{ "count": 227, "entry_count": 6455671, "repository": "https://github.com/MISP/misp-warninglists", "revision": "154896d7bf00be5c336e2aed5c60862e60c40a17", "warninglists": [ { "entry_count": 503, "examples": [ "1.192.192.4/32", "1.192.192.6/32", "1.192.192.8/32", "1.192.195.11/32", "1.192.195.5/32" ], "id": "quake-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/quake-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation 360 Quake (quake.360.net), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "360 Quake (quake.360.net) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/quake-scanning/list.json" }, { "entry_count": 658, "examples": [ "103.29.68.220/32", "103.3.63.60/32", "104.200.21.21/32", "104.200.30.136/32", "104.200.30.247/32" ], "id": "a10networks-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/a10networks-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation A10 Networks (a10protects.com / a10networks.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "A10 Networks (a10protects.com / a10networks.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/a10networks-scanning/list.json" }, { "entry_count": 62, "examples": [ "104.156.155.0/24", "104.237.151.205/32", "139.162.119.12/32", "139.162.119.146/32", "139.162.119.196/32" ], "id": "academyforinternetresearch-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/academyforinternetresearch-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Academy for Internet Research (academyforinternetresearch.org), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Academy for Internet Research (academyforinternetresearch.org) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/academyforinternetresearch-scanning/list.json" }, { "entry_count": 15, "examples": [ "185.200.118.32/32", "185.200.118.34/31", "185.200.118.36/30", "185.200.118.40/29", "185.200.118.48/29" ], "id": "adscore-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/adscore-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Adscore (adscore.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Adscore (adscore.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/adscore-scanning/list.json" }, { "entry_count": 5, "examples": [ "158.94.187.0/24", "158.94.218.0/24", "194.187.176.0/22", "2a0e:7b84::/30", "45.83.64.0/22" ], "id": "alphastrike-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/alphastrike-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP ranges associated with Alpha Strike Labs scanning infrastructure. Alpha Strike Labs GmbH (AS208843) operates legitimate security research and internet-wide scanning services [https://ipinfo.io/AS208843]", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Alpha Strike Labs IP Ranges Used for Scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/alphastrike-scanning/list.json" }, { "entry_count": 22, "examples": [ "194.187.176.1/32", "194.187.176.128/25", "194.187.176.16/28", "194.187.176.2/31", "194.187.176.32/27" ], "id": "alphastrike-research-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/alphastrike-research-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the Alphastrike research scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Alphastrike research IP Ranges Used for Scanning", "type": "cidr", "version": 26100813 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/alphastrike-research-nt-scanning/list.json" }, { "entry_count": 12972, "examples": [ "100.20.118.33/32", "100.20.138.123/32", "100.20.153.121/32", "100.20.177.21/32", "100.20.181.236/32" ], "id": "binaryedge-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/binaryedge-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation BinaryEdge (binaryedge.io / binaryedge.ninja), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "BinaryEdge (binaryedge.io / binaryedge.ninja) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/binaryedge-scanning/list.json" }, { "entry_count": 6, "examples": [ "109.105.208.0/21", "185.117.225.0/24", "185.180.140.0/22", "185.226.196.0/22", "2a10:3c0::/29" ], "id": "bitsight-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/bitsight-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation BitSight Technologies Inc. / Internet Census Group (bitsight.com / internet-census.org), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "BitSight Technologies Inc. / Internet Census Group (bitsight.com / internet-census.org) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/bitsight-scanning/list.json" }, { "entry_count": 31, "examples": [ "139.144.235.132/32", "139.144.239.72/32", "139.144.239.74/32", "162.216.18.113/32", "170.187.163.117/32" ], "id": "bufferover-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/bufferover-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the Bufferover scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Bufferover IP Ranges Used for Scanning", "type": "cidr", "version": 26100813 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/bufferover-nt-scanning/list.json" }, { "entry_count": 48, "examples": [ "139.144.235.132/32", "139.144.239.72/32", "139.144.239.74/32", "162.216.18.113/32", "170.187.163.117/32" ], "id": "bufferoverrun-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/bufferoverrun-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation bufferover.run / erbbysam (bufferover.run), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "bufferover.run / erbbysam (bufferover.run) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/bufferoverrun-scanning/list.json" }, { "entry_count": 21, "examples": [ "android.clients.google.com", "apple.com", "captive.apple.com", "clients3.google.com", "clients4.google.com" ], "id": "captive-portals", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/captive-portals/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "Hostnames used by different desktop and mobile device operating systems for captive portal detection as documented by the Wireless Broadband Alliance.", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "Captive Portal Detection Hostnames", "type": "string", "version": 20230130 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/captive-portals/list.json" }, { "entry_count": 23, "examples": [ "162.142.125.0/24", "167.248.133.0/24", "167.94.138.0/24", "167.94.145.0/24", "167.94.146.0/24" ], "id": "censys-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/censys-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with Censys scanning [https://support.censys.io/hc/en-us/articles/360043177092-Opt-Out-of-Data-Collection#Can_I_opt_out_of_Censys_data_collection?]", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Censys IP Ranges Used for Scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/censys-scanning/list.json" }, { "entry_count": 20, "examples": [ "185.194.94.170", "185.194.94.171", "185.194.94.172", "185.194.94.173", "185.194.94.174" ], "id": "circl-security-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/circl-security-scanning/list.json", "matching_attributes": [ "ip-src", "domain|ip", "ip-src|port" ], "metadata": { "category": "known", "description": "CIRCL IP address to conducting non-intrusive security scans on Luxembourg IP addresses", "matching_attributes": [ "ip-src", "domain|ip", "ip-src|port" ], "name": "CIRCL IP address used for security scanning", "type": "cidr", "version": 26081402 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/circl-security-scanning/list.json" }, { "entry_count": 2, "examples": [ "185.194.93.130", "2a00:5980:93::130" ], "id": "circl-ssh-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/circl-ssh-scanning/list.json", "matching_attributes": [ "ip-src", "domain|ip", "ip-src|port" ], "metadata": { "category": "known", "description": "CIRCL IP address to conducting non-intrusive SSH scans", "matching_attributes": [ "ip-src", "domain|ip", "ip-src|port" ], "name": "CIRCL IP address used for SSH scanning", "type": "cidr", "version": 26081402 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/circl-ssh-scanning/list.json" }, { "entry_count": 5, "examples": [ "hit-adult.opendns.com", "hit-block.opendns.com", "hit-botnet.opendns.com", "hit-malware.opendns.com", "hit-phish.opendns.com" ], "id": "umbrella-blockpage-hostname", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/umbrella-blockpage-hostname/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "Umbrella blockpage hostnames", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "cisco-umbrella-blockpage-hostname", "type": "hostname", "version": 20260811 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/umbrella-blockpage-hostname/list.json" }, { "entry_count": 6, "examples": [ "146.112.61.104", "146.112.61.105", "146.112.61.106", "146.112.61.107", "146.112.61.108" ], "id": "umbrella-blockpage-v4", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/umbrella-blockpage-v4/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip" ], "metadata": { "description": "Cisco Umbrella blockpage in IPv4", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip" ], "name": "cisco-umbrella-blockpage-ipv4", "type": "cidr", "version": 20260811 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/umbrella-blockpage-v4/list.json" }, { "entry_count": 6, "examples": [ "::ffff:9270:3d68", "::ffff:9270:3d69", "::ffff:9270:3d6a", "::ffff:9270:3d6b", "::ffff:9270:3d6c" ], "id": "umbrella-blockpage-v6", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/umbrella-blockpage-v6/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip" ], "metadata": { "description": "Cisco Umbrella blockpage in IPv6", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip" ], "name": "cisco-umbrella-blockpage-ipv6", "type": "cidr", "version": 20260811 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/umbrella-blockpage-v6/list.json" }, { "entry_count": 1307, "examples": [ "100.20.177.21/32", "100.21.51.20/32", "100.22.0.89/32", "100.22.234.236/32", "104.237.139.124/32" ], "id": "coalition-signals-intelligence-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/coalition-signals-intelligence-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the Coalition signals intelligence scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/08/10", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Coalition signals intelligence IP Ranges Used for Scanning", "type": "cidr", "version": 26081011 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/coalition-signals-intelligence-nt-scanning/list.json" }, { "entry_count": 1, "examples": [ "/^(security|noc|soc|abuse)\\@.*\\..*$/i" ], "id": "common-contact-emails", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/common-contact-emails/list.json", "matching_attributes": [ "email-dst", "email-src", "target-email" ], "metadata": { "description": "A list of commonly used abuse and contact e-mail addresses, including the ones denoted in RFC2142.", "matching_attributes": [ "email-dst", "email-src", "target-email" ], "name": "Common contact e-mail addresses", "type": "regex", "version": 20200226 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/common-contact-emails/list.json" }, { "entry_count": 753, "examples": [ "2019novelcoronavirusoracle.com", "3d.nicovideo.jp", "3dcovid19.tech", "aanvraagcoronapremie.be", "account.nicovideo.jp" ], "id": "covid-19-cyber-threat-coalition-whitelist", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/covid-19-cyber-threat-coalition-whitelist/list.json", "matching_attributes": [ "domain", "hostname", "url" ], "metadata": { "description": "The Cyber Threat Coalition's whitelist of COVID-19 related websites.", "matching_attributes": [ "domain", "hostname", "url" ], "name": "Covid-19 Cyber Threat Coalition's Whitelist", "type": "hostname", "version": 20260811 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/covid-19-cyber-threat-coalition-whitelist/list.json" }, { "entry_count": 99, "examples": [ "akkure4covid.com", "api.contracovid.com.br", "app.contracovid.com.br", "auxilio.caixa.gov.br", "bag-coronavirus.ch" ], "id": "covid-19-krassi-whitelist", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/covid-19-krassi-whitelist/list.json", "matching_attributes": [ "domain", "hostname", "url" ], "metadata": { "description": "Krassimir's Covid-19 whitelist of known good Covid-19 related websites.", "matching_attributes": [ "domain", "hostname", "url" ], "name": "Covid-19 Krassi's Whitelist", "type": "hostname", "version": 20260811 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/covid-19-krassi-whitelist/list.json" }, { "entry_count": 1, "examples": [ "185.242.226.0/24" ], "id": "criminalip-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/criminalip-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Criminal IP / AiSpera (criminalip.com / aispera.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Criminal IP / AiSpera (criminalip.com / aispera.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/criminalip-scanning/list.json" }, { "entry_count": 220, "examples": [ "br-root-ca1-2020.ocsp.d-trust.net", "c.pki.goog", "cdn.d-trust-cloudcrl.net", "cdp-ldap.intranet.eon.com", "cdp.disig.sk" ], "id": "crl-hostname", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/crl-hostname/list.json", "matching_attributes": [ "hostname", "domain", "domain|ip" ], "metadata": { "description": "Domains that belongs to CRL or OCSP", "matching_attributes": [ "hostname", "domain", "domain|ip" ], "name": "CRL and OCSP domains", "type": "string", "version": 20261005 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/crl-hostname/list.json" }, { "entry_count": 385, "examples": [ "103.165.181.22", "104.18.20.226", "104.18.21.226", "104.18.38.233", "106.120.110.60" ], "id": "crl-ip", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/crl-ip/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "description": "IP addresses that belongs to CRL or OCSP", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "CRL and OCSP IP addresses", "type": "cidr", "version": 20261005 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/crl-ip/list.json" }, { "entry_count": 6, "examples": [ "18.97.19.128/25", "18.97.26.0/24", "18.97.5.0/25", "44.220.185.0/24", "44.220.188.0/24" ], "id": "crowdstrikefalconsurface-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/crowdstrikefalconsurface-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation CrowdStrike Falcon Surface (crowdstrike.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "CrowdStrike Falcon Surface (crowdstrike.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/crowdstrikefalconsurface-scanning/list.json" }, { "entry_count": 5, "examples": [ "66.240.223.214/32", "66.240.223.240/32", "66.240.236.109/32", "66.240.236.116/32", "71.6.199.87/32" ], "id": "cybcube-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cybcube-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation CyberCube (cybcube.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "CyberCube (cybcube.