IP-LIST.txt

# K8s cluster that scan us
116.202.130.184/32
# Malware Backend Server for Minecraft Plugins
85.208.9.224/32
# Known malicious hoster ips (pfcloud AS51396)
176.65.132.0/24
176.65.148.0/24
176.65.149.0/24
176.65.150.0/24
176.65.151.0/24
185.215.247.0/24
204.76.203.0/24
45.135.193.0/24
45.135.194.0/24
45.153.34.0/24
45.156.87.0/24
89.251.10.0/24
# other pfcloud ranges
212.135.223.0/24
212.135.222.0/24
212.135.221.0/24
212.135.220.0/24
212.134.68.0/22
212.134.66.0/23
212.134.12.0/22
212.134.8.0/23
195.40.182.0/23
195.40.176.0/22
195.40.76.0/23
195.40.72.0/22
# Matscanner scans and tracks Minecraft servers
155.248.209.22/32
# Lucky Systems is also a scanner that scans but warns for griefers
23.88.49.137/32
# Abusive (said ipinfo)
185.204.1.184/32
# Minecraft Server scanner, abusive
95.111.227.12/32
# Go Host server, pinging all the time (AS208191)
151.241.66.0/24
151.243.236.0/24
151.244.252.0/24
155.117.237.0/24
176.65.134.0/24
91.231.222.0/24
96.62.190.0/24
# Weird hetzner server
168.119.210.14/32
# other
178.3.70.31/32
# serverseeker pfcloud
45.128.232.184/32
195.154.199.60/32
79.238.122.146/32
136.243.89.108/32
# Old Malware Backend Server for Minecraft Plugins
84.252.120.172/32
# pfcloud serverseeker
154.213.185.46/32
# russian servers TWCloud
5.42.101.0/24
# netherlands worldstream servers
93.190.141.0/24
54.36.120.8/32
# tracking server
116.202.130.184/32
# compromised or honeypot server
155.248.209.22/32
# metrics server
193.25.217.28/32
84.239.16.128/25
# mclist serverseeker
116.202.58.77/32
# Altus Webhosting
37.46.113.164/32
# matscan serverseeker
51.15.34.47/32
# weird server
51.222.110.150/32
209.38.102.131/32
# Tracking server
77.181.194.30/32
# vpn proxy server
185.204.1.183/32
95.111.227.12/32
206.168.34.255/32
# french server minecraft
191.101.217.28/32
# Cloud_Innovation chinese
156.253.227.0/24
156.229.233.0/24
# datacamp
156.146.63.209/24
# Lunar Client Ping + mcstatus.io serverseeker
144.172.67.4/32
# Scaleway 61000 Port Attack / Read
51.158.160.67/32
# Liquid vpn proxy
178.63.18.171/32
45.88.109.232/32
45.88.109.119/32
149.28.8.28/32
193.168.172.124/32
108.61.218.165/32
148.113.175.3/32
213.165.70.64/32
# Spams pings
81.20.127.109/32
# VPN Hoster tzulo.com
23.234.69.28/32
# blixsolutions.no
194.127.199.35/32
# HZ-HOSTING-LTD Minecraft Protocol
185.253.118.69/32
# Minecraft SimpliQ Tech SRL Proxy Ping
93.113.25.158/32
# hostuniversal.com.au
103.216.220.0/23
# netiface pfcloud
23.176.184.0/24
# russian hoster in germany, mc protocol pings
5.83.140.2/32
# hostroyale
185.92.210.0/24
104.36.50.19/24
185.188.61.197/32
# datacamp
178.249.211.86/32
138.199.15.148/32
156.146.63.150/32
45.134.142.221/32
# mullvad
155.2.190.0/24
194.127.199.0/24
# gohost
176.65.134.0/24
# cust.se
185.65.134.0/24
185.195.233.0/24
# Alsycon B.V.
45.95.147.0/24
# Hayashimo LLC
23.168.216.0/24
# Shodan ips
207.90.244.0/24
# Microsoft abused flagged (ipinfo)
13.89.125.25/32
# temporary hopefully. Might be portscan
79.238.117.30/32
209.38.70.156/32
# Hetzner Tracker
116.202.55.208/32
# DMZHost
45.148.10.0/24
# TZULO Tracker
23.234.90.0/24
# Temporary - spam
46.223.13.15/32
79.238.123.186/32
# Minecraft Server Tracking / unknown host
23.162.40.0/24
