GitHub RadarBlue team tool
Aggregation of lists of malicious IP addresses (C2, malware, phishing), to be blocked in the LAN > WAN direction, integrated into firewalls: FortiGate, Palo Alto, pfSense, IPtables 27 stars.
Project links:Open GitHub projectBack to radar
Update of the following table: 2026-06-12 21:20 CEST
| Malicious IP addresses in full-outgoing-ip-a-\* | % | Number of IPs | | ---------------------------------------------------------- | ------- | ------------- | | Present in 3 sources and more | 0.72 % | 1 402 | | Present in 2 sources | 8.59 % | 16 637 | | Present in 1 source | 90.68 % | 175 569 | | Total | 100 % | 193 608 |
🇫🇷 Agrégation de listes d'adresses IP malveillantes de type phishing, malware et C2 (Command & Control) donc à bloquer UNIQUEMENT en sortie : dans le sens LAN > WAN
🇬🇧 Aggregation of lists of malicious IP addresses such as phishing, malware and C2 (Command & Control), therefore ONLY to be blocked in the LAN > WAN direction
<details> <summary><b>🇫🇷 Introduction</b></summary> <p>
Fichiers à utiliser (liens dans la partie "Links" ci-dessous) :
</p> </details> <details> <summary><b>🇬🇧 Introduction</b></summary> <p>
Files to use (links in the "Links" section below):
</p> </details> <details> <summary><b>🇫🇷 Comment l'utilisez dans mes équipements ? 🔧</b></summary> <p>
Comment intégrer ces listes dans un pare-feu ?
</p> </details> <details> <summary><b>🇬🇧 How do I use it in my devices? 🔧</b></summary> <p>
How to integrate these lists into a firewall?
</p> </details> <details> <summary><b>🔗 URL of files to copy paste ⧉</b></summary> <p>
Full aggregation files:
https://raw.githubusercontent.com/romainmarcoux/malicious-outgoing-ip/main/full-outgoing-ip-aa.txthttps://raw.githubusercontent.com/romainmarcoux/malicious-outgoing-ip/main/full-outgoing-ip-ab.txtFile of the 40,000 most malicious IPs:
https://raw.githubusercontent.com/romainmarcoux/malicious-outgoing-ip/main/full-outgoing-ip-40k.txt</p> </details> <details> <summary><b>Sources</b></summary> <p>
| Filename | Source | Description | | ------------------------------------------------------------ | ----------- | ----------- | | abuse.ch-\ | [link](https://threatfox.abuse.ch/) | Command and Control, RAT, Malware IPs | | alienvault-precisionsec-\ | link | Command and Control and Malware IPs | | cert.ssi.gouv.fr-\ | [link](https://www.cert.ssi.gouv.fr/) | Cybercriminal groups, Malware and Phishing IPs | | cybercrime-tracker.net-\ | link | Command and Control and Malware IPs | | cybercure.ai-\ | [link](https://www.cybercure.ai/) | Malware IPs | | digitalside.it-\ | link | Malware IPs | | drb-ra-\ | [link](https://x.com/drb_ra) | Command and Control IPs | | inquest.net-\ | link | Command and Control and Malware IPs | | malwarebytes-\ | [link](https://www.malwarebytes.com) | Command and Control, Malware and Phishing IPs | | mattyroberts.io-\ | link | Attackers, Botnet and Malware IPs | | sicehice-\ | [link](https://sicehice.com/) | Command and Control IPs | | threatview.io-\ | link | Botnet, C2, Malware and Phishing IPs | | urlabuse.com-\ | [link](https://urlabuse.com/) | Hacked website, Malware and Phishing IPs | | urlhaus.abuse.ch-\ | link | Malware IPs | | ut1-fr | link | Malware and Phishing IPs | | viriback.com-\* | link | Command and Control and Malware IPs |
</p> </details> <details> <summary><b>Release notes 📋</b></summary> <p>
</p> </details> <details> <summary><b>🇫🇷 Qui suis-je ?</b></summary> <p>
Je suis expert freelance en cybersécurité, notamment sur les pare-feux.
Je maintiens ce projet depuis 2023 pour aider la communauté à se protéger contre les cybermenaces.
N'hésitez pas à me consulter pour vos besoins d'expertise pare-feux (audit, intégration, migration, problématiques ...) : voir contact ci-dessous.
</p> </details> <details> <summary><b>🇬🇧 Who am I?</b></summary> <p>
I am a freelance cybersecurity expert, particularly on firewalls.
I have been maintaining this project since 2023 to help the community protect itself against cyber threats.
Do not hesitate to consult me for your firewall expertise needs (audit, integration, migration, issues, etc.): see contact below.
</p> </details> <details> <summary><b>To support me 🫴</b></summary> <p>
 
</p> </details> <details> <summary><b>🇫🇷 📬 Pour me contacter (faux positifs, idées, remerciements ...)</b></summary> <p>
Contactez-moi via LinkedIn (mon profil) pour :
</p> </details> <details> <summary><b>🇬🇧 📬 To contact me (false positives, ideas, thanks, etc.)</b></summary> <p>
Contact me via LinkedIn (my profile) to:
</p> </details>