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cybcube-scanning/list.json" }, { "entry_count": 1, "examples": [ "52.73.169.169/32" ], "id": "cybergreen-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cybergreen-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation CyberGreen Institute (cybergreen.net), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "CyberGreen Institute (cybergreen.net) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cybergreen-scanning/list.json" }, { "entry_count": 1, "examples": [ "52.73.169.169/32" ], "id": "cybergreen-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cybergreen-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the Cybergreen scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2025/12/10", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Cybergreen IP Ranges Used for Scanning", "type": "cidr", "version": 25121023 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cybergreen-nt-scanning/list.json" }, { "entry_count": 1, "examples": [ "85.142.100.0/24" ], "id": "cyberok-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cyberok-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation CyberOK (cyberok.ru), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "CyberOK (cyberok.ru) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cyberok-scanning/list.json" }, { "entry_count": 15, "examples": [ "104.248.206.108/32", "143.198.115.76/32", "159.223.217.240/32", "159.89.1.53/32", "161.35.108.63/32" ], "id": "cyberresilience-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cyberresilience-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation CyberResilience (cyberresilience.io), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "CyberResilience (cyberresilience.io) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cyberresilience-scanning/list.json" }, { "entry_count": 14, "examples": [ "104.248.206.108/32", "137.184.75.34/32", "137.184.78.203/32", "138.68.73.85/32", "142.93.49.93/32" ], "id": "cyberresilience-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cyberresilience-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the Cyberresilience scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Cyberresilience IP Ranges Used for Scanning", "type": "cidr", "version": 26100813 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cyberresilience-nt-scanning/list.json" }, { "entry_count": 484, "examples": [ "104.248.122.5/32", "104.248.138.26/32", "104.248.20.160/32", "104.248.22.153/32", "104.248.23.98/32" ], "id": "odin-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/odin-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Cyble ODIN (odin.io), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Cyble ODIN (odin.io) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/odin-scanning/list.json" }, { "entry_count": 21, "examples": [ "18.117.57.162/32", "18.190.163.148/32", "18.217.194.148/32", "18.221.137.47/32", "18.223.104.85/32" ], "id": "cypex-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cypex-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Cypex (cypex.ai), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Cypex (cypex.ai) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cypex-scanning/list.json" }, { "entry_count": 10, "examples": [ "18.117.57.162/32", "18.190.163.148/32", "18.217.194.148/32", "18.221.137.47/32", "18.223.104.85/32" ], "id": "cypex-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cypex-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the Cypex scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/04/09", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Cypex IP Ranges Used for Scanning", "type": "cidr", "version": 26040915 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cypex-nt-scanning/list.json" }, { "entry_count": 4, "examples": [ "204.130.133.143/32", "204.130.133.193/32", "2607:fae0:f202:44c::143/128", "2607:fae0:f202:44c::193/128" ], "id": "dataplane-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/dataplane-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Dataplane.org (dataplane.org), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Dataplane.org (dataplane.org) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/dataplane-scanning/list.json" }, { "entry_count": 11, "examples": [ "107.20.158.220/32", "13.126.5.12/32", "3.234.180.95/32", "3.7.157.159/32", "3.7.173.162/32" ], "id": "detectify-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/detectify-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Detectify (detectify.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Detectify (detectify.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/detectify-scanning/list.json" }, { "entry_count": 1, "examples": [ "185.114.175.0/24" ], "id": "edgewatch-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/edgewatch-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Edgewatch Security Intelligence (edgewatch.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Edgewatch Security Intelligence (edgewatch.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/edgewatch-scanning/list.json" }, { "entry_count": 1, "examples": [ "142.93.146.198/32" ], "id": "eset-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/eset-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation ESET Research (eset.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "ESET Research (eset.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/eset-scanning/list.json" }, { "entry_count": 2, "examples": [ "46.161.50.108/31", "5.101.64.6/32" ], "id": "f6-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/f6-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the F6 scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "F6 IP Ranges Used for Scanning", "type": "cidr", "version": 26100813 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/f6-nt-scanning/list.json" }, { "entry_count": 7701, "examples": [ "0020d198028d12c73a2872376e24fbd73a39e39bf09338ac3b6495dd785df678", "002393fa0a6825f77ef686e208620b97177791f02f07db2518480fbe37ce7bd8", "00250c293689880075fe9a82715e602877d53b5e", "0029aecf433fc4c7c61ce2f20c66c557", "002e6d642c2ee639b40fbed1020ee7beedf2e521f9b2bde46c958d32e6353e9d" ], "id": "mozilla-IntermediateCA", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/mozilla-IntermediateCA/list.json", "matching_attributes": [ "md5", "sha1", "sha256", "filename|md5", "filename|sha1", "filename|sha256", "x509-fingerprint-md5", "x509-fingerprint-sha1", "x509-fingerprint-sha256" ], "metadata": { "description": "Fingerprint of known intermediate of trusted certificates taken from Mozilla's lists at https://wiki.mozilla.org/CA", "matching_attributes": [ "md5", "sha1", "sha256", "filename|md5", "filename|sha1", "filename|sha256", "x509-fingerprint-md5", "x509-fingerprint-sha1", "x509-fingerprint-sha256" ], "name": "Fingerprint of known intermediate of trusted certificates", "type": "string", "version": 20261005 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/mozilla-IntermediateCA/list.json" }, { "entry_count": 516, "examples": [ "010c0695a6981914ffbf5fc6b0b695ea29e912a6", "018e13f0772532cf809bd1b17281867283fc48c6e13be9c69812854a490c1b05", "022d0582fa88ce140c0679de7f1410e945d7a56d", "02ed0eb28c14da45165c566791700d6451d7fb56f0b2ab1d3b8eb070e56edff5", "0552e6f83fdf65e8fa9670e666df28a4e21340b510cbe52566f97c4fb94b2bd1" ], "id": "mozilla-CA", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/mozilla-CA/list.json", "matching_attributes": [ "md5", "sha1", "sha256", "filename|md5", "filename|sha1", "filename|sha256", "x509-fingerprint-md5", "x509-fingerprint-sha1", "x509-fingerprint-sha256" ], "metadata": { "description": "Fingerprint of trusted CA certificates taken from Mozilla's lists at https://wiki.mozilla.org/CA", "matching_attributes": [ "md5", "sha1", "sha256", "filename|md5", "filename|sha1", "filename|sha256", "x509-fingerprint-md5", "x509-fingerprint-sha1", "x509-fingerprint-sha256" ], "name": "Fingerprint of trusted CA certificates", "type": "string", "version": 20260811 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/mozilla-CA/list.json" }, { "entry_count": 318, "examples": [ "101.36.106.109/32", "101.36.106.75/32", "101.36.107.46/32", "101.36.108.178/32", "101.36.108.184/32" ], "id": "fofa-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/fofa-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation FOFA Search Engine (fofa.info), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "FOFA Search Engine (fofa.info) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/fofa-scanning/list.json" }, { "entry_count": 998688, "examples": [ "0-1.ir", "0.freebasics.com", "0.nbastrakhan.net", "0.torrentoyunindir.com", "000-leo.x.yupoo.com" ], "id": "google-chrome-crux-1million", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/google-chrome-crux-1million/list.json", "matching_attributes": [ "hostname", "domain", "uri", "url" ], "metadata": { "description": "Cached Chrome Top Million Websites - top 1 million", "matching_attributes": [ "hostname", "domain", "uri", "url" ], "name": "google-chrome-crux-1million", "type": "string", "version": 20260908 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/google-chrome-crux-1million/list.json" }, { "entry_count": 7, "examples": [ "80.82.70.118/32", "80.82.70.133/32", "80.82.70.228/32", "80.82.77.202/32", "89.248.171.23/32" ], "id": "groupib-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/groupib-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Group-IB (rnd.group-ib.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Group-IB (rnd.group-ib.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/groupib-scanning/list.json" }, { "entry_count": 3, "examples": [ "143.198.179.104/32", "159.223.98.198/32", "198.211.109.100/32" ], "id": "hackertarget-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/hackertarget-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Hacker Target Pty Ltd (hackertarget.com / hackertarget.io), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Hacker Target Pty Ltd (hackertarget.com / hackertarget.io) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/hackertarget-scanning/list.json" }, { "entry_count": 7, "examples": [ "145.220.91.19/32", "2001:67c:6ec:2913:145:220:91:19/128", "51.15.115.141/32", "51.15.44.6/32", "51.15.56.200/32" ], "id": "hadrian-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/hadrian-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Hadrian (hdrn.nu / hadrian.io), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Hadrian (hdrn.nu / hadrian.io) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/hadrian-scanning/list.json" }, { "entry_count": 24645, "examples": [ "00014cb6ebc0e2fb3f83dec061fc8ac1", "00040c682b12de3c33ef3a1839260d4851073c94ce49ab32ac38dbd13c16e1c2", "000b86c93a586d1055074acbb05d93bbfc548d9380663e140721938696b9ef84", "000d32692ba88d6938780304c28fdba7", "000f5b33c5eb8d847c173df5da504fcf4fff4ac07265e1b5efcbc9354f123a11" ], "id": "ti-falsepositives", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/ti-falsepositives/list.json", "matching_attributes": [ "md5", "sha1", "sha256", "filename|md5", "filename|sha1", "filename|sha256" ], "metadata": { "description": "Hashes that are often included in IOC lists but are false positives.", "matching_attributes": [ "md5", "sha1", "sha256", "filename|md5", "filename|sha1", "filename|sha256" ], "name": "Hashes that are often included in IOC lists but are false positives.", "type": "string", "version": 20251216 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/ti-falsepositives/list.json" }, { "entry_count": 3521, "examples": [ "101.200.243.197/32", "101.201.38.226/32", "106.15.238.36/32", "111.7.106.104/30", "111.7.96.149/32" ], "id": "hunter-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/hunter-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Hunter Search Engine (hunter.how / hunter.qianxin.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Hunter Search Engine (hunter.how / hunter.qianxin.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/hunter-scanning/list.json" }, { "entry_count": 31, "examples": [ "154.16.44.0/24", "185.216.145.160/27", "185.223.235.0/26", "188.240.59.0/26", "193.124.20.224/27" ], "id": "infrawatch-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/infrawatch-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Infrawatch (infrawat.ch / infrawatch.com / infrawatch.app), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Infrawatch (infrawat.ch / infrawatch.com / infrawatch.app) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/infrawatch-scanning/list.json" }, { "entry_count": 253, "examples": [ "109.105.209.10/32", "109.105.209.12/30", "109.105.209.17/32", "109.105.209.18/31", "109.105.209.2/31" ], "id": "internet-census-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/internet-census-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the Internet census scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Internet census IP Ranges Used for Scanning", "type": "cidr", "version": 26100813 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/internet-census-nt-scanning/list.json" }, { "entry_count": 10, "examples": [ "209.188.108.0/24", "209.237.154.0/24", "2620:96:a000::/46", "2620:96:a004::/47", "2620:96:a006::/48" ], "id": "internetmeasurementresearch-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/internetmeasurementresearch-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Internet Measurement Research (internetmeasurementresearch.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Internet Measurement Research (internetmeasurementresearch.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/internetmeasurementresearch-scanning/list.json" }, { "entry_count": 2, "examples": [ "50.116.30.197/32", "96.126.112.111/32" ], "id": "internetmetrics-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/internetmetrics-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Internet Metrics (internet-metrics.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Internet Metrics (internet-metrics.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/internetmetrics-scanning/list.json" }, { "entry_count": 11, "examples": [ "104.237.150.176/32", "104.237.151.244/32", "172.104.210.143/32", "172.104.211.111/32", "172.104.23.19/32" ], "id": "internetresearchproject-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/internetresearchproject-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Internet Research Project (internet-research-project.net), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Internet Research Project (internet-research-project.net) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/internetresearchproject-scanning/list.json" }, { "entry_count": 1, "examples": [ "104.152.52.0/24" ], "id": "internettl-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/internettl-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation InterneTTL (internettl.org), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "InterneTTL (internettl.org) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/internettl-scanning/list.json" }, { "entry_count": 5, "examples": [ "213.32.122.80/28", "46.105.132.32/27", "51.254.59.112/28", "51.38.12.12/30", "51.38.12.20/30" ], "id": "intrinsec-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/intrinsec-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Intrinsec (intrinsec.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Intrinsec (intrinsec.