-nt-scanning

List containing IP's associated with the Coalition signals intelligence scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/08/10

1,307 entries · version 26081011

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-dst|port, ip-src|port

First 5 entries

  • 100.20.177.21/32
  • 100.21.51.20/32
  • 100.22.0.89/32
  • 100.22.234.236/32
  • 104.237.139.124/32
View source for Coalition signals intelligence IP Ranges Used for ScanningFull JSON for Coalition signals intelligence IP Ranges Used for Scanning
cidr · known

Criminal IP / AiSpera (criminalip.com / aispera.com) IP ranges used for scanning

criminalip-scanning

Published source ranges of the internet-wide scanning organisation Criminal IP / AiSpera (criminalip.com / aispera.com), as tracked by https://github.com/OpenFilters/internet-scanners

1 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 1 entries

  • 185.242.226.0/24
View source for Criminal IP / AiSpera (criminalip.com / aispera.com) IP ranges used for scanningFull JSON for Criminal IP / AiSpera (criminalip.com / aispera.com) IP ranges used for scanning
string

CRL and OCSP domains

crl-hostname

Domains that belongs to CRL or OCSP

220 entries · version 20261005

List details
Matching attributes
hostname, domain, domain|ip

First 5 entries

  • br-root-ca1-2020.ocsp.d-trust.net
  • c.pki.goog
  • cdn.d-trust-cloudcrl.net
  • cdp-ldap.intranet.eon.com
  • cdp.disig.sk
View source for CRL and OCSP domainsFull JSON for CRL and OCSP domains
cidr · known

CrowdStrike Falcon Surface (crowdstrike.com) IP ranges used for scanning

crowdstrikefalconsurface-scanning

Published source ranges of the internet-wide scanning organisation CrowdStrike Falcon Surface (crowdstrike.com), as tracked by https://github.com/OpenFilters/internet-scanners

6 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 18.97.19.128/25
  • 18.97.26.0/24
  • 18.97.5.0/25
  • 44.220.185.0/24
  • 44.220.188.0/24
View source for CrowdStrike Falcon Surface (crowdstrike.com) IP ranges used for scanningFull JSON for CrowdStrike Falcon Surface (crowdstrike.com) IP ranges used for scanning
cidr · known

CyberCube (cybcube.com) IP ranges used for scanning

cybcube-scanning

Published source ranges of the internet-wide scanning organisation CyberCube (cybcube.com), as tracked by https://github.com/OpenFilters/internet-scanners

5 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 66.240.223.214/32
  • 66.240.223.240/32
  • 66.240.236.109/32
  • 66.240.236.116/32
  • 71.6.199.87/32
View source for CyberCube (cybcube.com) IP ranges used for scanningFull JSON for CyberCube (cybcube.com) IP ranges used for scanning
cidr · known

CyberGreen Institute (cybergreen.net) IP ranges used for scanning

cybergreen-scanning

Published source ranges of the internet-wide scanning organisation CyberGreen Institute (cybergreen.net), as tracked by https://github.com/OpenFilters/internet-scanners

1 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 1 entries

  • 52.73.169.169/32
View source for CyberGreen Institute (cybergreen.net) IP ranges used for scanningFull JSON for CyberGreen Institute (cybergreen.net) IP ranges used for scanning
cidr · known

CyberResilience (cyberresilience.io) IP ranges used for scanning

cyberresilience-scanning

Published source ranges of the internet-wide scanning organisation CyberResilience (cyberresilience.io), as tracked by https://github.com/OpenFilters/internet-scanners

15 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 104.248.206.108/32
  • 143.198.115.76/32
  • 159.223.217.240/32
  • 159.89.1.53/32
  • 161.35.108.63/32
View source for CyberResilience (cyberresilience.io) IP ranges used for scanningFull JSON for CyberResilience (cyberresilience.io) IP ranges used for scanning
cidr · known

Cyberresilience IP Ranges Used for Scanning

cyberresilience-nt-scanning

List containing IP's associated with the Cyberresilience scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08

14 entries · version 26100813

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-dst|port, ip-src|port

First 5 entries

  • 104.248.206.108/32
  • 137.184.75.34/32
  • 137.184.78.203/32
  • 138.68.73.85/32
  • 142.93.49.93/32
View source for Cyberresilience IP Ranges Used for ScanningFull JSON for Cyberresilience IP Ranges Used for Scanning
cidr · known

Cyble ODIN (odin.io) IP ranges used for scanning

odin-scanning

Published source ranges of the internet-wide scanning organisation Cyble ODIN (odin.io), as tracked by https://github.com/OpenFilters/internet-scanners

484 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 104.248.122.5/32
  • 104.248.138.26/32
  • 104.248.20.160/32
  • 104.248.22.153/32
  • 104.248.23.98/32
View source for Cyble ODIN (odin.io) IP ranges used for scanningFull JSON for Cyble ODIN (odin.io) IP ranges used for scanning
cidr · known

Cypex (cypex.ai) IP ranges used for scanning

cypex-scanning

Published source ranges of the internet-wide scanning organisation Cypex (cypex.ai), as tracked by https://github.com/OpenFilters/internet-scanners

21 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 18.117.57.162/32
  • 18.190.163.148/32
  • 18.217.194.148/32
  • 18.221.137.47/32
  • 18.223.104.85/32
View source for Cypex (cypex.ai) IP ranges used for scanningFull JSON for Cypex (cypex.ai) IP ranges used for scanning
cidr · known

Cypex IP Ranges Used for Scanning

cypex-nt-scanning

List containing IP's associated with the Cypex scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/04/09

10 entries · version 26040915

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-dst|port, ip-src|port

First 5 entries

  • 18.117.57.162/32
  • 18.190.163.148/32
  • 18.217.194.148/32
  • 18.221.137.47/32
  • 18.223.104.85/32
View source for Cypex IP Ranges Used for ScanningFull JSON for Cypex IP Ranges Used for Scanning
cidr · known

Dataplane.org (dataplane.org) IP ranges used for scanning

dataplane-scanning

Published source ranges of the internet-wide scanning organisation Dataplane.org (dataplane.org), as tracked by https://github.com/OpenFilters/internet-scanners

4 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 4 entries

  • 204.130.133.143/32
  • 204.130.133.193/32
  • 2607:fae0:f202:44c::143/128
  • 2607:fae0:f202:44c::193/128
View source for Dataplane.org (dataplane.org) IP ranges used for scanningFull JSON for Dataplane.org (dataplane.org) IP ranges used for scanning
cidr · known

Detectify (detectify.com) IP ranges used for scanning

detectify-scanning

Published source ranges of the internet-wide scanning organisation Detectify (detectify.com), as tracked by https://github.com/OpenFilters/internet-scanners

11 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 107.20.158.220/32
  • 13.126.5.12/32
  • 3.234.180.95/32
  • 3.7.157.159/32
  • 3.7.173.162/32
View source for Detectify (detectify.com) IP ranges used for scanningFull JSON for Detectify (detectify.com) IP ranges used for scanning
cidr · known

Edgewatch Security Intelligence (edgewatch.com) IP ranges used for scanning

edgewatch-scanning

Published source ranges of the internet-wide scanning organisation Edgewatch Security Intelligence (edgewatch.com), as tracked by https://github.com/OpenFilters/internet-scanners

1 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 1 entries

  • 185.114.175.0/24
View source for Edgewatch Security Intelligence (edgewatch.com) IP ranges used for scanningFull JSON for Edgewatch Security Intelligence (edgewatch.com) IP ranges used for scanning
cidr · known

ESET Research (eset.com) IP ranges used for scanning

eset-scanning

Published source ranges of the internet-wide scanning organisation ESET Research (eset.com), as tracked by https://github.com/OpenFilters/internet-scanners

1 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 1 entries

  • 142.93.146.198/32
View source for ESET Research (eset.com) IP ranges used for scanningFull JSON for ESET Research (eset.com) IP ranges used for scanning
string

Fingerprint of known intermediate of trusted certificates

mozilla-IntermediateCA

Fingerprint of known intermediate of trusted certificates taken from Mozilla's lists at https://wiki.mozilla.org/CA

7,701 entries · version 20261005

List details
Matching attributes
md5, sha1, sha256, filename|md5, filename|sha1, filename|sha256, x509-fingerprint-md5, x509-fingerprint-sha1, x509-fingerprint-sha256

First 5 entries

  • 0020d198028d12c73a2872376e24fbd73a39e39bf09338ac3b6495dd785df678
  • 002393fa0a6825f77ef686e208620b97177791f02f07db2518480fbe37ce7bd8
  • 00250c293689880075fe9a82715e602877d53b5e
  • 0029aecf433fc4c7c61ce2f20c66c557
  • 002e6d642c2ee639b40fbed1020ee7beedf2e521f9b2bde46c958d32e6353e9d
View source for Fingerprint of known intermediate of trusted certificatesFull JSON for Fingerprint of known intermediate of trusted certificates
string

Fingerprint of trusted CA certificates

mozilla-CA

Fingerprint of trusted CA certificates taken from Mozilla's lists at https://wiki.mozilla.org/CA

