IPsum Threat IP Feed

Freeauth: noneUnlicense#cyber-threat#threat-intel#blocklists#network-data#risk✓ verified Nov 1, 2026

IPsum Threat IP Feed

Public IPsum threat intelligence as a tab-separated text feed aggregating suspicious or malicious IP addresses from more than 30 public lists. Each row contains an IP and the number of source lists containing it; no key is needed.

Coverage

The current snapshot is rebuilt every 24 hours and sorted from the highest source-list occurrence count to the lowest. Threshold files contain addresses appearing on at least one through eight lists; the provider does not state a geographic scope or historical coverage start.

Verdict

This is defensive data for ranking or filtering IP reputation by agreement across multiple public blocklists. The occurrence count is source-list overlap, not a probability or direct observation count, although the provider says higher counts generally imply higher confidence and fewer false positives. Daily refreshes can lag fast-moving activity, and inherited errors or address reassignment can create false positives. Do not visit or fetch listed hosts; match the downloaded feed locally and choose a threshold suited to the cost of blocking.

Get the free weekly email

Free weekly email of newly verified free data. Unsubscribe by emailing us.

Use in your agent

Load the IPsum threat-IP feed into pandas and Parquet. Checked against the provider's documentation on Nov 1, 2026.

Raw skill file (/skills/ipsum.md)Also in our MCP server: call get_ingestion_skill with {"slug": "ipsum"}.

Access

No account or key. The full feed and threshold files are public raw GitHub downloads.

Request

bash

curl 'https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt'

Format

Tab-separated text with comment headers, one IP address per data row, and an integer count of the public source lists containing that IP.

Load into pandas and Parquet

Needs Python 3 with requests, pandas and pyarrow.

python

"""IPsum full threat-IP feed -> pandas -> Parquet. No key."""
import io
import requests
import pandas as pd

URL = "https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt"
r = requests.get(URL, timeout=120)
r.raise_for_status()
df = pd.read_csv(io.StringIO(r.text), sep="\t", comment="#",
                 names=["ip", "source_count"], dtype={"ip": "string"})
df["source_count"] = pd.to_numeric(df["source_count"], downcast="integer")
df.to_parquet("ipsum.parquet", index=False)
print(len(df), "IP addresses", "source count", int(df["source_count"].min()), "to",
      int(df["source_count"].max()), int((df["source_count"] >= 3).sum()), "at level 3+")

Run by us on 2026-11-01 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 139773 IP addresses source count 1 to 12 18258 at level 3+

Limits

Rate limit: Not stated.
The repository is refreshed every 24 hours.
Preprocessed level files cover thresholds from at least one through at least eight source lists.

Quirks

Lines beginning with # are metadata and must be skipped before parsing the two tab-separated fields.
source_count measures occurrence across source lists, not event frequency, severity or probability.
Do not connect to listed hosts; use the downloaded feed only for defensive matching.

Terms and attribution

The repository uses the Unlicense and dedicates the work to the public domain.
The work is supplied as-is without warranty.

Sources

https://raw.githubusercontent.com/stamparm/ipsum/master/README.md: “All lists are automatically retrieved and parsed on a daily (every 24 hours) basis and the final result is pushed to this repository.”
https://raw.githubusercontent.com/stamparm/ipsum/master/README.md: “Higher counts generally mean higher confidence and fewer false positives when blocking inbound traffic.”
https://raw.githubusercontent.com/stamparm/ipsum/master/LICENSE: “This is free and unencumbered software released into the public domain.”

Information and education only. Not financial, investment, legal or tax advice. Listings can be inaccurate, incomplete or out of date and are provided "as is". Free tiers, limits and licenses belong to each provider and can change, so check the provider's own terms before you rely on them. Terms & Disclaimer

IPsum Threat IP Feed