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/intrinsec-scanning/list.json" }, { "entry_count": 3, "examples": [ "46.105.132.32/30", "51.38.12.12/30", "51.38.12.20/30" ], "id": "intrinsec-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/intrinsec-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the Intrinsec scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Intrinsec IP Ranges Used for Scanning", "type": "cidr", "version": 26100813 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/intrinsec-nt-scanning/list.json" }, { "entry_count": 36, "examples": [ "13.115.104.128/25", "13.210.1.64/26", "13.213.79.0/24", "13.56.21.128/25", "13.59.252.0/25" ], "id": "intruder-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/intruder-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Intruder (intruder.io), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Intruder (intruder.io) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/intruder-scanning/list.json" }, { "entry_count": 3062, "examples": [ "102.130.49.212/32", "102.164.61.103/32", "102.164.62.251/32", "102.177.72.174/32", "102.18.119.21/32" ], "id": "ipinfo-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/ipinfo-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation IPinfo Internet Census Data Collection (ipinfo.io), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "IPinfo Internet Census Data Collection (ipinfo.io) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/ipinfo-scanning/list.json" }, { "entry_count": 15, "examples": [ "146.185.219.214/32", "146.185.248.89/32", "37.9.35.222/32", "5.188.133.153/32", "5.188.168.53/32" ], "id": "ipinfo-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/ipinfo-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the Ipinfo scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Ipinfo IP Ranges Used for Scanning", "type": "cidr", "version": 26100813 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/ipinfo-nt-scanning/list.json" }, { "entry_count": 55, "examples": [ "103.16.130.243/32", "103.16.131.136/32", "103.203.56.0/22", "103.230.157.150/32", "103.29.69.181/32" ], "id": "ipip-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/ipip-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation IPIP (ipip.net), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "IPIP (ipip.net) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/ipip-scanning/list.json" }, { "entry_count": 21, "examples": [ "103.203.56.0/32", "103.203.57.0/32", "103.203.57.13/32", "103.203.57.15/32", "103.203.57.16/31" ], "id": "ipip-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/ipip-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the Ipip scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Ipip IP Ranges Used for Scanning", "type": "cidr", "version": 26100813 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/ipip-nt-scanning/list.json" }, { "entry_count": 8, "examples": [ "101.132.145.132/32", "112.74.38.239/32", "47.89.154.16/32", "47.91.125.252/32", "8.208.10.94/32" ], "id": "ki3-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/ki3-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation KI3 (ki3.org.cn), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "KI3 (ki3.org.cn) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/ki3-scanning/list.json" }, { "entry_count": 1, "examples": [ "88.80.189.24/32" ], "id": "knoq-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/knoq-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Knoq (knoq.nl), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Knoq (knoq.nl) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/knoq-scanning/list.json" }, { "entry_count": 188, "examples": [ "104.237.130.38/32", "128.199.182.152/32", "128.199.182.55/32", "128.199.182.77/32", "134.122.28.88/32" ], "id": "leakix-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/leakix-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation LeakIX (leakix.org / leakix.net), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "LeakIX (leakix.org / leakix.net) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/leakix-scanning/list.json" }, { "entry_count": 4, "examples": [ "14d82eec-204b-4c2f-b7e8-296a70dab67e", "5572c4c0-d078-44ce-b81c-6cbf8d3ed39e", "7ae974c5-1af7-4923-af3a-fb1fd14dcb7e", "de8bc8b5-d9f9-48b1-a8ad-b748da725064" ], "id": "microsoft-azure-appid", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-azure-appid/list.json", "matching_attributes": [ "azure-application-id" ], "metadata": { "description": "List of Azure Application IDs (https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in)", "matching_attributes": [ "azure-application-id" ], "name": "List of Azure Applicaiton IDs", "type": "string", "version": 20260811 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-azure-appid/list.json" }, { "entry_count": 9205, "examples": [ "0-mail.com", "0-mailer.dynv6.net", "000-webmail.myhome-server.de", "000000000000000.theworkpc.com", "000000000000000000.dynv6.net" ], "id": "disposable-email", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/disposable-email/list.json", "matching_attributes": [ "email-src", "email-dst", "whois-registrant-email", "domain|ip", "dns-soa-email" ], "metadata": { "category": "known", "description": "List of disposable email domains", "matching_attributes": [ "email-src", "email-dst", "whois-registrant-email", "domain|ip", "dns-soa-email" ], "name": "List of disposable email domains", "type": "substring", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/disposable-email/list.json" }, { "entry_count": 15, "examples": [ "2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad", "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f", "3395856ce81f2b7382dee72602f798b642f14140", "44d88612fea8a8f36de82e1278abb02f", "6ce6f415d8475545be5ba114f208b0ff" ], "id": "eicar.com", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/eicar.com/list.json", "matching_attributes": [ "md5", "sha1", "sha256", "sha512", "filename|md5", "filename|sha1", "filename|sha256", "filename|sha512" ], "metadata": { "description": "Event contains one or more entries based on hashes for EICAR test virus", "matching_attributes": [ "md5", "sha1", "sha256", "sha512", "filename|md5", "filename|sha1", "filename|sha256", "filename|sha512" ], "name": "List of hashes for EICAR test virus", "type": "string", "version": 20200403 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/eicar.com/list.json" }, { "entry_count": 1, "examples": [ "FE80::/10" ], "id": "ipv6-linklocal", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/ipv6-linklocal/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "description": "Event contains one or more entries part of the IPv6 link local prefix (RFC 4291)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "List of IPv6 link local blocks", "type": "cidr", "version": 20220705 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/ipv6-linklocal/list.json" }, { "entry_count": 346, "examples": [ "103.11.223.0/24", "103.12.23.0/24", "103.13.37.0/24", "103.15.143.0/24", "103.16.197.0/24" ], "id": "akamai", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/akamai/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Akamai IP ranges from BGP search", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Akamai IP ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/akamai/list.json" }, { "entry_count": 334, "examples": [ "101.132.0.0/15", "101.200.0.0/15", "101.37.0.0/16", "103.135.210.0/23", "103.173.12.0/23" ], "id": "alibaba-cloud", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/alibaba-cloud/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Alibaba Cloud (Aliyun) IPv4 and IPv6 ranges, from the prefixes its verified autonomous systems announce, read live from the RIPEstat Data API (https://stat.ripe.net/). Alibaba Cloud publishes no address-space feed of its own. This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Alibaba Cloud IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/alibaba-cloud/list.json" }, { "entry_count": 4083, "examples": [ "1.178.1.0/24", "1.178.100.0/22", "1.178.16.0/20", "1.178.172.0/23", "1.178.174.0/24" ], "id": "amazon-aws", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/amazon-aws/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Amazon AWS IP address ranges (https://ip-ranges.amazonaws.com/ip-ranges.json)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Amazon AWS IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/amazon-aws/list.json" }, { "entry_count": 1891, "examples": [ "100beatscheap.com", "12diasdepresentesdeitunes.com", "12diasderegalosdeitunes.cl", "12diasderegalosdeitunes.co", "12diasderegalosdeitunes.co.cr" ], "id": "apple-domains", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/apple-domains/list.json", "matching_attributes": [ "hostname", "domain", "domain|ip", "url" ], "metadata": { "description": "Hosts that Apple products need to access on enterprise networks, merged from Apple's support article (https://support.apple.com/en-us/101555) and the v2fly domain-list-community 'apple' data set (and its includes).", "matching_attributes": [ "hostname", "domain", "domain|ip", "url" ], "name": "List of known Apple hosts for enterprise networks", "type": "hostname", "version": 20260829 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/apple-domains/list.json" }, { "entry_count": 4, "examples": [ "17.0.0.0/8", "192.12.74.0/24", "192.42.249.0/24", "204.79.190.0/24" ], "id": "apple", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/apple/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "description": "IP ranges assigned to Apple", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Apple IP ranges", "type": "cidr", "version": 20241023 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/apple/list.json" }, { "entry_count": 5, "examples": [ "139.178.128.0/18", "144.178.0.0/18", "17.0.0.0/8", "57.102.0.0/15", "65.199.22.0/23" ], "id": "apple-ipv4", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/apple-ipv4/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "description": "Apple IPv4 ranges announced by AS714 and AS6185", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Apple IPv4 ranges", "type": "cidr", "version": 20260829 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/apple-ipv4/list.json" }, { "entry_count": 5, "examples": [ "2403:300::/32", "2620:0:1b00::/48", "2620:149::/32", "2a01:b740::/32", "2a01:b747::/32" ], "id": "apple-ipv6", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/apple-ipv6/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "description": "Apple IPv6 ranges announced by AS714 and AS6185", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Apple IPv6 ranges", "type": "cidr", "version": 20260829 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/apple-ipv6/list.json" }, { "entry_count": 2226, "examples": [ ".02bancorp.com", ".1822direkt.com", ".1stbk.com", ".1stfed.com", ".1stfedvw.com" ], "id": "bank-website", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/bank-website/list.json", "matching_attributes": [ "domain", "hostname", "domain|ip", "url" ], "metadata": { "description": "Event contains one or more entries of known banking website", "matching_attributes": [ "domain", "hostname", "domain|ip", "url" ], "name": "List of known bank domains", "type": "hostname", "version": 20260414 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/bank-website/list.json" }, { "entry_count": 908, "examples": [ "102.219.126.20", "102.67.138.155", "103.108.229.5", "103.108.231.41", "103.135.249.250" ], "id": "bunny-net", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/bunny-net/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "List of known Bunny.net CDN IP ranges (https://support.bunny.net/hc/en-us/articles/115003578911-How-to-detect-when-BunnyCDN-PoP-servers-are-accessing-your-backend)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Bunny.net CDN ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/bunny-net/list.json" }, { "entry_count": 10, "examples": [ "167.71.238.159/32", "167.88.158.0/24", "195.191.102.0/23", "204.93.142.0/23", "204.93.150.0/24" ], "id": "cachefly", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cachefly/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "CacheFly IP address ranges (https://cachefly.cachefly.net/ips/cdn.txt)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known CacheFly IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cachefly/list.json" }, { "entry_count": 36, "examples": [ "109.61.88.160/27", "109.61.90.128/25", "143.244.33.128/26", "143.244.51.0/26", "143.244.51.192/26" ], "id": "cdn77", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cdn77/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "CDN77 IP address ranges (https://prefixlists.tools.cdn77.com/public_lmax_prefixes.json)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known CDN77 IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cdn77/list.json" }, { "entry_count": 59, "examples": [ "103.125.218.226/32", "103.214.169.52/32", "103.42.116.205/32", "104.28.192.94/32", "107.149.201.15/32" ], "id": "check-host-net", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/check-host-net/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "check-host IP addresses (https://check-host.net/nodes/ips)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known check-host.net IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/check-host-net/list.json" }, { "entry_count": 22, "examples": [ "103.21.244.0/22", "103.22.200.0/22", "103.31.4.0/22", "104.16.0.0/13", "104.24.0.0/14" ], "id": "cloudflare", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "List of known Cloudflare IP ranges (https://www.cloudflare.com/ips/)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Cloudflare IP ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare/list.json" }, { "entry_count": 7, "examples": [ "166.19.0.0/16", "192.112.160.0/20", "198.176.96.0/20", "207.53.232.0/22", "216.153.48.0/20" ], "id": "coreweave", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/coreweave/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "CoreWeave IP address ranges, from the prefixes announced by the autonomous systems held by CoreWeave, Inc (AS33425, AS46992) as reported by the RIPEstat Data API. This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known CoreWeave IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/coreweave/list.json" }, { "entry_count": 13, "examples": [ ".bmw.de", ".deutsche-boerse.com", ".innogy.com", ".linde.de", ".lufthansa.com" ], "id": "dax30", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/dax30/list.json", "matching_attributes": [ "domain", "hostname", "domain|ip" ], "metadata": { "description": "Event contains one or more entries of known dax30 webpages", "matching_attributes": [ "domain", "hostname", "domain|ip" ], "name": "List of known dax30 webpages", "type": "hostname", "version": 20200403 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/dax30/list.json" }, { "entry_count": 235, "examples": [ "103.253.145.0/24", "103.253.146.0/23", "104.131.0.0/16", "104.236.0.0/16", "104.248.0.0/16" ], "id": "digitalocean", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/digitalocean/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "DigitalOcean IP address ranges, from their published RFC 8805 geofeed (https://digitalocean.com/geo/google.csv)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known DigitalOcean IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/digitalocean/list.json" }, { "entry_count": 234, "examples": [ "2ip.ru", "2ip.tools", "aboutmyip.com", "api.ipify.org", "api.myip.com" ], "id": "whats-my-ip", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/whats-my-ip/list.json", "matching_attributes": [ "domain", "hostname", "domain|ip", "uri", "url" ], "metadata": { "description": "Event contains one or more entries of known 'what's my ip' domains", "matching_attributes": [ "domain", "hostname", "domain|ip", "uri", "url" ], "name": "List of known domains to know external IP", "type": "hostname", "version": 20260809 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/whats-my-ip/list.json" }, { "entry_count": 47, "examples": [ "akana.mobiseclab.org", "analyze.intezer.com", "anlyz.io", "app.any.run", "app.sndbox.com" ], "id": "automated-malware-analysis", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/automated-malware-analysis/list.json", "matching_attributes": [ "domain", "hostname", "domain|ip", "url" ], "metadata": { "description": "Domains used by automated malware analysis services & security vendors", "matching_attributes": [ "domain", "hostname", "domain|ip", "url" ], "name": "List of known domains used by automated malware analysis services & security vendors", "type": "substring", "version": 20260904 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/automated-malware-analysis/list.json" }, { "entry_count": 45, "examples": [ "107.170.65.169/32", "128.199.8.140/32", "157.245.243.118/32", "157.245.245.246/32", "159.65.216.50/32" ], "id": "driftnet", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/driftnet/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Driftnet / Internet-Measurement IP address ranges (https://internet-measurement.com/)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Driftnet / Internet-Measurement IP ranges (https://internet-measurement.com/)", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/driftnet/list.json" }, { "entry_count": 45603, "examples": [ ".0000000000000000000000.com", ".0000004.xyz", ".00008192.xyz", ".00010010.org", ".0001124.xyz" ], "id": "dynamic-dns", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/dynamic-dns/list.json", "matching_attributes": [ "domain", "hostname", "domain|ip" ], "metadata": { "category": "known", "description": "Event contains one or more entries