516 entries · version 20260811

List details
Matching attributes
md5, sha1, sha256, filename|md5, filename|sha1, filename|sha256, x509-fingerprint-md5, x509-fingerprint-sha1, x509-fingerprint-sha256

First 5 entries

  • 010c0695a6981914ffbf5fc6b0b695ea29e912a6
  • 018e13f0772532cf809bd1b17281867283fc48c6e13be9c69812854a490c1b05
  • 022d0582fa88ce140c0679de7f1410e945d7a56d
  • 02ed0eb28c14da45165c566791700d6451d7fb56f0b2ab1d3b8eb070e56edff5
  • 0552e6f83fdf65e8fa9670e666df28a4e21340b510cbe52566f97c4fb94b2bd1
View source for Fingerprint of trusted CA certificatesFull JSON for Fingerprint of trusted CA certificates
cidr · known

FOFA Search Engine (fofa.info) IP ranges used for scanning

fofa-scanning

Published source ranges of the internet-wide scanning organisation FOFA Search Engine (fofa.info), as tracked by https://github.com/OpenFilters/internet-scanners

318 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 101.36.106.109/32
  • 101.36.106.75/32
  • 101.36.107.46/32
  • 101.36.108.178/32
  • 101.36.108.184/32
View source for FOFA Search Engine (fofa.info) IP ranges used for scanningFull JSON for FOFA Search Engine (fofa.info) IP ranges used for scanning
cidr · known

Group-IB (rnd.group-ib.com) IP ranges used for scanning

groupib-scanning

Published source ranges of the internet-wide scanning organisation Group-IB (rnd.group-ib.com), as tracked by https://github.com/OpenFilters/internet-scanners

7 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 80.82.70.118/32
  • 80.82.70.133/32
  • 80.82.70.228/32
  • 80.82.77.202/32
  • 89.248.171.23/32
View source for Group-IB (rnd.group-ib.com) IP ranges used for scanningFull JSON for Group-IB (rnd.group-ib.com) IP ranges used for scanning
cidr · known

Hacker Target Pty Ltd (hackertarget.com / hackertarget.io) IP ranges used for scanning

hackertarget-scanning

Published source ranges of the internet-wide scanning organisation Hacker Target Pty Ltd (hackertarget.com / hackertarget.io), as tracked by https://github.com/OpenFilters/internet-scanners

3 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 3 entries

  • 143.198.179.104/32
  • 159.223.98.198/32
  • 198.211.109.100/32
View source for Hacker Target Pty Ltd (hackertarget.com / hackertarget.io) IP ranges used for scanningFull JSON for Hacker Target Pty Ltd (hackertarget.com / hackertarget.io) IP ranges used for scanning
cidr · known

Hadrian (hdrn.nu / hadrian.io) IP ranges used for scanning

hadrian-scanning

Published source ranges of the internet-wide scanning organisation Hadrian (hdrn.nu / hadrian.io), as tracked by https://github.com/OpenFilters/internet-scanners

7 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 145.220.91.19/32
  • 2001:67c:6ec:2913:145:220:91:19/128
  • 51.15.115.141/32
  • 51.15.44.6/32
  • 51.15.56.200/32
View source for Hadrian (hdrn.nu / hadrian.io) IP ranges used for scanningFull JSON for Hadrian (hdrn.nu / hadrian.io) IP ranges used for scanning
string

Hashes that are often included in IOC lists but are false positives.

ti-falsepositives

Hashes that are often included in IOC lists but are false positives.

24,645 entries · version 20251216

List details
Matching attributes
md5, sha1, sha256, filename|md5, filename|sha1, filename|sha256

First 5 entries

  • 00014cb6ebc0e2fb3f83dec061fc8ac1
  • 00040c682b12de3c33ef3a1839260d4851073c94ce49ab32ac38dbd13c16e1c2
  • 000b86c93a586d1055074acbb05d93bbfc548d9380663e140721938696b9ef84
  • 000d32692ba88d6938780304c28fdba7
  • 000f5b33c5eb8d847c173df5da504fcf4fff4ac07265e1b5efcbc9354f123a11
View source for Hashes that are often included in IOC lists but are false positives.Full JSON for Hashes that are often included in IOC lists but are false positives.
cidr · known

Hunter Search Engine (hunter.how / hunter.qianxin.com) IP ranges used for scanning

hunter-scanning

Published source ranges of the internet-wide scanning organisation Hunter Search Engine (hunter.how / hunter.qianxin.com), as tracked by https://github.com/OpenFilters/internet-scanners

3,521 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 101.200.243.197/32
  • 101.201.38.226/32
  • 106.15.238.36/32
  • 111.7.106.104/30
  • 111.7.96.149/32
View source for Hunter Search Engine (hunter.how / hunter.qianxin.com) IP ranges used for scanningFull JSON for Hunter Search Engine (hunter.how / hunter.qianxin.com) IP ranges used for scanning
cidr · known

Infrawatch (infrawat.ch / infrawatch.com / infrawatch.app) IP ranges used for scanning

infrawatch-scanning

Published source ranges of the internet-wide scanning organisation Infrawatch (infrawat.ch / infrawatch.com / infrawatch.app), as tracked by https://github.com/OpenFilters/internet-scanners

31 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 154.16.44.0/24
  • 185.216.145.160/27
  • 185.223.235.0/26
  • 188.240.59.0/26
  • 193.124.20.224/27
View source for Infrawatch (infrawat.ch / infrawatch.com / infrawatch.app) IP ranges used for scanningFull JSON for Infrawatch (infrawat.ch / infrawatch.com / infrawatch.app) IP ranges used for scanning
cidr · known

Internet census IP Ranges Used for Scanning

internet-census-nt-scanning

List containing IP's associated with the Internet census scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08

253 entries · version 26100813

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-dst|port, ip-src|port

First 5 entries

  • 109.105.209.10/32
  • 109.105.209.12/30
  • 109.105.209.17/32
  • 109.105.209.18/31
  • 109.105.209.2/31
View source for Internet census IP Ranges Used for ScanningFull JSON for Internet census IP Ranges Used for Scanning
cidr · known

Internet Measurement Research (internetmeasurementresearch.com) IP ranges used for scanning

internetmeasurementresearch-scanning

Published source ranges of the internet-wide scanning organisation Internet Measurement Research (internetmeasurementresearch.com), as tracked by https://github.com/OpenFilters/internet-scanners

10 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 209.188.108.0/24
  • 209.237.154.0/24
  • 2620:96:a000::/46
  • 2620:96:a004::/47
  • 2620:96:a006::/48
View source for Internet Measurement Research (internetmeasurementresearch.com) IP ranges used for scanningFull JSON for Internet Measurement Research (internetmeasurementresearch.com) IP ranges used for scanning
cidr · known

Internet Metrics (internet-metrics.com) IP ranges used for scanning

internetmetrics-scanning

Published source ranges of the internet-wide scanning organisation Internet Metrics (internet-metrics.com), as tracked by https://github.com/OpenFilters/internet-scanners

2 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 2 entries

  • 50.116.30.197/32
  • 96.126.112.111/32
View source for Internet Metrics (internet-metrics.com) IP ranges used for scanningFull JSON for Internet Metrics (internet-metrics.com) IP ranges used for scanning
cidr · known

Internet Research Project (internet-research-project.net) IP ranges used for scanning

internetresearchproject-scanning

Published source ranges of the internet-wide scanning organisation Internet Research Project (internet-research-project.net), as tracked by https://github.com/OpenFilters/internet-scanners

11 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 104.237.150.176/32
  • 104.237.151.244/32
  • 172.104.210.143/32
  • 172.104.211.111/32
  • 172.104.23.19/32
View source for Internet Research Project (internet-research-project.net) IP ranges used for scanningFull JSON for Internet Research Project (internet-research-project.net) IP ranges used for scanning
cidr · known

InterneTTL (internettl.org) IP ranges used for scanning

internettl-scanning

Published source ranges of the internet-wide scanning organisation InterneTTL (internettl.org), as tracked by https://github.com/OpenFilters/internet-scanners

1 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 1 entries

  • 104.152.52.0/24
View source for InterneTTL (internettl.org) IP ranges used for scanningFull JSON for InterneTTL (internettl.org) IP ranges used for scanning
cidr · known

Intrinsec (intrinsec.com) IP ranges used for scanning

intrinsec-scanning

Published source ranges of the internet-wide scanning organisation Intrinsec (intrinsec.com), as tracked by https://github.com/OpenFilters/internet-scanners

5 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 213.32.122.80/28
  • 46.105.132.32/27
  • 51.254.59.112/28
  • 51.38.12.12/30
  • 51.38.12.20/30
View source for Intrinsec (intrinsec.com) IP ranges used for scanningFull JSON for Intrinsec (intrinsec.com) IP ranges used for scanning
cidr · known

Intruder (intruder.io) IP ranges used for scanning

intruder-scanning

Published source ranges of the internet-wide scanning organisation Intruder (intruder.io), as tracked by https://github.com/OpenFilters/internet-scanners

