GriffinGuard provides real-time insights into global Internet exploitation activity using more than 100,000 sensors worldwide.

This feed contains the top 10,000 abusive IP addresses (by packet count) observed over the last 7 days. It includes mass-Internet scanners and exploiters. Each IP is classified as Malicious, Institutional, or Suspicious, and flagged as potentially spoofable or confirmed.

The feed is updated roughly every 30 minutes. The publicly available feed represents approximately 98% of the full dataset available through their commercial API.

Note: This data is provided for security monitoring and research purposes only and is not redistributed. It is downloaded and analyzed locally by update-ipsets.