IPnoise
IPs caught attacking a distributed network of interactive honeypot sensors — hosts running no legitimate service, advertised nowhere, so every connection reaching them is hostile by construction.
The sensors answer, emulating real services well enough to record what each source actually came to do: credential attacks, exploit and malware-delivery attempts, CMS and admin-panel enumeration, SSH brute force. An address is listed after repeated hostile activity within a short sliding window. The captured payloads themselves are never published. Listing and delisting are both automatic: an address appears on the evidence of its own activity, and stops appearing once that activity stops. The statistics show what is being attacked, and from where.
That sliding window decides whether a source counts as hostile in the first place, and is deliberately not specified here; the freshness below is a separate, unrelated setting that only controls how long a qualifying entry keeps appearing in a given file.
Pick the freshness window that matches your risk tolerance: a shorter one means less chance of blocking an IP that's since been reassigned; a longer one casts a wider net.
curl -fsSL https://ipnoise.sekuripy.hr/7d.txt | grep -v '^#'
The feed is meant to be acted on, not just read. Every source on it has already committed to attacking a host that offers nothing and asked nobody for traffic — there is no benign reading of that — so blocking them at your own perimeter is a low-risk way to cut inbound attacks from the same actors before they reach you.
Straight into a firewall, if you run nftables:
# once
nft add table inet ipnoise
nft add set inet ipnoise blocked '{ type ipv4_addr; }'
nft add chain inet ipnoise input \
'{ type filter hook input priority -10; }'
nft add rule inet ipnoise input ip saddr @blocked drop
# then on a cron, as often as you like
curl -fsSL https://ipnoise.sekuripy.hr/7d.txt | grep -Ev '^#|:' |
sed 's/^/add element inet ipnoise blocked { /; s/$/ }/' |
{ echo 'flush set inet ipnoise blocked'; cat; } | nft -f -
On pfSense or OPNsense, add the URL directly as a firewall alias of type URL Table (IPs). It also ships as a feed in maltrail, so an existing install already has it. These four URLs, and the flat one-address-per-line format behind them, will not change.
Sensors run on multiple independent providers across different regions — each one enough on its own to catch a source that repeats, so blind spots in one region or provider's IP range don't mean blind spots everywhere.
Each day's active set is archived daily at github.com/stamparm/ipnoise.
Generated ·collecting since