stamparm/ipsum resource

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

2357 stars · 176 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

IPsum is a daily-updated threat intelligence feed aggregating 30+ public lists of suspicious and malicious IP addresses, with each IP annotated by the number of source lists it appears on. It publishes preprocessed level files (levels/1.txt through levels/8.txt) so operators can pick a cross-list agreement threshold for firewall blocking.

Use cases

• block malicious IPs with iptables and ipset
• get a daily auto-ban list of bad IPs
• filter inbound traffic using a blacklist consensus threshold
• feed a firewall with IPs seen on at least 3 blacklists
• integrate a threat feed into a security monitoring pipeline
• reduce false positives by requiring multiple blacklist hits

When to choose

• you need a free, transparent, regularly updated malicious IP blocklist
• you want control over the confidence threshold rather than an opaque reputation score
• you run Linux firewalls and want ready-to-use ipset/iptables integration

When to avoid

• you need per-IP context, geolocation, or enrichment beyond occurrence counts
• you require an API or real-time lookups rather than a daily batch feed
• you need IPv6 coverage or guaranteed accuracy for blocking decisions

Facets

dataset · maturity active

security monitoring security networking self-hosted cli self-hosted threat-intelligence ip-blacklist firewall ipset iptables daily-feed blocklist linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="stamparm/ipsum")