# CDN77 _ Tracking
79.127.217.39/24
# mvsrvstat.us server
172.104.152.224/32
# probably tracker
45.129.56.142/32
# Blix
193.138.7.0/24
31.169.48.0/21
# shodan
209.38.128.0/19
# OWL Limited, tracker
92.60.40.0/32
178.19.80.0/32
71.73.78.114/32
# breakblocks serverseeker
51.81.208.11/32
# another tracker host from japan
194.114.136.0/24
# OWL
103.136.147.155/32
# tracking
193.32.249.0/24
# MULLVAD Ranges
45.85.106.0/24  
45.92.0.0/24  
45.92.231.0/24  
45.130.118.0/24  
46.229.255.0/24  
80.66.198.0/24  
85.203.53.0/24  
85.203.54.0/24  
85.203.55.0/24  
89.37.63.0/24  
92.60.40.0/24  
155.2.190.0/24  
155.2.191.0/24  
155.2.208.0/24  
155.2.209.0/24  
155.2.218.0/24  
155.2.219.0/24  
167.160.13.0/24  
170.62.100.0/24  
170.62.104.0/24  
185.184.220.0/24  
185.184.222.0/24  
185.217.116.0/24  
185.213.193.0/25  
185.213.193.128/25  
185.254.75.0/24  
193.19.108.0/24  
194.34.172.0/24  
203.159.82.0/24  
142.147.89.192/26  
45.8.223.192/26  
185.225.28.144/28
# shodan.io from ipfire.org/docs/configuration/firewall/blockshodan
208.180.20.97/32
# census1.shodan.io
198.20.69.74/32
# census2.shodan.io
198.20.69.98/32
# census3.shodan.io
198.20.70.114/32
# census4.shodan.io
198.20.99.130/32
# census5.shodan.io
93.120.27.62/32
# census6.shodan.io
66.240.236.119/32
# census7.shodan.io
71.6.135.131/32
# census8.shodan.io
66.240.192.138/32
# census9.shodan.io
71.6.167.142/32
# census10.shodan.io
82.221.105.6/32
# census11.shodan.io
82.221.105.7/32
# census12.shodan.io
71.6.165.200/32
# atlantic.census.shodan.io
188.138.9.50/32
# pacific.census.shodan.io
85.25.103.50/32
# rim.census.shodan.io
85.25.43.94/32
# pirate.census.shodan.io
71.6.146.185/32
# ninja.census.shodan.io
71.6.158.166/32
# border.census.shodan.io
198.20.87.98/32
# burger.census.shodan.io
66.240.219.146/32
# atlantic.dns.shodan.io
209.126.110.38/32
# blog.shodan.io
104.236.198.48/32
# hello.data.shodan.io
104.131.0.69/32
# www.shodan.io
162.159.244.38/32
# battery.census.shodan.io
93.174.95.106/32
# cloud.census.shodan.io
94.102.49.193/32
# dojo.census.shodan.io
80.82.77.139/32
# flower.census.shodan.io
94.102.49.190/32
# goldfish.census.shodan.io
185.163.109.66/32
# house.census.shodan.io
89.248.172.16/32
# inspire.census.shodan.io
71.6.146.186/32
# mason.census.shodan.io
89.248.167.131/32
# ny.private.shodan.io
159.203.176.62/32
# turtle.census.shodan.io
185.181.102.18/32
# sky.census.shodan.io
80.82.77.33/32
# shodan.io (PTR only)
216.117.2.180/32
# einstein.census.shodan.io
71.6.199.23/32
# hat.census.shodan.io
185.142.236.34/32
# red.census.shodan.io
185.165.190.34/32
# soda.census.shodan.io
71.6.135.131/32
# wine.census.shodan.io
185.142.236.35/32
# wall.census.shodan.io
66.240.219.133/32
# floss.census.shodan.io
143.198.225.197/32
# dog.census.shodan.io
137.184.95.216/32
# draft.census.shodan.io
64.227.90.185/32
# can.census.shodan.io
143.198.238.87/32
# jug.census.shodan.io
137.184.112.192/32
# elk.census.shodan.io
137.184.190.188/32
# tab.census.shodan.io
167.172.219.157/32
# buffet.census.shodan.io
143.110.239.2/32
# deer.census.shodan.io
143.198.68.20/32
# sparkle.census.shodan.io
137.184.190.194/32
# fish.census.shodan.io
137.184.190.246/32
# heimdal.scan6x.shodan.io
137.184.9.17/32