of known dynamic DNS domains.", "matching_attributes": [ "domain", "hostname", "domain|ip" ], "name": "List of known dynamic DNS domains", "type": "hostname", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/dynamic-dns/list.json" }, { "entry_count": 21, "examples": [ "103.244.50.0/24", "103.245.222.0/23", "103.245.224.0/24", "104.156.80.0/20", "140.248.128.0/17" ], "id": "fastly", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/fastly/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Fastly IP address ranges (https://api.fastly.com/public-ip-list)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Fastly IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/fastly/list.json" }, { "entry_count": 322, "examples": [ "1.37.77.96/28", "101.53.220.208/29", "102.130.69.140/30", "102.208.99.250/31", "102.216.238.168/29" ], "id": "gcore", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/gcore/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Gcore CDN IP address ranges (https://api.gcore.com/cdn/public-net-list)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Gcore CDN IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/gcore/list.json" }, { "entry_count": 479, "examples": [ "104.154.113.0/24", "104.154.114.0/23", "104.154.116.0/22", "104.154.120.0/23", "104.154.128.0/17" ], "id": "google-gcp", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/google-gcp/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "GCP (Google Cloud Platform) IP address ranges (https://www.gstatic.com/ipranges/cloud.json)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known GCP (Google Cloud Platform) IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/google-gcp/list.json" }, { "entry_count": 5204, "examples": [ "100.62.132.232/32", "100.62.139.158/32", "104.208.0.0/19", "104.208.128.0/17", "104.208.32.0/20" ], "id": "github", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/github/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "GitHub IP address ranges (https://api.github.com/meta)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known GitHub IP ranges (https://api.github.com/meta)", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/github/list.json" }, { "entry_count": 8, "examples": [ "2001:4860:4864::/56", "209.85.128.0/17", "2404:6800:4864::/56", "2607:f8b0:4864::/56", "2800:3f0:4864::/56" ], "id": "google-gmail-sending-ips", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/google-gmail-sending-ips/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "List of known Gmail sending IP ranges (https://support.google.com/a/answer/27642?hl=en)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Gmail sending IP ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/google-gmail-sending-ips/list.json" }, { "entry_count": 161, "examples": [ "103.44.220.0/24", "103.87.189.0/24", "103.87.190.0/23", "104.238.64.0/18", "107.180.0.0/17" ], "id": "godaddy", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/godaddy/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "GoDaddy IP address ranges, collected from the prefixes announced by the autonomous systems of GoDaddy.com, LLC and GoDaddy Host Europe GmbH, via the RIPEstat Data API (https://stat.ripe.net/data/announced-prefixes/data.json). Note this is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known GoDaddy IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/godaddy/list.json" }, { "entry_count": 7556, "examples": [ "0.chart.apis.google.com", "0.client-channel.google.com", "0.firebaseio.com", "0.fls.doubleclick.net", "00.firebaseio.com" ], "id": "google", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/google/list.json", "matching_attributes": [ "domain", "hostname", "domain|ip", "url" ], "metadata": { "description": "Event contains one or more entries of known google domains, merged from Google's own supported_domains list, the nickspaargaren/no-google community blocklist, and the v2fly domain-list-community 'google' data set.", "matching_attributes": [ "domain", "hostname", "domain|ip", "url" ], "name": "List of known google domains", "type": "hostname", "version": 20261005 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/google/list.json" }, { "entry_count": 59, "examples": [ "192.178.4.0/24", "192.178.5.0/27", "192.178.6.0/23", "2001:4860:4801:10::/60", "2001:4860:4801:20::/59" ], "id": "googlebot", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/googlebot/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "description": "Google Bot IP address ranges (https://developers.google.com/search/apis/ipranges/googlebot.json)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Googlebot IP ranges (https://developers.google.com/search/apis/ipranges/googlebot.json)", "type": "cidr", "version": 20260901 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/googlebot/list.json" }, { "entry_count": 197415, "examples": [ "00002c0f93816b3f8e432547b295ac29", "0000a47b73c377a2ec61f78b196fb448", "0001098c33b66779505bc2e3b14d50c818e2abf25c99afa5194f954b07a454cf", "000184038785e19255c415e79e698ced83d8f043", "0001b55cfd0c5e837280da7d76743f0266c1a033" ], "id": "nioc-filehash", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/nioc-filehash/list.json", "matching_attributes": [ "md5", "sha1", "sha256", "filename|md5", "filename|sha1", "filename|sha256" ], "metadata": { "description": "Event contains one or more benign files based on known hashes, see https://github.com/RichieB2B/nioc", "matching_attributes": [ "md5", "sha1", "sha256", "filename|md5", "filename|sha1", "filename|sha256" ], "name": "List of known hashes for benign files", "type": "string", "version": 20210501 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/nioc-filehash/list.json" }, { "entry_count": 6, "examples": [ "3::", "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e", "d14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42f", "d41d8cd98f00b204e9800998ecf8427e", "da39a3ee5e6b4b0d3255bfef95601890afd80709" ], "id": "empty-hashes", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/empty-hashes/list.json", "matching_attributes": [ "md5", "sha1", "sha224", "sha256", "sha512", "filename|md5", "filename|sha1", "filename|sha224", "filename|sha256", "filename|sha512", "ssdeep", "filename|ssdeep" ], "metadata": { "description": "Event contains one or more entries of empty files based on known hashed", "matching_attributes": [ "md5", "sha1", "sha224", "sha256", "sha512", "filename|md5", "filename|sha1", "filename|sha224", "filename|sha256", "filename|sha512", "ssdeep", "filename|ssdeep" ], "name": "List of known hashes for empty files", "type": "string", "version": 20200403 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/empty-hashes/list.json" }, { "entry_count": 789700, "examples": [ "000031f59f1d81be876257834e2c4d9aa89b72cda2c2507a4d53003e8307850e", "0000340cd15afe3c5d3e5d1b9818e7fa02bf635dab41ee6656a905c302700ae4", "000069963845056a276aef2f22c604cb03242463b8a50ced76e9d285d64f4d2f", "000081ad1f098ba1f545b402161cdd3191ccce58f294102b62117caa76b721a5", "0000b0742d5f72860d9f5f1178c9d992aa96e4d7c24da22683fd02a16630679c" ], "id": "windows-binary-hashes", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/windows-binary-hashes/list.json", "matching_attributes": [ "sha256" ], "metadata": { "description": "List of known Windows binaries based on hashes from winbindex (https://github.com/m417z/winbindex)", "matching_attributes": [ "sha256" ], "name": "List of known hashes for Windows binaries", "type": "string", "version": 20260709 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/windows-binary-hashes/list.json" }, { "entry_count": 69, "examples": [ "01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b", "048846ed8ed185a26394adeb3f63274d1029bbd59cffa8e73a4ef8b19456de1d", "06f7826c2862d184a49e3672c0aa6097b11e7771a4bf613ec37941236c1a8e20", "07c4c7ae2c4c7cb3ccd2ba9cd70a94382395ca8e2b0312c1631d09d790b6db33", "0f343b0931126a20f133d67c2b018a3b" ], "id": "common-ioc-false-positive", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/common-ioc-false-positive/list.json", "matching_attributes": [ "md5", "sha1", "sha224", "sha256", "sha512", "filename|md5", "filename|sha1", "filename|sha224", "filename|sha256", "filename|sha512" ], "metadata": { "description": "Event contains one or more entries with common false-positives", "matching_attributes": [ "md5", "sha1", "sha224", "sha256", "sha512", "filename|md5", "filename|sha1", "filename|sha224", "filename|sha256", "filename|sha512" ], "name": "List of known hashes with common false-positives (based on Florian Roth input list)", "type": "string", "version": 20200403 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/common-ioc-false-positive/list.json" }, { "entry_count": 166298, "examples": [ "116.202.0.0/19", "116.202.112.0/21", "116.202.128.0/21", "116.202.136.0/25", "116.202.137.0/26" ], "id": "hetzner", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/hetzner/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Hetzner Online GmbH IP address ranges, from their published RFC 8805 geofeed (https://www.hetzner.com/geofeed.csv). This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Hetzner IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/hetzner/list.json" }, { "entry_count": 24, "examples": [ "api.extralargecoffee.com", "api.ipify.org", "helper.rumble.network", "ip.circl.lu", "ip.dyn.bortzmeyer.fr" ], "id": "findip-host", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/findip-host/list.json", "matching_attributes": [ "domain", "hostname", "domain|ip" ], "metadata": { "description": "Event contains one or more entries of known hostname querying your source IP.", "matching_attributes": [ "domain", "hostname", "domain|ip" ], "name": "List of known hostname used for querying your source IP. This can be used as exclusion for your Passive DNS lookup.", "type": "hostname", "version": 20260809 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/findip-host/list.json" }, { "entry_count": 244, "examples": [ "1.178.32.0/19", "1.92.0.0/16", "1.94.0.0/18", "1.94.128.0/17", "1.94.64.0/20" ], "id": "huawei-cloud", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/huawei-cloud/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Huawei Cloud IP address ranges, from the RFC 8805 geofeed Huawei publishes for its cloud regions (https://res-static.hc-cdn.cn/cloudbu-site/china/zh-cn/IP-location/google-geo-feed.csv), the file referenced by the geofeed: attribute of Huawei Cloud's own inetnum objects in APNIC whois. This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Huawei Cloud IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/huawei-cloud/list.json" }, { "entry_count": 217, "examples": [ "103.106.108.0/24", "103.193.4.0/22", "103.197.160.0/22", "103.53.196.0/24", "103.70.48.0/24" ], "id": "ibm-cloud", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/ibm-cloud/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "IBM Cloud (ex-SoftLayer) IP address ranges, from the prefixes announced by its autonomous systems AS36351, AS46702, AS46703, AS46704 as reported by the RIPEstat Data API (https://stat.ripe.net/data/announced-prefixes/data.json). IBM publishes no unauthenticated machine-readable endpoint for these. Scoped to the SOFTLAYER-handle cloud fleet; IBM corporate address space is deliberately excluded. A minority of the announced prefixes are registered to third parties: those are customer / bring-your-own-IP ranges routed out of IBM Cloud's autonomous system and are kept on purpose. This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known IBM Cloud IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/ibm-cloud/list.json" }, { "entry_count": 14070, "examples": [ "104.28.100.10/31", "104.28.100.106/31", "104.28.100.108/30", "104.28.100.12/30", "104.28.100.16/32" ], "id": "icloud-private-relay", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/icloud-private-relay/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "iCloud Private Relay egress IP address ranges (https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay/)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known iCloud Private Relay egress IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/icloud-private-relay/list.json" }, { "entry_count": 12, "examples": [ "103.28.248.0/22", "107.154.0.0/16", "131.125.128.0/17", "149.126.72.0/21", "185.11.124.0/22" ], "id": "imperva", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/imperva/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Imperva (Incapsula) IP address ranges (https://my.imperva.com/api/integration/v1/ips)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Imperva (Incapsula) IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/imperva/list.json" }, { "entry_count": 15, "examples": [ "132.196.86.0/24", "172.182.202.0/25", "172.182.207.0/25", "20.125.66.80/28", "20.171.206.0/23" ], "id": "openai-gptbot", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/openai-gptbot/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "description": "OpenAI gptbot crawler (https://openai.com/gptbot.json)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known IP address ranges for OpenAI GPT crawler bot", "type": "cidr", "version": 20261005 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/openai-gptbot/list.json" }, { "entry_count": 10, "examples": [ "144.86.173.0/24", "147.185.132.0/22", "162.216.148.0/22", "172.105.147.0/24", "198.235.24.0/24" ], "id": "palo-alto-networks-cortex-xpanse", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/palo-alto-networks-cortex-xpanse/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Palo Alto Networks Cortex Xpanse (https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known IP address ranges for Palo Alto Networks Cortex Xpanse", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/palo-alto-networks-cortex-xpanse/list.json" }, { "entry_count": 11052, "examples": [ "102.128.164.0/23", "102.129.132.0/24", "102.129.141.0/24", "102.129.143.0/24", "102.129.145.130/31" ], "id": "vpn-ipv4", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/vpn-ipv4/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "IPv4 networks belonging to common VPN providers, from https://raw.githubusercontent.com/X4BNet/lists_vpn/main/output/vpn/ipv4.txt", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known IPv4 networks belonging to common VPN providers", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/vpn-ipv4/list.json" }, { "entry_count": 44428, "examples": [ "1.116.0.0/15", "1.118.3.0/24", "1.12.0.0/14", "1.178.1.0/24", "1.178.100.0/22" ], "id": "datacenter-ipv4", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/datacenter-ipv4/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "IPv4 networks belonging to datacenters and VPN providers, from https://raw.githubusercontent.com/X4BNet/lists_vpn/main/output/datacenter/ipv4.txt", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known IPv4 networks belonging to datacenters and VPN providers", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/datacenter-ipv4/list.json" }, { "entry_count": 62780, "examples": [ "1.0.0.1", "1.0.0.19", "1.0.0.2", "1.0.0.3", "1.0.127.132" ], "id": "public-dns-v4", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/public-dns-v4/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "description": "Event contains one or more public IPv4 DNS resolvers as attribute with an IDS flag set", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known IPv4 public DNS resolvers", "type": "cidr", "version": 20260829 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/public-dns-v4/list.json" }, { "entry_count": 498, "examples": [ "2001:550:1d05::/48", "2001:678:8b4::/48", "2001:978:2305::/48", "2001:978:3400::/48", "2001:ac8::/32" ], "id": "vpn-ipv6", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/vpn-ipv6/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "IPv6 networks belonging to common VPN providers, from https://raw.githubusercontent.com/X4BNet/lists_vpn/main/output/vpn/ipv6.txt", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known IPv6 networks belonging to common VPN