36 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 13.115.104.128/25
  • 13.210.1.64/26
  • 13.213.79.0/24
  • 13.56.21.128/25
  • 13.59.252.0/25
View source for Intruder (intruder.io) IP ranges used for scanningFull JSON for Intruder (intruder.io) IP ranges used for scanning
cidr · known

IPinfo Internet Census Data Collection (ipinfo.io) IP ranges used for scanning

ipinfo-scanning

Published source ranges of the internet-wide scanning organisation IPinfo Internet Census Data Collection (ipinfo.io), as tracked by https://github.com/OpenFilters/internet-scanners

3,062 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 102.130.49.212/32
  • 102.164.61.103/32
  • 102.164.62.251/32
  • 102.177.72.174/32
  • 102.18.119.21/32
View source for IPinfo Internet Census Data Collection (ipinfo.io) IP ranges used for scanningFull JSON for IPinfo Internet Census Data Collection (ipinfo.io) IP ranges used for scanning
cidr · known

Ipinfo IP Ranges Used for Scanning

ipinfo-nt-scanning

List containing IP's associated with the Ipinfo scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08

15 entries · version 26100813

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-dst|port, ip-src|port

First 5 entries

  • 146.185.219.214/32
  • 146.185.248.89/32
  • 37.9.35.222/32
  • 5.188.133.153/32
  • 5.188.168.53/32
View source for Ipinfo IP Ranges Used for ScanningFull JSON for Ipinfo IP Ranges Used for Scanning
cidr · known

IPIP (ipip.net) IP ranges used for scanning

ipip-scanning

Published source ranges of the internet-wide scanning organisation IPIP (ipip.net), as tracked by https://github.com/OpenFilters/internet-scanners

55 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 103.16.130.243/32
  • 103.16.131.136/32
  • 103.203.56.0/22
  • 103.230.157.150/32
  • 103.29.69.181/32
View source for IPIP (ipip.net) IP ranges used for scanningFull JSON for IPIP (ipip.net) IP ranges used for scanning
cidr · known

Ipip IP Ranges Used for Scanning

ipip-nt-scanning

List containing IP's associated with the Ipip scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08

21 entries · version 26100813

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-dst|port, ip-src|port

First 5 entries

  • 103.203.56.0/32
  • 103.203.57.0/32
  • 103.203.57.13/32
  • 103.203.57.15/32
  • 103.203.57.16/31
View source for Ipip IP Ranges Used for ScanningFull JSON for Ipip IP Ranges Used for Scanning
cidr · known

KI3 (ki3.org.cn) IP ranges used for scanning

ki3-scanning

Published source ranges of the internet-wide scanning organisation KI3 (ki3.org.cn), as tracked by https://github.com/OpenFilters/internet-scanners

8 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 101.132.145.132/32
  • 112.74.38.239/32
  • 47.89.154.16/32
  • 47.91.125.252/32
  • 8.208.10.94/32
View source for KI3 (ki3.org.cn) IP ranges used for scanningFull JSON for KI3 (ki3.org.cn) IP ranges used for scanning
cidr · known

LeakIX (leakix.org / leakix.net) IP ranges used for scanning

leakix-scanning

Published source ranges of the internet-wide scanning organisation LeakIX (leakix.org / leakix.net), as tracked by https://github.com/OpenFilters/internet-scanners

188 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 104.237.130.38/32
  • 128.199.182.152/32
  • 128.199.182.55/32
  • 128.199.182.77/32
  • 134.122.28.88/32
View source for LeakIX (leakix.org / leakix.net) IP ranges used for scanningFull JSON for LeakIX (leakix.org / leakix.net) IP ranges used for scanning
string

List of Azure Applicaiton IDs

microsoft-azure-appid

List of Azure Application IDs (https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in)

4 entries · version 20260811

List details
Matching attributes
azure-application-id

First 4 entries

  • 14d82eec-204b-4c2f-b7e8-296a70dab67e
  • 5572c4c0-d078-44ce-b81c-6cbf8d3ed39e
  • 7ae974c5-1af7-4923-af3a-fb1fd14dcb7e
  • de8bc8b5-d9f9-48b1-a8ad-b748da725064
View source for List of Azure Applicaiton IDsFull JSON for List of Azure Applicaiton IDs
string

List of hashes for EICAR test virus

eicar.com

Event contains one or more entries based on hashes for EICAR test virus

15 entries · version 20200403

List details
Matching attributes
md5, sha1, sha256, sha512, filename|md5, filename|sha1, filename|sha256, filename|sha512

First 5 entries

  • 2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad
  • 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f
  • 3395856ce81f2b7382dee72602f798b642f14140
  • 44d88612fea8a8f36de82e1278abb02f
  • 6ce6f415d8475545be5ba114f208b0ff
View source for List of hashes for EICAR test virusFull JSON for List of hashes for EICAR test virus
cidr · known

List of known Alibaba Cloud IP address ranges

alibaba-cloud

Alibaba Cloud (Aliyun) IPv4 and IPv6 ranges, from the prefixes its verified autonomous systems announce, read live from the RIPEstat Data API (https://stat.ripe.net/). Alibaba Cloud publishes no address-space feed of its own. This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.

334 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 101.132.0.0/15
  • 101.200.0.0/15
  • 101.37.0.0/16
  • 103.135.210.0/23
  • 103.173.12.0/23
View source for List of known Alibaba Cloud IP address rangesFull JSON for List of known Alibaba Cloud IP address ranges
hostname

List of known Apple hosts for enterprise networks

apple-domains

Hosts that Apple products need to access on enterprise networks, merged from Apple's support article (https://support.apple.com/en-us/101555) and the v2fly domain-list-community 'apple' data set (and its includes).

1,891 entries · version 20260829

List details
Matching attributes
hostname, domain, domain|ip, url

First 5 entries

  • 100beatscheap.com
  • 12diasdepresentesdeitunes.com
  • 12diasderegalosdeitunes.cl
  • 12diasderegalosdeitunes.co
  • 12diasderegalosdeitunes.co.cr
View source for List of known Apple hosts for enterprise networksFull JSON for List of known Apple hosts for enterprise networks
cidr · known

List of known Bunny.net CDN ranges

bunny-net

List of known Bunny.net CDN IP ranges (https://support.bunny.net/hc/en-us/articles/115003578911-How-to-detect-when-BunnyCDN-PoP-servers-are-accessing-your-backend)

908 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 102.219.126.20
  • 102.67.138.155
  • 103.108.229.5
  • 103.108.231.41
  • 103.135.249.250
View source for List of known Bunny.net CDN rangesFull JSON for List of known Bunny.net CDN ranges
cidr · known

List of known CoreWeave IP address ranges

coreweave

CoreWeave IP address ranges, from the prefixes announced by the autonomous systems held by CoreWeave, Inc (AS33425, AS46992) as reported by the RIPEstat Data API. This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.

7 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 166.19.0.0/16
  • 192.112.160.0/20
  • 198.176.96.0/20
  • 207.53.232.0/22
  • 216.153.48.0/20
View source for List of known CoreWeave IP address rangesFull JSON for List of known CoreWeave IP address ranges
substring

List of known domains used by automated malware analysis services & security vendors

automated-malware-analysis

Domains used by automated malware analysis services & security vendors

47 entries · version 20260904

List details
Matching attributes
domain, hostname, domain|ip, url

First 5 entries

  • akana.mobiseclab.org
  • analyze.intezer.com
  • anlyz.io
  • app.any.run
  • app.sndbox.com
View source for List of known domains used by automated malware analysis services & security vendorsFull JSON for List of known domains used by automated malware analysis services & security vendors
cidr · known

List of known Driftnet / Internet-Measurement IP ranges (https://internet-measurement.com/)

driftnet

Driftnet / Internet-Measurement IP address ranges (https://internet-measurement.com/)

45 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 107.170.65.169/32
  • 128.199.8.140/32
  • 157.245.243.118/32
  • 157.245.245.246/32
  • 159.65.216.50/32
View source for List of known Driftnet / Internet-Measurement IP ranges (https://internet-measurement.com/)Full JSON for List of known Driftnet / Internet-Measurement IP ranges (https://internet-measurement.com/)
cidr · known

List of known GCP (Google Cloud Platform) IP address ranges

google-gcp

GCP (Google Cloud Platform) IP address ranges (https://www.gstatic.com/ipranges/cloud.json)

479 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 104.154.113.0/24
  • 104.154.114.0/23
  • 104.154.116.0/22
  • 104.154.120.0/23
  • 104.154.128.0/17
View source for List of known GCP (Google Cloud Platform) IP address rangesFull JSON for List of known GCP (Google Cloud Platform) IP address ranges
cidr · known

List of known GoDaddy IP address ranges

godaddy

GoDaddy IP address ranges, collected from the prefixes announced by the autonomous systems of GoDaddy.com, LLC and GoDaddy Host Europe GmbH, via the RIPEstat Data API (https://stat.ripe.net/data/announced-prefixes/data.json). Note this is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.