# gravy.scanf.shodan.io
137.184.13.100/32
# scanme.scanf.shodan.io
137.184.94.133/32
# frame.census.shodan.io
137.184.112.103/32
# collector.chrono.shodan.io
137.184.180.190/32
# ships.data.shodan.io
143.198.50.234/32
# green.census.shodan.io
185.142.236.36/32
# blue.census.shodan.io
185.142.236.40/32
# guitar.census.shodan.io
185.142.236.41/32
# blue2.census.shodan.io
185.142.236.43/32
# red2.census.shodan.io
185.142.239.16/32
# Shodans own /24
207.90.244.0/24
# Some phishing service from south korea
43.155.179.100/32
# Known minecraft server crawler
193.32.126.225/32
# Data bridge limited
23.160.24.0/24
# Tracking / Port scan -> annoying Minecraft organisation
103.136.147.26/32
103.216.220.39/32
103.75.11.55/32
198.54.134.173/32
146.70.200.24/32
193.35.18.92/32
193.35.18.105/32
193.35.18.163/32
45.128.232.206/32
149.102.143.151/32
132.145.71.44/32
185.209.198.77/32
193.32.248.247/32
# Cloudsingularity
38.240.225.79/32
# Ultahost, Inc., pings with 1.19.1
192.142.45.175/32
# Contabo Server pinging with 1.19.1
86.48.29.72/32
# Server Scanner ip adresses from abuseipdb
172.105.157.220/32
91.230.110.186/32
165.154.221.175/32
23.176.184.152/32
176.65.148.4/32
176.65.149.126/32
176.65.148.158/32
204.76.203.35/32
115.231.78.11/32
176.65.148.230/32
176.65.148.136/32
91.230.110.186/32
176.65.148.4/32
23.176.184.152/32
# shodan
147.182.202.179/32
# mcsdc server seeker
23.176.184.152/32
# malicious
40.119.29.137/32
# minecraft server scanner
146.70.184.149/32
185.204.1.186/32
208.77.244.93/32
207.46.224.85/32
116.202.58.68/32
# Microsoft hosted minecraft server scanner
207.46.224.85/32
# another server scanner for minecraft
185.204.1.186/32
173.212.243.164/32
# Internet Measurement host
185.247.137.0/24
# Minecraft Server Scanner
194.26.192.222/32
185.241.206.91/32
45.83.31.38/32
45.141.215.9/32
5.101.66.166/32
40.124.174.155/32
141.98.255.149/32
193.32.127.159/32
185.212.149.204/32
141.98.252.143/32
208.77.244.0/23
# malicious
20.64.105.82/32
45.141.215.9/32
64.226.86.7/32
# contabo scanner
144.126.143.9/32
# france scanner, scw.cloud
51.159.149.103/32
# fixed line minecraft server scanner
141.98.255.143/32
# portscanner
143.198.150.150/32
# suspicious microsoft
52.188.81.67/32
40.124.173.160/32
# worldstream bruteforcing
212.8.249.217/32
212.8.243.130/32
# mc server scanner
141.98.254.173/32
141.98.255.151/32
# microsoft - but looks suspicious as it pings with 1.19.1 as a server
135.119.112.69/32
20.64.106.155/32
# black host minecraft server scanner / port scan
86.54.30.165/32
# blix server scanner
91.90.44.21/32
# annddd... another one but 1.8
148.230.80.5/32
# services AB minecraft server scanner
141.98.255.152/32
# do not trust palo alto, as they had an incident regarding their firewall
198.235.24.0/24
205.210.31.26/32
# Legacy stretchoid scanner (abuseipdb)
40.124.175.26/32
20.65.202.2/32
# censys, because people abuse it for minecraft server scanning. Yes they do.
66.132.148.0/24
66.132.153.0/24
66.132.159.0/24
66.132.172.0/24
162.142.125.0/24
167.94.138.0/24
167.248.133.0/24
206.168.32.0/22
# driftnet
87.236.176.186/32
# chinese server, portscan
106.75.12.244/32
# 1.7 ping from hetzner server
138.201.31.198/32
# other
172.235.181.217/32
# scanner
98.80.4.38/32