providers", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/vpn-ipv6/list.json" }, { "entry_count": 8752, "examples": [ "2001:1520::/32", "2001:1598::/32", "2001:15e8::/32", "2001:1608::/32", "2001:1638::/32" ], "id": "datacenter-ipv6", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/datacenter-ipv6/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "IPv6 networks belonging to datacenters and VPN providers, from https://raw.githubusercontent.com/X4BNet/lists_vpn/main/output/datacenter/ipv6.txt", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known IPv6 networks belonging to datacenters and VPN providers", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/datacenter-ipv6/list.json" }, { "entry_count": 358, "examples": [ "2001:148f:fffe::1", "2001:148f:ffff::1", "2001:1608:10:25::1c04:b12f", "2001:1608:10:25::9249:d69b", "2001:19f0:5:3bd7:5400:4ff:fe05:da83" ], "id": "public-dns-v6", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/public-dns-v6/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "description": "Event contains one or more public IPv6 DNS resolvers as attribute with an IDS flag set", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known IPv6 public DNS resolvers", "type": "cidr", "version": 20260829 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/public-dns-v6/list.json" }, { "entry_count": 1386, "examples": [ "103.101.128.0/22", "103.119.218.0/23", "103.138.32.0/24", "103.139.48.0/23", "103.139.50.0/24" ], "id": "leaseweb", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/leaseweb/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Leaseweb IP address ranges, from the prefixes announced by the autonomous systems held by the Leaseweb group, as reported by the RIPEstat Data API (https://stat.ripe.net). Leaseweb publishes no address-space feed of its own. This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Leaseweb IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/leaseweb/list.json" }, { "entry_count": 91, "examples": [ "alllink.io", "artist.link", "beacons.ai", "bio.fm", "bio.site" ], "id": "link-in-bio", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/link-in-bio/list.json", "matching_attributes": [ "domain", "hostname", "domain|ip", "url" ], "metadata": { "category": "known", "description": "Event contains one or more entries of known Link in bio domains. Those shorten links are a reference to a list of links.", "matching_attributes": [ "domain", "hostname", "domain|ip", "url" ], "name": "List of known link in Bio domains", "type": "hostname", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/link-in-bio/list.json" }, { "entry_count": 279, "examples": [ "103.29.68.0/22", "103.3.60.0/22", "104.105.0.0/16", "104.111.0.0/18", "104.200.16.0/20" ], "id": "linode", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/linode/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Linode (Akamai Connected Cloud) IP address ranges, from their published RFC 8805 geofeed (https://geoip.linode.com/)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Linode (Akamai Connected Cloud) IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/linode/list.json" }, { "entry_count": 156, "examples": [ "103.9.10.0/24", "139.217.0.0/19", "139.217.128.0/19", "139.217.160.0/26", "139.217.160.128/28" ], "id": "microsoft-azure-china", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-azure-china/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Microsoft Azure China Datacenter IP Ranges", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Microsoft Azure China Datacenter IP Ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-azure-china/list.json" }, { "entry_count": 2337, "examples": [ "102.133.0.0/16", "102.37.0.0/16", "103.25.156.0/24", "103.255.140.0/23", "103.36.96.0/24" ], "id": "microsoft-azure", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-azure/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Microsoft Azure Datacenter IP Ranges", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Microsoft Azure Datacenter IP Ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-azure/list.json" }, { "entry_count": 36, "examples": [ "2a01:4180:2000::/40", "2a01:4180:2400::/40", "2a01:4180:4050:400::/64", "2a01:4180:4050:800::/64", "2a01:4180:4051:400::/64" ], "id": "microsoft-azure-germany", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-azure-germany/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Microsoft Azure Germany Datacenter IP Ranges", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Microsoft Azure Germany Datacenter IP Ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-azure-germany/list.json" }, { "entry_count": 161, "examples": [ "104.210.16.0/20", "104.212.32.0/23", "104.212.34.0/24", "104.212.43.0/24", "104.212.44.0/23" ], "id": "microsoft-azure-us-gov", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-azure-us-gov/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Microsoft Azure US Government Cloud Datacenter IP Ranges", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Microsoft Azure US Government Cloud Datacenter IP Ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-azure-us-gov/list.json" }, { "entry_count": 16, "examples": [ ".admin-mcas-df.ms", ".admin-mcas-gov-df.ms", ".admin-mcas-gov-df.us", ".admin-mcas-gov.ms", ".admin-mcas-gov.us" ], "id": "microsoft-mdca-proxy", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-mdca-proxy/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "Microsoft Defender for Cloud Apps (MDCA/MCAS) hostnames (https://learn.microsoft.com/en-us/defender-cloud-apps/troubleshooting-proxy-url)", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "List of known Microsoft Defender for Cloud Apps (MDCA/MCAS) proxy hostnames", "type": "hostname", "version": 20260819 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-mdca-proxy/list.json" }, { "entry_count": 322, "examples": [ ".aadrm.cn", ".aadrm.com", ".aadrm.us", ".acompli.net", ".admin.onedrive.us" ], "id": "microsoft", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft/list.json", "matching_attributes": [ "domain", "hostname", "domain|ip", "url" ], "metadata": { "description": "Event contains one or more entries of known microsoft domains", "matching_attributes": [ "domain", "hostname", "domain|ip", "url" ], "name": "List of known microsoft domains", "type": "string", "version": 20260908 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft/list.json" }, { "entry_count": 141, "examples": [ "52.168.52.134", "portal.docdeliveryapp.com", "portal.docdeliveryapp.net", "portal.docstoreinternal.com", "portal.hardwarecheck.net" ], "id": "microsoft-attack-simulator", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-attack-simulator/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain", "domain|ip", "hostname", "url" ], "metadata": { "description": "Office 365 URLs and IP address ranges used for their attack simulator in Office 365 Threat Intelligence", "matching_attributes": [ "ip-src", "ip-dst", "domain", "domain|ip", "hostname", "url" ], "name": "List of known Office 365 Attack Simulator used for phishing awareness campaigns", "type": "substring", "version": 20260405 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-attack-simulator/list.json" }, { "entry_count": 82, "examples": [ "104.146.128.0/17", "104.47.0.0/17", "13.107.128.0/22", "13.107.136.0/22", "13.107.140.6/32" ], "id": "microsoft-office365-ip", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-office365-ip/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Office 365 IP address ranges", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Office 365 IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-office365-ip/list.json" }, { "entry_count": 67, "examples": [ "101.28.252.0/24", "103.9.8.0/22", "112.25.33.0/24", "115.231.150.0/24", "123.150.49.0/24" ], "id": "microsoft-office365-cn", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-office365-cn/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Office 365 IP address ranges in China", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Office 365 IP address ranges in China", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-office365-cn/list.json" }, { "entry_count": 183, "examples": [ "aadrm.com", "account.activedirectory.windowsazure.com", "account.live.com", "accounts.accesscontrol.windows.net", "acompli.net" ], "id": "microsoft-office365", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-office365/list.json", "matching_attributes": [ "domain", "domain|ip", "hostname" ], "metadata": { "description": "Office 365 URLs and IP address ranges", "matching_attributes": [ "domain", "domain|ip", "hostname" ], "name": "List of known Office 365 URLs", "type": "string", "version": 20260811 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-office365/list.json" }, { "entry_count": 798, "examples": [ "129.144.0.0/16", "129.145.16.0/21", "129.145.74.0/23", "129.145.76.0/22", "129.146.0.0/21" ], "id": "oracle-oci", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/oracle-oci/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Oracle Cloud Infrastructure (OCI) IP address ranges (https://docs.oracle.com/en-us/iaas/Content/General/Concepts/addressranges.htm)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Oracle Cloud Infrastructure (OCI) IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/oracle-oci/list.json" }, { "entry_count": 622, "examples": [ "137.74.180.117", "137.74.229.68", "137.74.234.211", "137.74.48.119", "145.239.222.45" ], "id": "ovh-cluster", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/ovh-cluster/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "OVH Cluster IP address (https://docs.ovhcloud.com/en/guides/web-cloud/web-hosting/clusters-and-shared-hosting-ip)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known OVH Cluster IPs", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/ovh-cluster/list.json" }, { "entry_count": 276, "examples": [ "104.155.131.72", "104.199.223.229", "136.110.132.208", "136.110.146.246", "159.183.150.248" ], "id": "palo-alto-networks-cortex-cloud", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/palo-alto-networks-cortex-cloud/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Palo Alto Cortex Cloud IP address ranges (https://docs.ovhcloud.com/en/guides/web-cloud/web-hosting/clusters-and-shared-hosting-ip)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Palo Alto Cortex Cloud IP ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/palo-alto-networks-cortex-cloud/list.json" }, { "entry_count": 34783, "examples": [ "-250.starlink.ru", "0.it4tech.ru", "003-077-128-083.dynamic.caiway.nl", "0040.extnet.it", "006.132.48.116.static.netvigator.com" ], "id": "public-dns-hostname", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/public-dns-hostname/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "Event contains one or more public DNS resolvers (expressed as hostname) as attribute with an IDS flag set", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "List of known public DNS resolvers expressed as hostname", "type": "hostname", "version": 20240615 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/public-dns-hostname/list.json" }, { "entry_count": 100, "examples": [ "4everland.io", "5d6zyscsdarzytpbi3mypv37uoaro2to7oqru4a3oga42bwt3jkof4qd.onion", "alexdav.id", "apac.orbitor.dev", "aragon.ventures" ], "id": "public-ipfs-gateways", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/public-ipfs-gateways/list.json", "matching_attributes": [ "domain", "hostname", "domain|ip", "url", "uri" ], "metadata": { "category": "known", "description": "Event contains one or more entries of known public IPFS gateways", "matching_attributes": [ "domain", "hostname", "domain|ip", "url", "uri" ], "name": "List of known public IPFS gateways", "type": "string", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/public-ipfs-gateways/list.json" }, { "entry_count": 153, "examples": [ "103.4.112.0/23", "104.130.0.0/18", "104.130.112.0/21", "104.130.120.0/22", "104.130.160.0/19" ], "id": "rackspace", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/rackspace/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Rackspace IP address ranges, from the prefixes announced by the Rackspace autonomous systems (RIPEstat announced-prefixes). Note this is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Rackspace IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/rackspace/list.json" }, { "entry_count": 37, "examples": [ "129.77.12.0/23", "141.163.192.0/23", "141.163.195.0/24", "141.163.196.0/23", "141.163.199.0/24" ], "id": "salesforce", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/salesforce/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Salesforce IP address ranges, from their published ip-ranges endpoint (https://ip-ranges.salesforce.com/ip-ranges.json). These are fixed SaaS service endpoints rather than rentable compute, which makes them cleaner warninglist material: the addresses stay tied to Salesforce's own platform instead of to whichever tenant rented them today.", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Salesforce IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/salesforce/list.json" }, { "entry_count": 12, "examples": [ "151.115.0.0/16", "163.172.0.0/16", "195.154.0.0/16", "2001:bc8::/32", "212.129.0.0/18" ], "id": "scaleway", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/scaleway/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Scaleway (formerly Online SAS) IP address ranges, from the ranges Scaleway documents itself (https://www.scaleway.com/en/docs/account/reference-content/scaleway-network-information.md). This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Scaleway IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/scaleway/list.json" }, { "entry_count": 647, "examples": [ "0x1338.blogspot.be", "2014.hack.lu", "2014.zeronights.ru", "about-threats.trendmicro.com", "access.redhat.com" ], "id": "security-provider-blogpost", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/security-provider-blogpost/list.json", "matching_attributes": [ "domain", "domain|ip", "hostname", "url", "uri" ], "metadata": { "description": "Event contains one or more entries of known security providers/vendors blog domain with an IDS flag set", "matching_attributes": [ "domain", "domain|ip", "hostname", "url", "uri" ], "name": "List of known security providers/vendors blog domain", "type": "hostname", "version": 20241204 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/security-provider-blogpost/list.json" }, { "entry_count": 203, "examples": [ "104.155.11.149", "104.21.27.14", "104.21.65.18", "104.236.150.45", "104.236.158.189" ], "id": "sinkholes", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/sinkholes/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "List of known sinkholes", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known sinkholes", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/sinkholes/list.json" }, { "entry_count": 279, "examples": [ "103.129.252.43", "103.129.252.44", "103.129.252.65", "103.168.172.216", "103.168.172.217" ], "id": "smtp-receiving-ips", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/smtp-receiving-ips/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "description": "List of IP addresses for known SMTP servers.", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known SMTP receiving IP addresses", "type": "cidr", "version": 20261005 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/smtp-receiving-ips/list.json" }, { "entry_count": 1021, "examples": [ "1.201.15.0/24", "1.95.21.0/27", "100.24.127.128/25", "100.25.99.0/25", "101.226.139.0/25" ], "id": "smtp-sending-ips", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/smtp-sending-ips/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "List of IP ranges for known SMTP servers.", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known SMTP sending IP ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/smtp-sending-ips/list.json" }, { "entry_count": 