IPsum is a daily-updated threat intelligence feed based on the analysis of 30+ publicly available IP blacklists. Each IP in the feed is scored by the number of blacklists it appears on, providing a simple but effective confidence metric.

This is the level 2 list: it includes IPs appearing on at least 2 blacklists.

IPsum is available in 8 levels, each filtering IPs by minimum blacklist count:

- ipsum — at least 1 blacklist
- ipsum_2 — at least 2 blacklists (this list)
- ipsum_3 — at least 3 blacklists (recommended)
- ipsum_4 — at least 4 blacklists
- ipsum_5 — at least 5 blacklists
- ipsum_6 — at least 6 blacklists
- ipsum_7 — at least 7 blacklists
- ipsum_8 — at least 8 blacklists (highest confidence)

Higher levels have fewer entries but significantly lower false positive rates. The IPsum project recommends level 3 or above for most use cases.

The feed is generated daily by automatically retrieving, parsing, and cross-referencing all source blacklists. The scoring approach is similar to reputation-based systems: the more independent sources that flag an IP, the higher the confidence that it is genuinely malicious.

Licensed under the Unlicense (public domain).