161 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 103.44.220.0/24
  • 103.87.189.0/24
  • 103.87.190.0/23
  • 104.238.64.0/18
  • 107.180.0.0/17
View source for List of known GoDaddy IP address rangesFull JSON for List of known GoDaddy IP address ranges
hostname

List of known google domains

google

Event contains one or more entries of known google domains, merged from Google's own supported_domains list, the nickspaargaren/no-google community blocklist, and the v2fly domain-list-community 'google' data set.

7,556 entries · version 20261005

List details
Matching attributes
domain, hostname, domain|ip, url

First 5 entries

  • 0.chart.apis.google.com
  • 0.client-channel.google.com
  • 0.firebaseio.com
  • 0.fls.doubleclick.net
  • 00.firebaseio.com
View source for List of known google domainsFull JSON for List of known google domains
cidr

List of known Googlebot IP ranges (https://developers.google.com/search/apis/ipranges/googlebot.json)

googlebot

Google Bot IP address ranges (https://developers.google.com/search/apis/ipranges/googlebot.json)

59 entries · version 20260901

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 192.178.4.0/24
  • 192.178.5.0/27
  • 192.178.6.0/23
  • 2001:4860:4801:10::/60
  • 2001:4860:4801:20::/59
View source for List of known Googlebot IP ranges (https://developers.google.com/search/apis/ipranges/googlebot.json)Full JSON for List of known Googlebot IP ranges (https://developers.google.com/search/apis/ipranges/googlebot.json)
string

List of known hashes for benign files

nioc-filehash

Event contains one or more benign files based on known hashes, see https://github.com/RichieB2B/nioc

197,415 entries · version 20210501

List details
Matching attributes
md5, sha1, sha256, filename|md5, filename|sha1, filename|sha256

First 5 entries

  • 00002c0f93816b3f8e432547b295ac29
  • 0000a47b73c377a2ec61f78b196fb448
  • 0001098c33b66779505bc2e3b14d50c818e2abf25c99afa5194f954b07a454cf
  • 000184038785e19255c415e79e698ced83d8f043
  • 0001b55cfd0c5e837280da7d76743f0266c1a033
View source for List of known hashes for benign filesFull JSON for List of known hashes for benign files
string

List of known hashes for empty files

empty-hashes

Event contains one or more entries of empty files based on known hashed

6 entries · version 20200403

List details
Matching attributes
md5, sha1, sha224, sha256, sha512, filename|md5, filename|sha1, filename|sha224, filename|sha256, filename|sha512, ssdeep, filename|ssdeep

First 5 entries

  • 3::
  • cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
  • d14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42f
  • d41d8cd98f00b204e9800998ecf8427e
  • da39a3ee5e6b4b0d3255bfef95601890afd80709
View source for List of known hashes for empty filesFull JSON for List of known hashes for empty files
string

List of known hashes for Windows binaries

windows-binary-hashes

List of known Windows binaries based on hashes from winbindex (https://github.com/m417z/winbindex)

789,700 entries · version 20260709

List details
Matching attributes
sha256

First 5 entries

  • 000031f59f1d81be876257834e2c4d9aa89b72cda2c2507a4d53003e8307850e
  • 0000340cd15afe3c5d3e5d1b9818e7fa02bf635dab41ee6656a905c302700ae4
  • 000069963845056a276aef2f22c604cb03242463b8a50ced76e9d285d64f4d2f
  • 000081ad1f098ba1f545b402161cdd3191ccce58f294102b62117caa76b721a5
  • 0000b0742d5f72860d9f5f1178c9d992aa96e4d7c24da22683fd02a16630679c
View source for List of known hashes for Windows binariesFull JSON for List of known hashes for Windows binaries
string

List of known hashes with common false-positives (based on Florian Roth input list)

common-ioc-false-positive

Event contains one or more entries with common false-positives

69 entries · version 20200403

List details
Matching attributes
md5, sha1, sha224, sha256, sha512, filename|md5, filename|sha1, filename|sha224, filename|sha256, filename|sha512

First 5 entries

  • 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
  • 048846ed8ed185a26394adeb3f63274d1029bbd59cffa8e73a4ef8b19456de1d
  • 06f7826c2862d184a49e3672c0aa6097b11e7771a4bf613ec37941236c1a8e20
  • 07c4c7ae2c4c7cb3ccd2ba9cd70a94382395ca8e2b0312c1631d09d790b6db33
  • 0f343b0931126a20f133d67c2b018a3b
View source for List of known hashes with common false-positives (based on Florian Roth input list)Full JSON for List of known hashes with common false-positives (based on Florian Roth input list)
cidr · known

List of known Hetzner IP address ranges

hetzner

Hetzner Online GmbH IP address ranges, from their published RFC 8805 geofeed (https://www.hetzner.com/geofeed.csv). This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.

166,298 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 116.202.0.0/19
  • 116.202.112.0/21
  • 116.202.128.0/21
  • 116.202.136.0/25
  • 116.202.137.0/26
View source for List of known Hetzner IP address rangesFull JSON for List of known Hetzner IP address ranges
hostname

List of known hostname used for querying your source IP. This can be used as exclusion for your Passive DNS lookup.

findip-host

Event contains one or more entries of known hostname querying your source IP.

24 entries · version 20260809

List details
Matching attributes
domain, hostname, domain|ip

First 5 entries

  • api.extralargecoffee.com
  • api.ipify.org
  • helper.rumble.network
  • ip.circl.lu
  • ip.dyn.bortzmeyer.fr
View source for List of known hostname used for querying your source IP. This can be used as exclusion for your Passive DNS lookup.Full JSON for List of known hostname used for querying your source IP. This can be used as exclusion for your Passive DNS lookup.
cidr · known

List of known Huawei Cloud IP address ranges

huawei-cloud

Huawei Cloud IP address ranges, from the RFC 8805 geofeed Huawei publishes for its cloud regions (https://res-static.hc-cdn.cn/cloudbu-site/china/zh-cn/IP-location/google-geo-feed.csv), the file referenced by the geofeed: attribute of Huawei Cloud's own inetnum objects in APNIC whois. This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.

244 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 1.178.32.0/19
  • 1.92.0.0/16
  • 1.94.0.0/18
  • 1.94.128.0/17
  • 1.94.64.0/20
View source for List of known Huawei Cloud IP address rangesFull JSON for List of known Huawei Cloud IP address ranges
cidr · known

List of known IBM Cloud IP address ranges

ibm-cloud

IBM Cloud (ex-SoftLayer) IP address ranges, from the prefixes announced by its autonomous systems AS36351, AS46702, AS46703, AS46704 as reported by the RIPEstat Data API (https://stat.ripe.net/data/announced-prefixes/data.json). IBM publishes no unauthenticated machine-readable endpoint for these. Scoped to the SOFTLAYER-handle cloud fleet; IBM corporate address space is deliberately excluded. A minority of the announced prefixes are registered to third parties: those are customer / bring-your-own-IP ranges routed out of IBM Cloud's autonomous system and are kept on purpose. This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.

217 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 103.106.108.0/24
  • 103.193.4.0/22
  • 103.197.160.0/22
  • 103.53.196.0/24
  • 103.70.48.0/24
View source for List of known IBM Cloud IP address rangesFull JSON for List of known IBM Cloud IP address ranges
cidr · known

List of known iCloud Private Relay egress IP address ranges

icloud-private-relay

iCloud Private Relay egress IP address ranges (https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay/)

14,070 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 104.28.100.10/31
  • 104.28.100.106/31
  • 104.28.100.108/30
  • 104.28.100.12/30
  • 104.28.100.16/32
View source for List of known iCloud Private Relay egress IP address rangesFull JSON for List of known iCloud Private Relay egress IP address ranges
cidr · known

List of known IP address ranges for Palo Alto Networks Cortex Xpanse

palo-alto-networks-cortex-xpanse

Palo Alto Networks Cortex Xpanse (https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity)

10 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 144.86.173.0/24
  • 147.185.132.0/22
  • 162.216.148.0/22
  • 172.105.147.0/24
  • 198.235.24.0/24
View source for List of known IP address ranges for Palo Alto Networks Cortex XpanseFull JSON for List of known IP address ranges for Palo Alto Networks Cortex Xpanse
cidr · known

List of known IPv4 networks belonging to common VPN providers

vpn-ipv4

IPv4 networks belonging to common VPN providers, from https://raw.githubusercontent.com/X4BNet/lists_vpn/main/output/vpn/ipv4.txt

11,052 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 102.128.164.0/23
  • 102.129.132.0/24
  • 102.129.141.0/24
  • 102.129.143.0/24
  • 102.129.145.130/31
View source for List of known IPv4 networks belonging to common VPN providersFull JSON for List of known IPv4 networks belonging to common VPN providers
cidr · known

List of known IPv4 networks belonging to datacenters and VPN providers

datacenter-ipv4

IPv4 networks belonging to datacenters and VPN providers, from https://raw.githubusercontent.com/X4BNet/lists_vpn/main/output/datacenter/ipv4.txt