0, "examples": [], "id": "stackpath", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/stackpath/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Empty: StackPath wound down its CDN and the generator's only source (https://k3t9x2h3.map2.ssl.hwcdn.net/ipblocks.txt) is dead (NXDOMAIN); hwcdn.net is now a parked domain-for-sale page. The formerly-listed IP ranges are being reassigned to new owners, so they are no longer safe to whitelist.", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Stackpath CDN IP ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/stackpath/list.json" }, { "entry_count": 5, "examples": [ "185.93.228.0/22", "192.88.134.0/23", "208.109.0.0/22", "2a02:fe80::/29", "66.248.200.0/22" ], "id": "sucuri", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/sucuri/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Sucuri Website Firewall IP address ranges, scraped from https://docs.sucuri.net/website-firewall/sucuri-firewall-troubleshooting-guide/ (no machine-readable API is published)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Sucuri (Website Firewall) IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/sucuri/list.json" }, { "entry_count": 14, "examples": [ "149.154.160.0/20", "185.76.151.0/24", "2001:67c:4e8::/48", "2001:b28:f23c::/48", "2001:b28:f23d::/48" ], "id": "telegram-ips", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/telegram-ips/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Telegram IP address ranges (https://core.telegram.org/resources/cidr.txt)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Telegram IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/telegram-ips/list.json" }, { "entry_count": 39, "examples": [ "13.115.104.128/25", "13.210.1.64/26", "13.213.79.0/24", "13.56.21.128/25", "13.59.252.0/25" ], "id": "tenable-cloud-ipv4", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/tenable-cloud-ipv4/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Tenable IPv4 Cloud Sensor addresses used for scanning Internet-facing infrastructure", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Tenable Cloud Sensors IPv4", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/tenable-cloud-ipv4/list.json" }, { "entry_count": 17, "examples": [ "2406:da14:e76:5b00::/56", "2406:da17:524:dd00::/56", "2406:da18:844:7100::/56", "2406:da1a:5b2:8500::/56", "2406:da1c:20f:2f00::/56" ], "id": "tenable-cloud-ipv6", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/tenable-cloud-ipv6/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Tenable IPv6 Cloud Sensor addresses used for scanning Internet-facing infrastructure", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Tenable Cloud Sensors IPv6", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/tenable-cloud-ipv6/list.json" }, { "entry_count": 259, "examples": [ "1.116.0.0/15", "1.12.0.0/14", "1.201.184.0/22", "1.201.188.0/23", "101.32.0.0/18" ], "id": "tencent-cloud", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/tencent-cloud/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Tencent Cloud IP address ranges, from the prefixes announced by Tencent's autonomous systems as reported by the RIPEstat Data API (https://stat.ripe.net/). Tencent publishes no machine-readable address-space file, so the address space is derived from BGP. This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Tencent Cloud IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/tencent-cloud/list.json" }, { "entry_count": 831, "examples": [ "102.130.113.9/32", "102.130.117.167/32", "102.130.127.117/32", "102.211.56.20/32", "102.68.99.63/32" ], "id": "tor-exit-nodes", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/tor-exit-nodes/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Specialized list of IPv4 addresses belonging to Tor exit nodes, from https://github.com/X4BNet/lists_torexit", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Tor exit nodes", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/tor-exit-nodes/list.json" }, { "entry_count": 255, "examples": [ "1url.com", "2h.ae", "2ly.link", "2no.co", "2uuu.me" ], "id": "url-shortener", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/url-shortener/list.json", "matching_attributes": [ "domain", "hostname", "domain|ip", "url", "uri" ], "metadata": { "category": "known", "description": "Event contains one or more entries of known Shorteners domains", "matching_attributes": [ "domain", "hostname", "domain|ip", "url", "uri" ], "name": "List of known URL Shorteners domains", "type": "hostname", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/url-shortener/list.json" }, { "entry_count": 145, "examples": [ "103.43.72.0/22", "104.156.224.0/19", "104.207.128.0/19", "104.238.128.0/18", "107.191.32.0/19" ], "id": "vultr", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/vultr/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Vultr (Constant Company, LLC) IP address ranges, from their published RFC 8805 geofeed (https://geofeed.constant.com/). This is general-purpose rented compute: the tenant behind any given address changes constantly and an attacker can simply rent one. The list recognises that an address belongs to the provider; it is NOT grounds for treating traffic as benign.", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Vultr IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/vultr/list.json" }, { "entry_count": 10, "examples": [ "103.102.166.0/24", "185.15.56.0/22", "193.46.90.0/24", "195.200.68.0/24", "198.35.26.0/23" ], "id": "wikimedia", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/wikimedia/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "description": "Wikimedia address ranges (https://wikitech.wikimedia.org/w/api.php?action=parse&page=IP_and_AS_allocations&format=json&prop=wikitext)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Wikimedia address ranges", "type": "cidr", "version": 20260819 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/wikimedia/list.json" }, { "entry_count": 144, "examples": [ ".1.msftsrvcs.vo.llnwi.net", ".a-msedge.net", ".akamai.net", ".akamaiedge.net", ".b.akamaiedge.net" ], "id": "microsoft-win10-connection-endpoints", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-win10-connection-endpoints/list.json", "matching_attributes": [ "domain", "hostname", "domain|ip" ], "metadata": { "description": "Event contains one or more entries of known Windows 10 connection endpoints (https://docs.microsoft.com/en-us/windows/privacy/manage-windows-endpoints)", "matching_attributes": [ "domain", "hostname", "domain|ip" ], "name": "List of known Windows 10 connection endpoints", "type": "string", "version": 20220816 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-win10-connection-endpoints/list.json" }, { "entry_count": 152, "examples": [ ".api.cdp.microsoft.com", ".blob.core.windows.net", ".delivery.mp.microsoft.com", ".displaycatalog.mp.microsoft.com", ".dl.delivery.mp.microsoft.com" ], "id": "microsoft-win11-connection-endpoints", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-win11-connection-endpoints/list.json", "matching_attributes": [ "domain", "hostname", "domain|ip" ], "metadata": { "description": "Event contains one or more entries of known Windows 11 connection endpoints (https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints)", "matching_attributes": [ "domain", "hostname", "domain|ip" ], "name": "List of known Windows 11 connection endpoints", "type": "string", "version": 20260829 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/microsoft-win11-connection-endpoints/list.json" }, { "entry_count": 78, "examples": [ "101.2.192.0/18", "104.129.192.0/20", "112.196.99.180/32", "136.226.0.0/16", "137.31.0.0/16" ], "id": "zscaler", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/zscaler/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Zscaler IP address ranges (https://config.zscaler.com/api/zscaler.net/hubs/cidr/json/recommended)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of known Zscaler IP address ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/zscaler/list.json" }, { "entry_count": 175, "examples": [ ".000webhostapp.com", ".amazonaws.com", ".appspot.com", ".atlassian.net", ".axshare.com" ], "id": "lots-project", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/lots-project/list.json", "matching_attributes": [ "domain", "domain|ip", "hostname", "hostname|port", "url" ], "metadata": { "category": "known", "description": "List of popular legitimate domains from LOTS (Living Off Trusted Sites) Project used to conduct phishing, C&C, exfiltration or downloading tools to evade detection", "matching_attributes": [ "domain", "domain|ip", "hostname", "hostname|port", "url" ], "name": "List of LOTS (Living Off Trusted Sites) Project Domains", "type": "hostname", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/lots-project/list.json" }, { "entry_count": 6, "examples": [ "145.220.76.240/32", "145.220.91.28/31", "185.71.61.126/31", "185.71.61.129/32", "185.71.61.140/32" ], "id": "internetcleanup-scanner", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/internetcleanup-scanner/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Internet Cleanup Foundation scaninfo (https://internetcleanup.foundation/scaninfo/)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of published IP address ranges for Internet Cleanup Foundation scanners", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/internetcleanup-scanner/list.json" }, { "entry_count": 39, "examples": [ "142.91.102.186/31", "185.2.80.252/31", "212.73.148.0/27", "212.73.148.32/29", "212.73.148.40/31" ], "id": "modat-scanner", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/modat-scanner/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Modat Scanner (https://www.modat.io/)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of published IP address ranges for Modat Scanner", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/modat-scanner/list.json" }, { "entry_count": 9, "examples": [ "195.184.76.0/24", "2001:41d0:33a:a00::400/124", "2001:41d0:33d:9200::400/124", "2a14:f100::/29", "51.254.49.96/28" ], "id": "onyphe-scanner", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/onyphe-scanner/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Onyphe Scanner (https://www.onyphe.io/)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of published IP address ranges for Onyphe Scanner", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/onyphe-scanner/list.json" }, { "entry_count": 3, "examples": [ "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16" ], "id": "rfc1918", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/rfc1918/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "description": "Event contains one or more entries part of the private network CIDR blocks (RFC 1918)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "List of RFC 1918 CIDR blocks", "type": "cidr", "version": 20220705 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/rfc1918/list.json" }, { "entry_count": 1, "examples": [ "2001:DB8::/32" ], "id": "rfc3849", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/rfc3849/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "description": "Event contains one or more entries part of the IPv6 documentation prefix (RFC 3849)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "List of RFC 3849 CIDR blocks", "type": "cidr", "version": 20220705 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/rfc3849/list.json" }, { "entry_count": 15, "examples": [ "0.0.0.0/8", "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12" ], "id": "rfc5735", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/rfc5735/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "description": "Event contains one or more entries part of the Special Use IPv4 Addresses CIDR blocks (RFC 5735)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "List of RFC 5735 CIDR blocks", "type": "cidr", "version": 20220705 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/rfc5735/list.json" }, { "entry_count": 16, "examples": [ "224.0.0.0/8", "225.0.0.0/8", "226.0.0.0/8", "227.0.0.0/8", "228.0.0.0/8" ], "id": "multicast", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/multicast/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "description": "Event contains one or more entries part of the RFC 5771 multicast CIDR blocks", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "List of RFC 5771 multicast CIDR blocks", "type": "cidr", "version": 20240422 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/multicast/list.json" }, { "entry_count": 1, "examples": [ "100.64.0.0/10" ], "id": "rfc6598", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/rfc6598/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "description": "Event contains one or more entries part of the Shared Address Space CIDR blocks (RFC 6598)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "List of RFC 6598 CIDR blocks", "type": "cidr", "version": 20220705 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/rfc6598/list.json" }, { "entry_count": 25, "examples": [ "10.in-addr.arpa", "16.172.in-addr.arpa", "168.192.in-addr.arpa", "17.172.in-addr.arpa", "18.172.in-addr.arpa" ], "id": "rfc6761", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/rfc6761/list.json", "matching_attributes": [ "hostname", "domain", "domain|ip" ], "metadata": { "description": "Event contains one or more entries part of the Special-Use Domain Names (RFC 6761)", "matching_attributes": [ "hostname", "domain", "domain|ip" ], "name": "List of RFC 6761 Special-Use Domain Names", "type": "string", "version": 20260908 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/rfc6761/list.json" }, { "entry_count": 105, "examples": [ "103.66.28.0/22", "13.58.114.74/32", "13.58.203.73/32", "13.58.84.198/32", "13.59.120.77/32" ], "id": "mandiantasm-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/mandiantasm-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Mandiant ASM / GTI (mandiant.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Mandiant ASM / GTI (mandiant.