These are the IP addresses of the most active Botnets/Zombies/Scanners in European Cyber Space

⚠Since these are malicious IP addresses that are bumping, you need to create rules based on WAN to LAN⚠

Support our work with a donation 👉 https://www.paypal.com/donate/?hosted_button_id=8GBRAM5CU57S4

blacklist_ips_for_fortinet_firewall_aa.txt

blacklist_ips_for_fortinet_firewall_ab.txt

botnets_zombies_scanner_spam_ips.txt (full list)

botnets_zombies_scanner_spam_ips_ipv6.txt (soon !!!)

• SSH Brute Forcers
• FortiOS CVE | RCE Exploits
• Exchange CVE | RCE Exploits
• VPN-SSL Brute Forcers
• C2 Cobalt Strike
• CGI Script Scanner
• Cisco ASA Scanner
• MSSQL Bruteforcer
• GPON CVE-2018-10561 Router Worm
• GPON CVE-2018-10562 Router Worm
• SSH Worm
• VMware ESXi Scanner
• RDP Worm
• Grafana API_JSONRPC.PHP Zabbix Credentials Disclosure
• WordPress Core User Enumeration
• Ivanti EPMM (MobileIron Core) Authentication Bypass
• Huawei HG532 UPnP CVE-2017-17215 Worm
• Open Proxy Scanner
• QNX Qconn Exploit
• ProxyLogon SSRF Vuln Check
• Atlassian Confluence Server Privilege Escalation
• Shodan Scanners
• Stretchoid Scanner
• XWorm MaaS (IoC)
• CVE-2023-22518 Exploitation
• NjRat
• QaKBot
• Malware
• Mirai

Etc.

I have created specific lists for Fortinet firewall users following the limitation set by Fortinet:

blacklist_ips_for_fortinet_firewall_aa.txt

blacklist_ips_for_fortinet_firewall_ab.txt

• etc.

Also, you will need to fork the list and split it into 130,000 entries per file. In this way, you can validate it in your Threat feeds of your Fortinet Firewall.

PS: this list will be updated every 24/48h