44,428 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 1.116.0.0/15
  • 1.118.3.0/24
  • 1.12.0.0/14
  • 1.178.1.0/24
  • 1.178.100.0/22
View source for List of known IPv4 networks belonging to datacenters and VPN providersFull JSON for List of known IPv4 networks belonging to datacenters and VPN providers
cidr · known

List of known IPv6 networks belonging to common VPN providers

vpn-ipv6

IPv6 networks belonging to common VPN providers, from https://raw.githubusercontent.com/X4BNet/lists_vpn/main/output/vpn/ipv6.txt

498 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 2001:550:1d05::/48
  • 2001:678:8b4::/48
  • 2001:978:2305::/48
  • 2001:978:3400::/48
  • 2001:ac8::/32
View source for List of known IPv6 networks belonging to common VPN providersFull JSON for List of known IPv6 networks belonging to common VPN providers
cidr · known

List of known IPv6 networks belonging to datacenters and VPN providers

datacenter-ipv6

IPv6 networks belonging to datacenters and VPN providers, from https://raw.githubusercontent.com/X4BNet/lists_vpn/main/output/datacenter/ipv6.txt

8,752 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 2001:1520::/32
  • 2001:1598::/32
  • 2001:15e8::/32
  • 2001:1608::/32
  • 2001:1638::/32
View source for List of known IPv6 networks belonging to datacenters and VPN providersFull JSON for List of known IPv6 networks belonging to datacenters and VPN providers
cidr · known

List of known Leaseweb IP address ranges

leaseweb

Leaseweb IP address ranges, from the prefixes announced by the autonomous systems held by the Leaseweb group, as reported by the RIPEstat Data API (https://stat.ripe.net). Leaseweb publishes no address-space feed of its own. This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.

1,386 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 103.101.128.0/22
  • 103.119.218.0/23
  • 103.138.32.0/24
  • 103.139.48.0/23
  • 103.139.50.0/24
View source for List of known Leaseweb IP address rangesFull JSON for List of known Leaseweb IP address ranges
cidr · known

List of known Linode (Akamai Connected Cloud) IP address ranges

linode

Linode (Akamai Connected Cloud) IP address ranges, from their published RFC 8805 geofeed (https://geoip.linode.com/)

279 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 103.29.68.0/22
  • 103.3.60.0/22
  • 104.105.0.0/16
  • 104.111.0.0/18
  • 104.200.16.0/20
View source for List of known Linode (Akamai Connected Cloud) IP address rangesFull JSON for List of known Linode (Akamai Connected Cloud) IP address ranges
cidr · known

List of known Microsoft Azure Germany Datacenter IP Ranges

microsoft-azure-germany

Microsoft Azure Germany Datacenter IP Ranges

36 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 2a01:4180:2000::/40
  • 2a01:4180:2400::/40
  • 2a01:4180:4050:400::/64
  • 2a01:4180:4050:800::/64
  • 2a01:4180:4051:400::/64
View source for List of known Microsoft Azure Germany Datacenter IP RangesFull JSON for List of known Microsoft Azure Germany Datacenter IP Ranges
cidr · known

List of known Microsoft Azure US Government Cloud Datacenter IP Ranges

microsoft-azure-us-gov

Microsoft Azure US Government Cloud Datacenter IP Ranges

161 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 104.210.16.0/20
  • 104.212.32.0/23
  • 104.212.34.0/24
  • 104.212.43.0/24
  • 104.212.44.0/23
View source for List of known Microsoft Azure US Government Cloud Datacenter IP RangesFull JSON for List of known Microsoft Azure US Government Cloud Datacenter IP Ranges
hostname

List of known Microsoft Defender for Cloud Apps (MDCA/MCAS) proxy hostnames

microsoft-mdca-proxy

Microsoft Defender for Cloud Apps (MDCA/MCAS) hostnames (https://learn.microsoft.com/en-us/defender-cloud-apps/troubleshooting-proxy-url)

16 entries · version 20260819

List details
Matching attributes
hostname, domain, url, domain|ip

First 5 entries

  • .admin-mcas-df.ms
  • .admin-mcas-gov-df.ms
  • .admin-mcas-gov-df.us
  • .admin-mcas-gov.ms
  • .admin-mcas-gov.us
View source for List of known Microsoft Defender for Cloud Apps (MDCA/MCAS) proxy hostnamesFull JSON for List of known Microsoft Defender for Cloud Apps (MDCA/MCAS) proxy hostnames
substring

List of known Office 365 Attack Simulator used for phishing awareness campaigns

microsoft-attack-simulator

Office 365 URLs and IP address ranges used for their attack simulator in Office 365 Threat Intelligence

141 entries · version 20260405

List details
Matching attributes
ip-src, ip-dst, domain, domain|ip, hostname, url

First 5 entries

  • 52.168.52.134
  • portal.docdeliveryapp.com
  • portal.docdeliveryapp.net
  • portal.docstoreinternal.com
  • portal.hardwarecheck.net
View source for List of known Office 365 Attack Simulator used for phishing awareness campaignsFull JSON for List of known Office 365 Attack Simulator used for phishing awareness campaigns
cidr · known

List of known Oracle Cloud Infrastructure (OCI) IP address ranges

oracle-oci

Oracle Cloud Infrastructure (OCI) IP address ranges (https://docs.oracle.com/en-us/iaas/Content/General/Concepts/addressranges.htm)

798 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 129.144.0.0/16
  • 129.145.16.0/21
  • 129.145.74.0/23
  • 129.145.76.0/22
  • 129.146.0.0/21
View source for List of known Oracle Cloud Infrastructure (OCI) IP address rangesFull JSON for List of known Oracle Cloud Infrastructure (OCI) IP address ranges
cidr · known

List of known OVH Cluster IPs

ovh-cluster

OVH Cluster IP address (https://docs.ovhcloud.com/en/guides/web-cloud/web-hosting/clusters-and-shared-hosting-ip)

622 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 137.74.180.117
  • 137.74.229.68
  • 137.74.234.211
  • 137.74.48.119
  • 145.239.222.45
View source for List of known OVH Cluster IPsFull JSON for List of known OVH Cluster IPs
cidr · known

List of known Palo Alto Cortex Cloud IP ranges

palo-alto-networks-cortex-cloud

Palo Alto Cortex Cloud IP address ranges (https://docs.ovhcloud.com/en/guides/web-cloud/web-hosting/clusters-and-shared-hosting-ip)

276 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 104.155.131.72
  • 104.199.223.229
  • 136.110.132.208
  • 136.110.146.246
  • 159.183.150.248
View source for List of known Palo Alto Cortex Cloud IP rangesFull JSON for List of known Palo Alto Cortex Cloud IP ranges
hostname

List of known public DNS resolvers expressed as hostname

public-dns-hostname

Event contains one or more public DNS resolvers (expressed as hostname) as attribute with an IDS flag set

34,783 entries · version 20240615

List details
Matching attributes
hostname, domain, url, domain|ip

First 5 entries

  • -250.starlink.ru
  • 0.it4tech.ru
  • 003-077-128-083.dynamic.caiway.nl
  • 0040.extnet.it
  • 006.132.48.116.static.netvigator.com
View source for List of known public DNS resolvers expressed as hostnameFull JSON for List of known public DNS resolvers expressed as hostname
cidr · known

List of known Rackspace IP address ranges

rackspace

Rackspace IP address ranges, from the prefixes announced by the Rackspace autonomous systems (RIPEstat announced-prefixes). Note this is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.

153 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 103.4.112.0/23
  • 104.130.0.0/18
  • 104.130.112.0/21
  • 104.130.120.0/22
  • 104.130.160.0/19
View source for List of known Rackspace IP address rangesFull JSON for List of known Rackspace IP address ranges
cidr · known

List of known Salesforce IP address ranges

salesforce

Salesforce IP address ranges, from their published ip-ranges endpoint (https://ip-ranges.salesforce.com/ip-ranges.json). These are fixed SaaS service endpoints rather than rentable compute, which makes them cleaner warninglist material: the addresses stay tied to Salesforce's own platform instead of to whichever tenant rented them today.

37 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 129.77.12.0/23
  • 141.163.192.0/23
  • 141.163.195.0/24
  • 141.163.196.0/23
  • 141.163.199.0/24
View source for List of known Salesforce IP address rangesFull JSON for List of known Salesforce IP address ranges
cidr · known

List of known Scaleway IP address ranges

scaleway

Scaleway (formerly Online SAS) IP address ranges, from the ranges Scaleway documents itself (https://www.scaleway.com/en/docs/account/reference-content/scaleway-network-information.md). This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.