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/mandiantasm-scanning/list.json" }, { "entry_count": 37, "examples": [ "212.73.148.0/32", "212.73.148.11/32", "212.73.148.14/32", "212.73.148.16/32", "212.73.148.2/32" ], "id": "modat-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/modat-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the Modat scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Modat IP Ranges Used for Scanning", "type": "cidr", "version": 26100813 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/modat-nt-scanning/list.json" }, { "entry_count": 11, "examples": [ "93.123.109.120/30", "93.123.109.124/31", "93.123.109.17/32", "93.123.109.18/31", "93.123.109.20/30" ], "id": "netlas-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/netlas-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Netlas (netlas.io), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Netlas (netlas.io) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/netlas-scanning/list.json" }, { "entry_count": 1, "examples": [ "146.88.240.0/23" ], "id": "netscout-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/netscout-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation NETSCOUT (internet-albedo.net), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "NETSCOUT (internet-albedo.net) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/netscout-scanning/list.json" }, { "entry_count": 11, "examples": [ "89.248.167.132/31", "89.248.167.135/32", "89.248.167.139/32", "89.248.167.140/32", "89.248.167.147/32" ], "id": "netsecscan-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/netsecscan-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the Netsecscan scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2025/12/10", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Netsecscan IP Ranges Used for Scanning", "type": "cidr", "version": 25121023 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/netsecscan-nt-scanning/list.json" }, { "entry_count": 11, "examples": [ "89.248.167.132/31", "89.248.167.135/32", "89.248.167.139/32", "89.248.167.140/32", "89.248.167.147/32" ], "id": "netsecscan-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/netsecscan-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List of NetSecScan.net scanners ", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "NetSecScan IP-Ranges, pot. used for Scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/netsecscan-scanning/list.json" }, { "entry_count": 48, "examples": [ "195.178.110.162/32", "2001:bc8:702:10ba::/128", "2001:bc8:702:11ad::/128", "2001:bc8:702:11f3::/128", "2001:bc8:702:1209::/128" ], "id": "deepfield-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/deepfield-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Nokia Deepfield (deepfield.net), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Nokia Deepfield (deepfield.net) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/deepfield-scanning/list.json" }, { "entry_count": 16, "examples": [ "104.105.18.64/32", "172.104.240.26/32", "172.104.42.54/32", "172.104.48.115/32", "172.105.92.211/32" ], "id": "onlyscans-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/onlyscans-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation ONLYSCANS (onlyscans.com / onlyscans.net), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "ONLYSCANS (onlyscans.com / onlyscans.net) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/onlyscans-scanning/list.json" }, { "entry_count": 167, "examples": [ "195.184.76.0/28", "195.184.76.112/30", "195.184.76.116/32", "195.184.76.118/31", "195.184.76.120/29" ], "id": "onyphe-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/onyphe-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the Onyphe scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Onyphe IP Ranges Used for Scanning", "type": "cidr", "version": 26100813 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/onyphe-nt-scanning/list.json" }, { "entry_count": 43, "examples": [ "amazonaws.com", "archive.org", "assets-global.website-files.com", "backblaze.com", "backblazeb2.com" ], "id": "digitalside", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/digitalside/list.json", "matching_attributes": [ "hostname", "domain" ], "metadata": { "description": "OSINT DigitalSide Threat-Intel Repository - MISP Warninglist - List of domains should be marked as false positive in the related MISP event with IDS attribute not flagged", "matching_attributes": [ "hostname", "domain" ], "name": "OSINT.DigitalSide.IT Warning List", "type": "hostname", "version": 20260811 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/digitalside/list.json" }, { "entry_count": 108, "examples": [ "103.120.80.111/32", "103.139.0.32/32", "103.224.182.0/23", "103.224.212.0/23", "104.26.6.37/32" ], "id": "parking-domain", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/parking-domain/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "List of parking domain's ip adresses", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Parking domains", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/parking-domain/list.json" }, { "entry_count": 129, "examples": [ "above.com", "afternic.com", "alter.com", "bodis.com", "bookmyname.com" ], "id": "parking-domain-ns", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/parking-domain-ns/list.json", "matching_attributes": [ "domain|ip", "domain", "hostname" ], "metadata": { "category": "known", "description": "List of parking domain's name server", "matching_attributes": [ "domain|ip", "domain", "hostname" ], "name": "Parking domains name server", "type": "hostname", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/parking-domain-ns/list.json" }, { "entry_count": 1, "examples": [ "45.79.38.219/32" ], "id": "pocnroll-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/pocnroll-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation pocnroll (pocnroll.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "pocnroll (pocnroll.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/pocnroll-scanning/list.json" }, { "entry_count": 6, "examples": [ "104.128.144.201/32", "104.128.144.202/31", "104.128.144.204/30", "104.128.144.208/29", "104.128.144.216/30" ], "id": "probethenet-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/probethenet-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the Probethenet scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/07/08", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Probethenet IP Ranges Used for Scanning", "type": "cidr", "version": 26070810 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/probethenet-nt-scanning/list.json" }, { "entry_count": 6, "examples": [ "104.128.144.201/32", "104.128.144.202/31", "104.128.144.204/30", "104.128.144.208/29", "104.128.144.216/30" ], "id": "probethenet-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/probethenet-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation ProbeTheNet Project / mThreat Technology Inc. (probethenet.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "ProbeTheNet Project / mThreat Technology Inc. (probethenet.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/probethenet-scanning/list.json" }, { "entry_count": 18, "examples": [ "109.123.117.228/30", "109.123.117.232/29", "109.123.117.240/29", "109.123.117.248/30", "109.123.117.252/31" ], "id": "rapid7-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/rapid7-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the Rapid7 scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Rapid7 IP Ranges Used for Scanning", "type": "cidr", "version": 26100813 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/rapid7-nt-scanning/list.json" }, { "entry_count": 11, "examples": [ "109.123.117.224/27", "146.185.25.160/27", "173.255.225.139/32", "2607:ff10:c5:522::/64", "2a02:2498:e004:23::/64" ], "id": "rapid7-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/rapid7-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Rapid7 Project Sonar (rapid7.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Rapid7 Project Sonar (rapid7.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/rapid7-scanning/list.json" }, { "entry_count": 6, "examples": [ "13.219.121.241/32", "18.235.110.182/32", "3.233.59.216/32", "54.86.115.253/32", "98.84.1.175/32" ], "id": "recordedfuture-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/recordedfuture-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Recorded Future / SecurityTrails (securitytrails.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Recorded Future / SecurityTrails (securitytrails.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/recordedfuture-scanning/list.json" }, { "entry_count": 10, "examples": [ "89.248.163.0/24", "89.248.165.0/24", "89.248.173.170/32", "89.248.173.173/32", "89.248.173.177/32" ], "id": "recyber-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/recyber-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Recyber (recyber.net), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Recyber (recyber.net) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/recyber-scanning/list.json" }, { "entry_count": 25, "examples": [ "138.197.101.95/32", "138.197.118.33/32", "138.68.249.116/32", "157.245.176.143/32", "157.245.252.5/32" ], "id": "researchscanner-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/researchscanner-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Research Scanner (research-scanner.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Research Scanner (research-scanner.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/researchscanner-scanning/list.json" }, { "entry_count": 24, "examples": [ "138.197.101.95/32", "138.197.118.33/32", "157.245.176.143/32", "157.245.252.5/32", "159.223.203.97/32" ], "id": "research-scanner-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/research-scanner-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the Research scanner scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Research scanner IP Ranges Used for Scanning", "type": "cidr", "version": 26100813 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/research-scanner-nt-scanning/list.json" }, { "entry_count": 727, "examples": [ "104.200.30.203/32", "104.200.30.246/32", "104.200.30.75/32", "104.200.30.79/32", "104.200.30.90/32" ], "id": "rootevidence-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/rootevidence-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Root Evidence (rootevidence.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Root Evidence (rootevidence.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/rootevidence-scanning/list.json" }, { "entry_count": 204, "examples": [ "104.207.149.87/32", "104.238.185.11/32", "108.61.209.136/32", "108.61.241.199/32", "128.232.21.75/32" ], "id": "university-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/university-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Scanners from various universities, as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Scanners from various universities IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/university-scanning/list.json" }, { "entry_count": 10325, "examples": [ "0.bg", "001.test.code-builder-stg.platform.salesforce.com", "0am.jp", "0e.vc", "0emm.com" ], "id": "second-level-tlds", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/second-level-tlds/list.json", "matching_attributes": [ "hostname", "domain", "domain|ip" ], "metadata": { "description": "Event contains one or more second level TLDs as attribute with an IDS flag set.", "matching_attributes": [ "hostname", "domain", "domain|ip" ], "name": "Second level TLDs as known by Mozilla Foundation", "type": "string", "version": 20261005 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/second-level-tlds/list.json" }, { "entry_count": 1, "examples": [ "144.202.82.88/32" ], "id": "securityresearch-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/securityresearch-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation securityresearch.net, as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "securityresearch.net IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/securityresearch-scanning/list.json" }, { "entry_count": 1, "examples": [ "209.38.165.60/32" ], "id": "shadowforce-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/shadowforce-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the Shadowforce scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Shadowforce IP Ranges Used for Scanning", "type": "cidr", "version": 26100813 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/shadowforce-nt-scanning/list.json" }, { "entry_count": 23, "examples": [ "128.199.44.215/32", "142.93.135.160/32", "146.190.21.73/32", "152.42.136.22/32", "159.223.0.20/32" ], "id": "shadowforce-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/shadowforce-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List of shadowforce.io scanners ", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Shadowforce IP-Ranges, pot. used for Scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/shadowforce-scanning/list.json" }, { "entry_count": 9, "examples": [ "184.105.247.194/31", "184.105.247.252/32", "216.218.206.67/32", "64.62.197.152/32", "64.62.197.17/32" ], "id": "shadowserver-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/shadowserver-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the Shadowserver scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/07/08", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Shadowserver IP Ranges Used for Scanning", "type": "cidr", "version": 26070810 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/shadowserver-nt-scanning/list.json" }, { "entry_count": 40, "examples": [ "108.165.44.0/24", "146.19.20.0/24", "154.16.223.0/24", "154.16.230.0/24", "154.16.240.0/24" ], "id": "shadowserver", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/shadowserver/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List of Shadowserver IP-Ranges. Potentially associated with Shadowserver scans. based on [https://bgp.he.net/search?search%5Bsearch%5D=shadowserver&commit=Search]", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Shadowserver IP-Ranges, pot. used for Scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/shadowserver/list.json" }, { "entry_count": 28, "examples": [ "2.59.22.234/32", "66.240.192.138/32", "66.240.205.34/32", "66.240.219.146/32", "66.240.236.119/32" ], "id": "shodan-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/shodan-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the Shodan scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Shodan IP Ranges Used for Scanning", "type": "cidr", "version": 26100813 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/shodan-nt-scanning/list.json" }, { "entry_count": 104, "examples": [ "134.209.95.237/32", "137.184.112.103/32", "137.184.112.192/32", "137.184.13.100/32", "137.184.190.194/32" ], "id": "shodan-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/shodan-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List of Shodan.io scanners ", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Shodan IP-Ranges, pot. used for Scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/shodan-scanning/list.json" }, { "entry_count": 1, "examples": [ "85.142.100.2/32" ], "id": "skipa-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/skipa-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the Skipa scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/03/13", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Skipa IP Ranges Used for Scanning", "type": "cidr", "version": 26031315 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/skipa-nt-scanning/list.json" }, { "entry_count": 5039, "examples": [ "104.42.220.14/32", "128.203.200.147/32", "128.203.200.175/32", "128.203.200.182/32", "128.203.200.211/32" ], "id": "stretchoid-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/stretchoid-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Stretchoid (stretchoid.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Stretchoid (stretchoid.