Trunc blacklists

We have hundreds of honeypots and real live systems sending logs to one of our central accounts. We decided to share some of the data we are receiving in the form of simple blacklists that anyone can use.

We have custom rules for a variety of popular log sources and our team can quickly develop custom rules for any log format as needed.

Web scanners - IP-based blacklist

An IP-based blacklist of IP addresses attacking our honeypots and/or live system logs. It requires a 3+ inclusion, or an IP detected attacking at least 3 of our locations - in order to minimize false positives.

https://trunc.org/blacklists/trunc-ip-blacklist.txt