12 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 151.115.0.0/16
  • 163.172.0.0/16
  • 195.154.0.0/16
  • 2001:bc8::/32
  • 212.129.0.0/18
View source for List of known Scaleway IP address rangesFull JSON for List of known Scaleway IP address ranges
hostname

List of known security providers/vendors blog domain

security-provider-blogpost

Event contains one or more entries of known security providers/vendors blog domain with an IDS flag set

647 entries · version 20241204

List details
Matching attributes
domain, domain|ip, hostname, url, uri

First 5 entries

  • 0x1338.blogspot.be
  • 2014.hack.lu
  • 2014.zeronights.ru
  • about-threats.trendmicro.com
  • access.redhat.com
View source for List of known security providers/vendors blog domainFull JSON for List of known security providers/vendors blog domain
cidr · known

List of known Stackpath CDN IP ranges

stackpath

Empty: StackPath wound down its CDN and the generator's only source (https://k3t9x2h3.map2.ssl.hwcdn.net/ipblocks.txt) is dead (NXDOMAIN); hwcdn.net is now a parked domain-for-sale page. The formerly-listed IP ranges are being reassigned to new owners, so they are no longer safe to whitelist.

0 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

This list has no entries.

View source for List of known Stackpath CDN IP rangesFull JSON for List of known Stackpath CDN IP ranges
cidr · known

List of known Sucuri (Website Firewall) IP address ranges

sucuri

Sucuri Website Firewall IP address ranges, scraped from https://docs.sucuri.net/website-firewall/sucuri-firewall-troubleshooting-guide/ (no machine-readable API is published)

5 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 185.93.228.0/22
  • 192.88.134.0/23
  • 208.109.0.0/22
  • 2a02:fe80::/29
  • 66.248.200.0/22
View source for List of known Sucuri (Website Firewall) IP address rangesFull JSON for List of known Sucuri (Website Firewall) IP address ranges
cidr · known

List of known Tenable Cloud Sensors IPv6

tenable-cloud-ipv6

Tenable IPv6 Cloud Sensor addresses used for scanning Internet-facing infrastructure

17 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 2406:da14:e76:5b00::/56
  • 2406:da17:524:dd00::/56
  • 2406:da18:844:7100::/56
  • 2406:da1a:5b2:8500::/56
  • 2406:da1c:20f:2f00::/56
View source for List of known Tenable Cloud Sensors IPv6Full JSON for List of known Tenable Cloud Sensors IPv6
cidr · known

List of known Tencent Cloud IP address ranges

tencent-cloud

Tencent Cloud IP address ranges, from the prefixes announced by Tencent's autonomous systems as reported by the RIPEstat Data API (https://stat.ripe.net/). Tencent publishes no machine-readable address-space file, so the address space is derived from BGP. This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.

259 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 1.116.0.0/15
  • 1.12.0.0/14
  • 1.201.184.0/22
  • 1.201.188.0/23
  • 101.32.0.0/18
View source for List of known Tencent Cloud IP address rangesFull JSON for List of known Tencent Cloud IP address ranges
cidr · known

List of known Tor exit nodes

tor-exit-nodes

Specialized list of IPv4 addresses belonging to Tor exit nodes, from https://github.com/X4BNet/lists_torexit

831 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 102.130.113.9/32
  • 102.130.117.167/32
  • 102.130.127.117/32
  • 102.211.56.20/32
  • 102.68.99.63/32
View source for List of known Tor exit nodesFull JSON for List of known Tor exit nodes
cidr · known

List of known Vultr IP address ranges

vultr

Vultr (Constant Company, LLC) IP address ranges, from their published RFC 8805 geofeed (https://geofeed.constant.com/). This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.

145 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 103.43.72.0/22
  • 104.156.224.0/19
  • 104.207.128.0/19
  • 104.238.128.0/18
  • 107.191.32.0/19
View source for List of known Vultr IP address rangesFull JSON for List of known Vultr IP address ranges
string

List of known Windows 10 connection endpoints

microsoft-win10-connection-endpoints

Event contains one or more entries of known Windows 10 connection endpoints (https://docs.microsoft.com/en-us/windows/privacy/manage-windows-endpoints)

144 entries · version 20220816

List details
Matching attributes
domain, hostname, domain|ip

First 5 entries

  • .1.msftsrvcs.vo.llnwi.net
  • .a-msedge.net
  • .akamai.net
  • .akamaiedge.net
  • .b.akamaiedge.net
View source for List of known Windows 10 connection endpointsFull JSON for List of known Windows 10 connection endpoints
string

List of known Windows 11 connection endpoints

microsoft-win11-connection-endpoints

Event contains one or more entries of known Windows 11 connection endpoints (https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints)

152 entries · version 20260829

List details
Matching attributes
domain, hostname, domain|ip

First 5 entries

  • .api.cdp.microsoft.com
  • .blob.core.windows.net
  • .delivery.mp.microsoft.com
  • .displaycatalog.mp.microsoft.com
  • .dl.delivery.mp.microsoft.com
View source for List of known Windows 11 connection endpointsFull JSON for List of known Windows 11 connection endpoints
hostname · known

List of LOTS (Living Off Trusted Sites) Project Domains

lots-project

List of popular legitimate domains from LOTS (Living Off Trusted Sites) Project used to conduct phishing, C&C, exfiltration or downloading tools to evade detection

175 entries · version 20261014

List details
Matching attributes
domain, domain|ip, hostname, hostname|port, url

First 5 entries

  • .000webhostapp.com
  • .amazonaws.com
  • .appspot.com
  • .atlassian.net
  • .axshare.com
View source for List of LOTS (Living Off Trusted Sites) Project DomainsFull JSON for List of LOTS (Living Off Trusted Sites) Project Domains
cidr · known

List of published IP address ranges for Internet Cleanup Foundation scanners

internetcleanup-scanner

Internet Cleanup Foundation scaninfo (https://internetcleanup.foundation/scaninfo/)

6 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 145.220.76.240/32
  • 145.220.91.28/31
  • 185.71.61.126/31
  • 185.71.61.129/32
  • 185.71.61.140/32
View source for List of published IP address ranges for Internet Cleanup Foundation scannersFull JSON for List of published IP address ranges for Internet Cleanup Foundation scanners
cidr · known

Mandiant ASM / GTI (mandiant.com) IP ranges used for scanning

mandiantasm-scanning

Published source ranges of the internet-wide scanning organisation Mandiant ASM / GTI (mandiant.com), as tracked by https://github.com/OpenFilters/internet-scanners

105 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 103.66.28.0/22
  • 13.58.114.74/32
  • 13.58.203.73/32
  • 13.58.84.198/32
  • 13.59.120.77/32
View source for Mandiant ASM / GTI (mandiant.com) IP ranges used for scanningFull JSON for Mandiant ASM / GTI (mandiant.com) IP ranges used for scanning
cidr · known

Modat IP Ranges Used for Scanning

modat-nt-scanning

List containing IP's associated with the Modat scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08

37 entries · version 26100813

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-dst|port, ip-src|port

First 5 entries

  • 212.73.148.0/32
  • 212.73.148.11/32
  • 212.73.148.14/32
  • 212.73.148.16/32
  • 212.73.148.2/32
View source for Modat IP Ranges Used for ScanningFull JSON for Modat IP Ranges Used for Scanning
cidr · known

Netlas (netlas.io) IP ranges used for scanning

netlas-scanning

Published source ranges of the internet-wide scanning organisation Netlas (netlas.io), as tracked by https://github.com/OpenFilters/internet-scanners

11 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 93.123.109.120/30
  • 93.123.109.124/31
  • 93.123.109.17/32
  • 93.123.109.18/31
  • 93.123.109.20/30
View source for Netlas (netlas.io) IP ranges used for scanningFull JSON for Netlas (netlas.io) IP ranges used for scanning
cidr · known

NETSCOUT (internet-albedo.net) IP ranges used for scanning

netscout-scanning

Published source ranges of the internet-wide scanning organisation NETSCOUT (internet-albedo.net), as tracked by https://github.com/OpenFilters/internet-scanners

1 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 1 entries

  • 146.88.240.0/23
View source for NETSCOUT (internet-albedo.net) IP ranges used for scanningFull JSON for NETSCOUT (internet-albedo.net) IP ranges used for scanning
cidr · known

Netsecscan IP Ranges Used for Scanning

netsecscan-nt-scanning

List containing IP's associated with the Netsecscan scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2025/12/10

11 entries · version 25121023

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-dst|port, ip-src|port

First 5 entries

  • 89.248.167.132/31
  • 89.248.167.135/32
  • 89.248.167.139/32
  • 89.248.167.140/32
  • 89.248.167.147/32
View source for Netsecscan IP Ranges Used for ScanningFull JSON for Netsecscan IP Ranges Used for Scanning
cidr · known

Nokia Deepfield (deepfield.net) IP ranges used for scanning

deepfield-scanning

Published source ranges of the internet-wide scanning organisation Nokia Deepfield (deepfield.net), as tracked by https://github.com/OpenFilters/internet-scanners

48 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 195.178.110.162/32
  • 2001:bc8:702:10ba::/128
  • 2001:bc8:702:11ad::/128
  • 2001:bc8:702:11f3::/128
  • 2001:bc8:702:1209::/128
View source for Nokia Deepfield (deepfield.net) IP ranges used for scanningFull JSON for Nokia Deepfield (deepfield.net) IP ranges used for scanning
cidr · known