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/stretchoid-scanning/list.json" }, { "entry_count": 1242, "examples": [ "104.42.155.18/32", "13.83.164.24/32", "13.86.114.132/32", "13.86.114.16/32", "13.86.115.128/32" ], "id": "stretchoid-nt-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/stretchoid-nt-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "metadata": { "category": "known", "description": "List containing IP's associated with the Stretchoid scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/10/08", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-dst|port", "ip-src|port" ], "name": "Stretchoid IP Ranges Used for Scanning", "type": "cidr", "version": 26100813 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/stretchoid-nt-scanning/list.json" }, { "entry_count": 139, "examples": [ "13.115.104.128/25", "13.210.1.64/26", "13.213.79.0/24", "13.56.21.128/25", "13.59.252.0/25" ], "id": "tenableasm-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/tenableasm-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation Tenable ASM (tenable.com / tenable.io), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "Tenable ASM (tenable.com / tenable.io) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/tenableasm-scanning/list.json" }, { "entry_count": 1437, "examples": [ "AAA", "AARP", "ABB", "ABBOTT", "ABBVIE" ], "id": "tlds", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/tlds/list.json", "matching_attributes": [ "hostname", "domain", "domain|ip" ], "metadata": { "description": "Event contains one or more TLDs as attribute with an IDS flag set", "matching_attributes": [ "hostname", "domain", "domain|ip" ], "name": "TLDs as known by IANA", "type": "string", "version": 20261005 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/tlds/list.json" }, { "entry_count": 999998, "examples": [ "\"amazon-adsystem.com", "\"cn", "\"com", "\"images-na.ssl-images-amazon.com", "\"media-amazon.com" ], "id": "cisco_top1m", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cisco_top1m/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "Event contains one or more entries from the top 1 000 000 of the most used websites (Cisco Umbrella).", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "Top 1 000 000 websites from Cisco Umbrella", "type": "string", "version": 20261005 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cisco_top1m/list.json" }, { "entry_count": 1001, "examples": [ "0xrpc.io", "163.com", "1rx.io", "2gis.com", "2mdn.net" ], "id": "cloudflare-top1k", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top1k/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "List of top 1,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "Top 1,000 domains from Cloudflare Radar", "type": "string", "version": 20260810 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top1k/list.json" }, { "entry_count": 1000125, "examples": [ "\"com,thefatherofsalmon.com.host\"", "0-0.pro", "0-0c.com", "0-1-2-1.ir", "0-1n.com" ], "id": "cloudflare-top1m", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top1m/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "List of top 1,000,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "Top 1,000,000 domains from Cloudflare Radar", "type": "string", "version": 20260810 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top1m/list.json" }, { "entry_count": 1000000, "examples": [ "0-0.asia", "0-1.ir", "0-24.jp", "0-55.ru", "0-57-26.buzz" ], "id": "tranco", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/tranco/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "Event contains one or more entries from the top 1,000,000 most-used sites (https://tranco-list.eu/).", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "Top 1,000,000 most-used sites from Tranco", "type": "hostname", "version": 20261005 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/tranco/list.json" }, { "entry_count": 10000, "examples": [ "-container.supertms.com", "0-bvs84irkvfpdbio14klg0d2um4mttanvfdm.canva-apps.cn", "0-courier.push.apple.com", "0-courier2.push.apple.com", "0-ejemplo.supertms.com" ], "id": "cisco_top10k", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cisco_top10k/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "Event contains one or more entries from the top 10 000 of the most used websites (Cisco Umbrella).", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "Top 10 000 websites from Cisco Umbrella", "type": "string", "version": 20261005 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cisco_top10k/list.json" }, { "entry_count": 10001, "examples": [ "011st.com", "0x7c0.com", "0xrpc.io", "10010.com", "10086.cn" ], "id": "cloudflare-top10k", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top10k/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "List of top 10,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "Top 10,000 domains from Cloudflare Radar", "type": "string", "version": 20260810 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top10k/list.json" }, { "entry_count": 100001, "examples": [ "0-0c.com", "0-h-g-l.com", "0-r-a-v.com", "000webhost.com", "001scrm.net" ], "id": "cloudflare-top100k", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top100k/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "List of top 100,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "Top 100,000 domains from Cloudflare Radar", "type": "string", "version": 20260810 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top100k/list.json" }, { "entry_count": 1000, "examples": [ "10086.cn", "11467.com", "115.com", "11st.co.kr", "123pan.com" ], "id": "alexa", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/alexa/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "Event contains one or more entries from the top 1000 of the most used website (Alexa).", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "Top 1000 website from Alexa", "type": "hostname", "version": 20230511 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/alexa/list.json" }, { "entry_count": 1000, "examples": [ "1.connectivity-test.static.microsoft", "1.nflxso.net", "1d.tlu.dl.delivery.mp.microsoft.com", "1pst.e2ro.com", "1rx.io" ], "id": "cisco_top1000", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cisco_top1000/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "Event contains one or more entries from the top 1000 of the most used websites (Cisco Umbrella).", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "Top 1000 websites from Cisco Umbrella", "type": "string", "version": 20261005 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cisco_top1000/list.json" }, { "entry_count": 10000, "examples": [ "000webhostapp.com", "01net.com", "0577vr.cn", "104.com.tw", "10jqka.com.cn" ], "id": "majestic_million", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/majestic_million/list.json", "matching_attributes": [ "hostname", "domain" ], "metadata": { "description": "Event contains one or more entries from the top 10000 of the most used websites (Majestic Million).", "matching_attributes": [ "hostname", "domain" ], "name": "Top 10000 websites from Majestic Million", "type": "string", "version": 20261005 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/majestic_million/list.json" }, { "entry_count": 10000, "examples": [ "0123tt.ru", "029whhg.com", "0lin.com", "0xrpc.io", "10086.cn" ], "id": "tranco10k", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/tranco10k/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "Event contains one or more entries from the top 10K most-used sites (https://tranco-list.eu/).", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "Top 10K most-used sites from Tranco", "type": "hostname", "version": 20261005 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/tranco10k/list.json" }, { "entry_count": 2001, "examples": [ "0xrpc.io", "126.net", "163.com", "1905.com", "1drv.com" ], "id": "cloudflare-top2k", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top2k/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "List of top 2,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "Top 2,000 domains from Cloudflare Radar", "type": "string", "version": 20260810 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top2k/list.json" }, { "entry_count": 20000, "examples": [ "-container.supertms.com", "0-akali-comssets.create.wire.c.dev1--premisewww.lel.asia", "0-bvs84irkvfpdbio14klg0d2um4mttanvfdm.canva-apps.cn", "0-cloudappatepractice.canva-apps.cn", "0-courier.push.apple.com" ], "id": "cisco_top20k", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cisco_top20k/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "Event contains one or more entries from the top 20 000 of the most used websites (Cisco Umbrella).", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "Top 20 000 websites from Cisco Umbrella", "type": "string", "version": 20261005 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cisco_top20k/list.json" }, { "entry_count": 20001, "examples": [ "004430.xyz", "007666.com", "011st.com", "0123456789nonexistent.com", "03k.org" ], "id": "cloudflare-top20k", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top20k/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "List of top 20,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "Top 20,000 domains from Cloudflare Radar", "type": "string", "version": 20260810 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top20k/list.json" }, { "entry_count": 201, "examples": [ "2mdn.net", "3gppnetwork.org", "a2z.com", "aaplimg.com", "adnxs.com" ], "id": "cloudflare-top200", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top200/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "List of top 200 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "Top 200 domains from Cloudflare Radar", "type": "string", "version": 20260810 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top200/list.json" }, { "entry_count": 200001, "examples": [ "0-0c.com", "0-h-g-l.com", "0-jayparts.com", "0-r-a-v.com", "000webhost.com" ], "id": "cloudflare-top200k", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top200k/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "List of top 200,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "Top 200,000 domains from Cloudflare Radar", "type": "string", "version": 20260810 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top200k/list.json" }, { "entry_count": 5001, "examples": [ "0x7c0.com", "0xrpc.io", "10086.cn", "10jqka.com.cn", "11st.co.kr" ], "id": "cloudflare-top5k", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top5k/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "List of top 5,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "Top 5,000 domains from Cloudflare Radar", "type": "string", "version": 20260810 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top5k/list.json" }, { "entry_count": 50001, "examples": [ "004430.xyz", "007666.com", "00px.net", "01.org", "0101.co.jp" ], "id": "cloudflare-top50k", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top50k/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "List of top 50,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "Top 50,000 domains from Cloudflare Radar", "type": "string", "version": 20260810 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top50k/list.json" }, { "entry_count": 500, "examples": [ "123rf.com", "20minutos.es", "3ds.com", "4shared.com", "abc.es" ], "id": "moz-top500", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/moz-top500/list.json", "matching_attributes": [ "hostname", "domain", "uri", "url" ], "metadata": { "description": "Event contains one or more entries from the top 500 of the most used domains from Moz.", "matching_attributes": [ "hostname", "domain", "uri", "url" ], "name": "Top 500 domains and pages from https://moz.com/top500", "type": "string", "version": 20261005 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/moz-top500/list.json" }, { "entry_count": 500003, "examples": [ "0-0.pro", "0-0c.com", "0-1n.com", "0-8-0-a.com", "0-9.club" ], "id": "cloudflare-top500k", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top500k/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "List of top 500,000 domains from Cloudflare Radar (https://developers.cloudflare.com/radar/investigate/domain-ranking-datasets/)", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "Top 500,000 domains from Cloudflare Radar", "type": "string", "version": 20260810 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cloudflare-top500k/list.json" }, { "entry_count": 5000, "examples": [ "-container.supertms.com", "0-courier2.push.apple.com", "0-ejemplo.supertms.com", "0-enakamai-lanwpradio-1ali-ali-s3.ali.gwfb.net", "0.amazon.pool.ntp.org" ], "id": "cisco_top5k", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cisco_top5k/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "Event contains one or more entries from the top 5000 of the most used websites (Cisco Umbrella).", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "Top 5000 websites from Cisco Umbrella", "type": "string", "version": 20261005 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/cisco_top5k/list.json" }, { "entry_count": 33, "examples": [ "/((?:\\+|00)1)?([0-9]{3})55501([0-9]{2})/", "/((?:\\+|00)1)?55501([0-9]{2})/", "/((?:\\+|00)33?|0?)(19900|26191|35301|46571|53649|63998)([0-9]{4})/", "/((?:\\+|00)33?|0?)(999)([0-9]{6})/", "/((?:\\+|00)353)?02091([0-9]{5})/" ], "id": "phone_numbers", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/phone_numbers/list.json", "matching_attributes": [ "phone-number", "whois-registrant-phone" ], "metadata": { "description": "Numbers that cannot be attributed because they reserved for different purposes.", "matching_attributes": [ "phone-number", "whois-registrant-phone" ], "name": "Unattributed phone number.", "type": "regex", "version": 20260812 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/phone_numbers/list.json" }, { "entry_count": 10588, "examples": [ "29mayis.edu.tr", "4cd.edu", "a-aarhus.dk", "a2.keio.jp", "aabu.edu.jo" ], "id": "university_domains", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/university_domains/list.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "metadata": { "description": "List of University domains from https://raw.githubusercontent.com/Hipo/university-domains-list/master/world_universities_and_domains.json", "matching_attributes": [ "hostname", "domain", "url", "domain|ip" ], "name": "University domains", "type": "string", "version": 20261005 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/university_domains/list.json" }, { "entry_count": 6, "examples": [ "141.212.120.0/24", "141.212.121.0/24", "141.212.122.0/24", "141.212.123.0/24", "141.212.124.0/24" ], "id": "umich-cse-connection-attempts", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/umich-cse-connection-attempts/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "University of Michigan Computer Science and Engineering connection attempts page (https://cse.engin.umich.edu/about/resources/connection-attempts/)", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "University of Michigan CSE connection-attempt network ranges", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/umich-cse-connection-attempts/list.json" }, { "entry_count": 319, "examples": [ "3d.nicovideo.jp", "aatishb.com", "account.nicovideo.jp", "ads.nicovideo.jp", "againstcovid19.com" ], "id": "covid", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/covid/list.json", "matching_attributes": [ "domain", "hostname", "url" ], "metadata": { "description": "Maintained using different lists (such as Jaime Blasco's and Krassimir's lists).", "matching_attributes": [ "domain", "hostname", "url" ], "name": "Valid covid-19 related domains", "type": "hostname", "version": 20200423 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/covid/list.json" }, { "entry_count": 210, "examples": [ "100.28.153.226/32", "100.49.117.77/32", "100.50.17.159/32", "13.58.100.25/32", "13.58.208.166/32" ], "id": "visionheight-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/visionheight-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation VisionHeight (visionheight.com), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "VisionHeight (visionheight.com) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/visionheight-scanning/list.json" }, { "entry_count": 44, "examples": [ "163.172.109.18/32", "163.172.99.21/32", "163.172.99.35/32", "163.172.99.60/32", "163.172.99.85/32" ], "id": "xmco-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/xmco-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation XMCO Serenety (xmco.fr), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "XMCO Serenety (xmco.fr) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/xmco-scanning/list.json" }, { "entry_count": 130, "examples": [ "101.36.106.47/32", "101.36.119.4/32", "101.36.122.155/32", "101.36.122.89/32", "103.210.21.32/32" ], "id": "zern-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/zern-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation ZERN (zern.io), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "ZERN (zern.io) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/zern-scanning/list.json" }, { "entry_count": 13, "examples": [ "148.153.188.246/32", "148.153.188.254/32", "148.153.189.62/32", "148.153.56.170/32", "148.153.56.174/32" ], "id": "zoomeye-scanning", "json": "https://raw.githubusercontent.com/MISP/misp-warninglists/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/zoomeye-scanning/list.json", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "metadata": { "category": "known", "description": "Published source ranges of the internet-wide scanning organisation ZoomEye (zoomeye.ai), as tracked by https://github.com/OpenFilters/internet-scanners", "matching_attributes": [ "ip-src", "ip-dst", "domain|ip", "ip-src|port", "ip-dst|port" ], "name": "ZoomEye (zoomeye.ai) IP ranges used for scanning", "type": "cidr", "version": 20261014 }, "source": "https://github.com/MISP/misp-warninglists/blob/154896d7bf00be5c336e2aed5c60862e60c40a17/lists/zoomeye-scanning/list.json" } ] }