ONLYSCANS (onlyscans.com / onlyscans.net) IP ranges used for scanning

onlyscans-scanning

Published source ranges of the internet-wide scanning organisation ONLYSCANS (onlyscans.com / onlyscans.net), as tracked by https://github.com/OpenFilters/internet-scanners

16 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 104.105.18.64/32
  • 172.104.240.26/32
  • 172.104.42.54/32
  • 172.104.48.115/32
  • 172.105.92.211/32
View source for ONLYSCANS (onlyscans.com / onlyscans.net) IP ranges used for scanningFull JSON for ONLYSCANS (onlyscans.com / onlyscans.net) IP ranges used for scanning
cidr · known

Onyphe IP Ranges Used for Scanning

onyphe-nt-scanning

List containing IP's associated with the Onyphe scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08

167 entries · version 26100813

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-dst|port, ip-src|port

First 5 entries

  • 195.184.76.0/28
  • 195.184.76.112/30
  • 195.184.76.116/32
  • 195.184.76.118/31
  • 195.184.76.120/29
View source for Onyphe IP Ranges Used for ScanningFull JSON for Onyphe IP Ranges Used for Scanning
hostname

OSINT.DigitalSide.IT Warning List

digitalside

OSINT DigitalSide Threat-Intel Repository - MISP Warninglist - List of domains should be marked as false positive in the related MISP event with IDS attribute not flagged

43 entries · version 20260811

List details
Matching attributes
hostname, domain

First 5 entries

  • amazonaws.com
  • archive.org
  • assets-global.website-files.com
  • backblaze.com
  • backblazeb2.com
View source for OSINT.DigitalSide.IT Warning ListFull JSON for OSINT.DigitalSide.IT Warning List
cidr · known

Parking domains

parking-domain

List of parking domain's ip adresses

108 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 103.120.80.111/32
  • 103.139.0.32/32
  • 103.224.182.0/23
  • 103.224.212.0/23
  • 104.26.6.37/32
View source for Parking domainsFull JSON for Parking domains
cidr · known

pocnroll (pocnroll.com) IP ranges used for scanning

pocnroll-scanning

Published source ranges of the internet-wide scanning organisation pocnroll (pocnroll.com), as tracked by https://github.com/OpenFilters/internet-scanners

1 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 1 entries

  • 45.79.38.219/32
View source for pocnroll (pocnroll.com) IP ranges used for scanningFull JSON for pocnroll (pocnroll.com) IP ranges used for scanning
cidr · known

Probethenet IP Ranges Used for Scanning

probethenet-nt-scanning

List containing IP's associated with the Probethenet scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/07/08

6 entries · version 26070810

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-dst|port, ip-src|port

First 5 entries

  • 104.128.144.201/32
  • 104.128.144.202/31
  • 104.128.144.204/30
  • 104.128.144.208/29
  • 104.128.144.216/30
View source for Probethenet IP Ranges Used for ScanningFull JSON for Probethenet IP Ranges Used for Scanning
cidr · known

ProbeTheNet Project / mThreat Technology Inc. (probethenet.com) IP ranges used for scanning

probethenet-scanning

Published source ranges of the internet-wide scanning organisation ProbeTheNet Project / mThreat Technology Inc. (probethenet.com), as tracked by https://github.com/OpenFilters/internet-scanners

6 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 104.128.144.201/32
  • 104.128.144.202/31
  • 104.128.144.204/30
  • 104.128.144.208/29
  • 104.128.144.216/30
View source for ProbeTheNet Project / mThreat Technology Inc. (probethenet.com) IP ranges used for scanningFull JSON for ProbeTheNet Project / mThreat Technology Inc. (probethenet.com) IP ranges used for scanning
cidr · known

Rapid7 IP Ranges Used for Scanning

rapid7-nt-scanning

List containing IP's associated with the Rapid7 scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08

18 entries · version 26100813

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-dst|port, ip-src|port

First 5 entries

  • 109.123.117.228/30
  • 109.123.117.232/29
  • 109.123.117.240/29
  • 109.123.117.248/30
  • 109.123.117.252/31
View source for Rapid7 IP Ranges Used for ScanningFull JSON for Rapid7 IP Ranges Used for Scanning
cidr · known

Rapid7 Project Sonar (rapid7.com) IP ranges used for scanning

rapid7-scanning

Published source ranges of the internet-wide scanning organisation Rapid7 Project Sonar (rapid7.com), as tracked by https://github.com/OpenFilters/internet-scanners

11 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 109.123.117.224/27
  • 146.185.25.160/27
  • 173.255.225.139/32
  • 2607:ff10:c5:522::/64
  • 2a02:2498:e004:23::/64
View source for Rapid7 Project Sonar (rapid7.com) IP ranges used for scanningFull JSON for Rapid7 Project Sonar (rapid7.com) IP ranges used for scanning
cidr · known

Recorded Future / SecurityTrails (securitytrails.com) IP ranges used for scanning

recordedfuture-scanning

Published source ranges of the internet-wide scanning organisation Recorded Future / SecurityTrails (securitytrails.com), as tracked by https://github.com/OpenFilters/internet-scanners

6 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 13.219.121.241/32
  • 18.235.110.182/32
  • 3.233.59.216/32
  • 54.86.115.253/32
  • 98.84.1.175/32
View source for Recorded Future / SecurityTrails (securitytrails.com) IP ranges used for scanningFull JSON for Recorded Future / SecurityTrails (securitytrails.com) IP ranges used for scanning
cidr · known

Recyber (recyber.net) IP ranges used for scanning

recyber-scanning

Published source ranges of the internet-wide scanning organisation Recyber (recyber.net), as tracked by https://github.com/OpenFilters/internet-scanners

10 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 89.248.163.0/24
  • 89.248.165.0/24
  • 89.248.173.170/32
  • 89.248.173.173/32
  • 89.248.173.177/32
View source for Recyber (recyber.net) IP ranges used for scanningFull JSON for Recyber (recyber.net) IP ranges used for scanning
cidr · known

Research Scanner (research-scanner.com) IP ranges used for scanning

researchscanner-scanning

Published source ranges of the internet-wide scanning organisation Research Scanner (research-scanner.com), as tracked by https://github.com/OpenFilters/internet-scanners

25 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 138.197.101.95/32
  • 138.197.118.33/32
  • 138.68.249.116/32
  • 157.245.176.143/32
  • 157.245.252.5/32
View source for Research Scanner (research-scanner.com) IP ranges used for scanningFull JSON for Research Scanner (research-scanner.com) IP ranges used for scanning
cidr · known

Research scanner IP Ranges Used for Scanning

research-scanner-nt-scanning

List containing IP's associated with the Research scanner scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08

24 entries · version 26100813

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-dst|port, ip-src|port

First 5 entries

  • 138.197.101.95/32
  • 138.197.118.33/32
  • 157.245.176.143/32
  • 157.245.252.5/32
  • 159.223.203.97/32
View source for Research scanner IP Ranges Used for ScanningFull JSON for Research scanner IP Ranges Used for Scanning
cidr · known

Root Evidence (rootevidence.com) IP ranges used for scanning

rootevidence-scanning

Published source ranges of the internet-wide scanning organisation Root Evidence (rootevidence.com), as tracked by https://github.com/OpenFilters/internet-scanners

727 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 104.200.30.203/32
  • 104.200.30.246/32
  • 104.200.30.75/32
  • 104.200.30.79/32
  • 104.200.30.90/32
View source for Root Evidence (rootevidence.com) IP ranges used for scanningFull JSON for Root Evidence (rootevidence.com) IP ranges used for scanning
cidr · known

Scanners from various universities IP ranges used for scanning

university-scanning

Published source ranges of the internet-wide scanning organisation Scanners from various universities, as tracked by https://github.com/OpenFilters/internet-scanners

204 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 104.207.149.87/32
  • 104.238.185.11/32
  • 108.61.209.136/32
  • 108.61.241.199/32
  • 128.232.21.75/32
View source for Scanners from various universities IP ranges used for scanningFull JSON for Scanners from various universities IP ranges used for scanning
cidr · known

securityresearch.net IP ranges used for scanning

securityresearch-scanning

Published source ranges of the internet-wide scanning organisation securityresearch.net, as tracked by https://github.com/OpenFilters/internet-scanners

1 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 1 entries

  • 144.202.82.88/32
View source for securityresearch.net IP ranges used for scanningFull JSON for securityresearch.net IP ranges used for scanning
cidr · known

Shadowserver IP Ranges Used for Scanning

shadowserver-nt-scanning

List containing IP's associated with the Shadowserver scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/07/08

9 entries · version 26070810

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-dst|port, ip-src|port

First 5 entries

  • 184.105.247.194/31
  • 184.105.247.252/32
  • 216.218.206.67/32
  • 64.62.197.152/32
  • 64.62.197.17/32
View source for Shadowserver IP Ranges Used for ScanningFull JSON for Shadowserver IP Ranges Used for Scanning
cidr · known

Shadowserver IP-Ranges, pot. used for Scanning

shadowserver

List of Shadowserver IP-Ranges. Potentially associated with Shadowserver scans. based on [https://bgp.he.net/search?search%5Bsearch%5D=shadowserver&commit=Search]

40 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-dst|port, ip-src|port

First 5 entries

  • 108.165.44.0/24
  • 146.19.20.0/24
  • 154.16.223.0/24
  • 154.16.230.0/24
  • 154.16.240.0/24
View source for Shadowserver IP-Ranges, pot. used for ScanningFull JSON for Shadowserver IP-Ranges, pot. used for Scanning
cidr · known

Shodan IP Ranges Used for Scanning

shodan-nt-scanning

List containing IP's associated with the Shodan scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08

28 entries · version 26100813

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-dst|port, ip-src|port

First 5 entries

  • 2.59.22.234/32
  • 66.240.192.138/32
  • 66.240.205.34/32
  • 66.240.219.146/32
  • 66.240.236.119/32
View source for Shodan IP Ranges Used for ScanningFull JSON for Shodan IP Ranges Used for Scanning
cidr · known

Stretchoid (stretchoid.com) IP ranges used for scanning

stretchoid-scanning

Published source ranges of the internet-wide scanning organisation Stretchoid (stretchoid.com), as tracked by https://github.com/OpenFilters/internet-scanners

5,039 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 104.42.220.14/32
  • 128.203.200.147/32
  • 128.203.200.175/32
  • 128.203.200.182/32
  • 128.203.200.211/32
View source for Stretchoid (stretchoid.com) IP ranges used for scanningFull JSON for Stretchoid (stretchoid.com) IP ranges used for scanning
cidr · known

Stretchoid IP Ranges Used for Scanning

stretchoid-nt-scanning

List containing IP's associated with the Stretchoid scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08

1,242 entries · version 26100813

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-dst|port, ip-src|port

First 5 entries

  • 104.42.155.18/32
  • 13.83.164.24/32
  • 13.86.114.132/32
  • 13.86.114.16/32
  • 13.86.115.128/32
View source for Stretchoid IP Ranges Used for ScanningFull JSON for Stretchoid IP Ranges Used for Scanning
cidr · known

Tenable ASM (tenable.com / tenable.io) IP ranges used for scanning

tenableasm-scanning

Published source ranges of the internet-wide scanning organisation Tenable ASM (tenable.com / tenable.io), as tracked by https://github.com/OpenFilters/internet-scanners

139 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 13.115.104.128/25
  • 13.210.1.64/26
  • 13.213.79.0/24
  • 13.56.21.128/25
  • 13.59.252.0/25
View source for Tenable ASM (tenable.com / tenable.io) IP ranges used for scanningFull JSON for Tenable ASM (tenable.com / tenable.io) IP ranges used for scanning
string

Top 10 000 websites from Cisco Umbrella

cisco_top10k

Event contains one or more entries from the top 10 000 of the most used websites (Cisco Umbrella).

10,000 entries · version 20261005

List details
Matching attributes
hostname, domain, url, domain|ip

First 5 entries

  • -container.supertms.com
  • 0-bvs84irkvfpdbio14klg0d2um4mttanvfdm.canva-apps.cn
  • 0-courier.push.apple.com
  • 0-courier2.push.apple.com
  • 0-ejemplo.supertms.com
View source for Top 10 000 websites from Cisco UmbrellaFull JSON for Top 10 000 websites from Cisco Umbrella
string

Top 20 000 websites from Cisco Umbrella

cisco_top20k

Event contains one or more entries from the top 20 000 of the most used websites (Cisco Umbrella).

20,000 entries · version 20261005

List details
Matching attributes
hostname, domain, url, domain|ip

First 5 entries

  • -container.supertms.com
  • 0-akali-comssets.create.wire.c.dev1--premisewww.lel.asia
  • 0-bvs84irkvfpdbio14klg0d2um4mttanvfdm.canva-apps.cn
  • 0-cloudappatepractice.canva-apps.cn
  • 0-courier.push.apple.com
View source for Top 20 000 websites from Cisco UmbrellaFull JSON for Top 20 000 websites from Cisco Umbrella
string

Top 5000 websites from Cisco Umbrella

cisco_top5k

Event contains one or more entries from the top 5000 of the most used websites (Cisco Umbrella).

5,000 entries · version 20261005

List details
Matching attributes
hostname, domain, url, domain|ip

First 5 entries

  • -container.supertms.com
  • 0-courier2.push.apple.com
  • 0-ejemplo.supertms.com
  • 0-enakamai-lanwpradio-1ali-ali-s3.ali.gwfb.net
  • 0.amazon.pool.ntp.org
View source for Top 5000 websites from Cisco UmbrellaFull JSON for Top 5000 websites from Cisco Umbrella
regex

Unattributed phone number.

phone_numbers

Numbers that cannot be attributed because they reserved for different purposes.

33 entries · version 20260812

List details
Matching attributes
phone-number, whois-registrant-phone

First 5 entries

  • /((?:\+|00)1)?([0-9]{3})55501([0-9]{2})/
  • /((?:\+|00)1)?55501([0-9]{2})/
  • /((?:\+|00)33?|0?)(19900|26191|35301|46571|53649|63998)([0-9]{4})/
  • /((?:\+|00)33?|0?)(999)([0-9]{6})/
  • /((?:\+|00)353)?02091([0-9]{5})/
View source for Unattributed phone number.Full JSON for Unattributed phone number.
string

University domains

university_domains

List of University domains from https://raw.githubusercontent.com/Hipo/university-domains-list/master/world_universities_and_domains.json

10,588 entries · version 20261005

List details
Matching attributes
hostname, domain, url, domain|ip

First 5 entries

  • 29mayis.edu.tr
  • 4cd.edu
  • a-aarhus.dk
  • a2.keio.jp
  • aabu.edu.jo
View source for University domainsFull JSON for University domains
cidr · known

University of Michigan CSE connection-attempt network ranges

umich-cse-connection-attempts

University of Michigan Computer Science and Engineering connection attempts page (https://cse.engin.umich.edu/about/resources/connection-attempts/)

6 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 141.212.120.0/24
  • 141.212.121.0/24
  • 141.212.122.0/24
  • 141.212.123.0/24
  • 141.212.124.0/24
View source for University of Michigan CSE connection-attempt network rangesFull JSON for University of Michigan CSE connection-attempt network ranges
cidr · known

VisionHeight (visionheight.com) IP ranges used for scanning

visionheight-scanning

Published source ranges of the internet-wide scanning organisation VisionHeight (visionheight.com), as tracked by https://github.com/OpenFilters/internet-scanners

210 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 100.28.153.226/32
  • 100.49.117.77/32
  • 100.50.17.159/32
  • 13.58.100.25/32
  • 13.58.208.166/32
View source for VisionHeight (visionheight.com) IP ranges used for scanningFull JSON for VisionHeight (visionheight.com) IP ranges used for scanning
cidr · known

XMCO Serenety (xmco.fr) IP ranges used for scanning

xmco-scanning

Published source ranges of the internet-wide scanning organisation XMCO Serenety (xmco.fr), as tracked by https://github.com/OpenFilters/internet-scanners

44 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 163.172.109.18/32
  • 163.172.99.21/32
  • 163.172.99.35/32
  • 163.172.99.60/32
  • 163.172.99.85/32
View source for XMCO Serenety (xmco.fr) IP ranges used for scanningFull JSON for XMCO Serenety (xmco.fr) IP ranges used for scanning
cidr · known

ZERN (zern.io) IP ranges used for scanning

zern-scanning

Published source ranges of the internet-wide scanning organisation ZERN (zern.io), as tracked by https://github.com/OpenFilters/internet-scanners

130 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 101.36.106.47/32
  • 101.36.119.4/32
  • 101.36.122.155/32
  • 101.36.122.89/32
  • 103.210.21.32/32
View source for ZERN (zern.io) IP ranges used for scanningFull JSON for ZERN (zern.io) IP ranges used for scanning
cidr · known

ZoomEye (zoomeye.ai) IP ranges used for scanning

zoomeye-scanning

Published source ranges of the internet-wide scanning organisation ZoomEye (zoomeye.ai), as tracked by https://github.com/OpenFilters/internet-scanners

13 entries · version 20261014

List details
Matching attributes
ip-src, ip-dst, domain|ip, ip-src|port, ip-dst|port

First 5 entries

  • 148.153.188.246/32
  • 148.153.188.254/32
  • 148.153.189.62/32
  • 148.153.56.170/32
  • 148.153.56.174/32
View source for ZoomEye (zoomeye.ai) IP ranges used for scanningFull JSON for ZoomEye (zoomeye.ai) IP ranges used for scanning

Generated from misp-warninglists · revision 154896d7bf00. Entry counts include duplicates across lists.

Use warning lists with MISP

In MISP, open Warninglists under Input Filters, update the lists, and enable those relevant to your organisation. Review matches alongside the event’s context before deciding how to use an indicator.

Download catalogue metadata · Read the warning-list documentation · Contribute a warning list