├── README.md ├── lists ├── skipa_checkpoint.csv ├── skipa_cidr.txt └── skipa_range.txt └── media ├── 28082024.png ├── 3rd_party_ips.png ├── 515997203.png ├── NGFW.png ├── cybercock.png ├── fgup.png ├── lookup.png ├── packets.png ├── skipa.png └── tg.png /README.md: -------------------------------------------------------------------------------- 1 | # CyberOK Skipa ips & something more 2 | 3 | Раз [@cyberok-org](https://www.github.com/cyberok-org) отказываются отвечать на просьбы исключения из сканирований, сливаю в паблик свой небольшой ресёрч и список аффилированных с ними ip адресов 4 | 5 | ## Про связь с подведами РКН 6 | 7 | Начну с [небольшой базы](https://t.me/poxek/4149?comment=85901) от увожаемого CEO сайберока (TL;DR: правильным является 4 вариант) 8 | 9 | ![TG](https://github.com/tread-lightly/CyberOK_Skipa_ips/blob/main/media/tg.png) 10 | 11 | **Важный апдейт от февраля 2025:** 12 | 13 | Спустя полгода с моей публикации, CyberCock косвенно подтвердили, что сотрудничают с роскомпозором: [пост в их тг](https://t.me/cyberok_news/87). Надеюсь, никому не нужно доказывать, что они сканируют ваши вдски / впски / сервачки не из благих целей ради вашей же безопасности 14 | 15 | ![CYBERCOCK](https://github.com/tread-lightly/CyberOK_Skipa_ips/blob/main/media/cybercock.png) 16 | 17 | 18 | **Теперь факты:** 19 | 20 | В первом и втором кварталах 2024, одновременно с запуском Zmap с scan-**.skipa.cyberok.ru, VDS/VPS селектела и etc., в логах начали регулярно светиться интересные сурсы - 212.192.158.0/24, с которых так же запускался Zmap: 21 | 22 | >... protection_name:"ZMap Security Scanner"; protection_type:"IPS"; proxy_src_ip:"212.192.158.168"; ser_agent_kid:"Other: Mozilla/5.0 zgrab/0.x"; service:"443"; ... 23 | > 24 | > 25 | >... protection_name:"ZMap Security Scanner"; protection_type:"IPS"; proxy_src_ip:"77.223.120.227"; ser_agent_kid:"Other: Mozilla/5.0 zgrab/0.x"; service:"80"; ... 26 | 27 | ![NGFW](https://github.com/tread-lightly/CyberOK_Skipa_ips/blob/main/media/NGFW.png) 28 | 29 | Количество отправляемых пакетов как хостами скипы, так и хостами из подсети 212.192.158.0/24, идентичное: 12-13 - 1/3 от 36 пакетов на хост, которые они высылают ([выступление на phd2](https://youtu.be/4wSxp7t6huA?si=O15rvlfQ2J6IWBaD&t=620)) и нет, это не ограничения самого Zmap: 30 | 31 | ![PACKETS](https://github.com/tread-lightly/CyberOK_Skipa_ips/blob/main/media/packets.png) 32 | 33 | Провайдером же подсети 212.192.158.0/24 является **FGUP GRCHC**, что есть ничто иное как Федеральное государственное унитарное предприятие «Главный радиочастотный центр» - дочка РКН, которую не раз связывали с мониторингом и цензурированием рунета ([источник](https://baj.media/ru/kiberpartizany-rasskazali-kak-v-rossii-sozdayut-botov-kotorye-razmeshchayut-prokremlevskie-3/)). Только на phd про таких "знакомых" не было ни слова, а жаль: 34 | 35 | ![LOOKUP](https://github.com/tread-lightly/CyberOK_Skipa_ips/blob/main/media/lookup.png) 36 | 37 | Посмотреть на архивные репорты и периоды активности хостов ГРЧЦ можно на [abuseipdb](https://www.abuseipdb.com/check-block/212.192.158.0/24) 38 | 39 | С политикой active probing сайберока можно ознакомиться [здесь](https://www.cyberok.ru/policy.html). Очевидно, что запрос на исключение, как и блокировка только хостов scan-xx.skipa.cyberok.ru - это полумеры 40 | > The moral of the story is: I chose a half-measure when I should have gone all the way. I'll never make that mistake again. No more half-measures, Walter. *(Season 3, Episode 12 of Breaking Bad)* 41 | 42 | ## IP адреса 43 | 44 | Наиболее полный перечень активных IP адресов сканеров CYBEROK Skipa, ГРЧЦ и НКЦКИ (обновляется регулярно, помимо него доступны ip-листы в 3 разных форматах: [CIDR](https://github.com/tread-lightly/CyberOK_Skipa_ips/blob/main/lists/skipa_cidr.txt), [Range](https://github.com/tread-lightly/CyberOK_Skipa_ips/blob/main/lists/skipa_range.txt) и [CheckPointCSV](https://github.com/tread-lightly/CyberOK_Skipa_ips/blob/main/lists/skipa_checkpoint.csv)): 45 | ``` 46 | 5.143.224.100/30 47 | 5.143.224.104/30 48 | 185.224.228.0/24 49 | 185.224.230.0/24 50 | 212.192.158.0/24 51 | 85.142.100.0/24 52 | 92.38.153.0/24 53 | 188.68.217.207 54 | 212.41.12.45 55 | 212.41.12.46 56 | 212.41.12.47 57 | 212.41.12.48 58 | 212.41.13.23 59 | 212.41.13.24 60 | 212.41.13.25 61 | 31.131.251.106 62 | 31.131.251.235 63 | 31.131.255.205 64 | 31.131.255.206 65 | 31.131.255.207 66 | 31.131.255.208 67 | 31.131.255.209 68 | 31.131.255.210 69 | 31.131.255.211 70 | 31.131.255.212 71 | 31.131.255.240 72 | 37.9.13.54 73 | 37.9.13.84 74 | 37.9.13.105 75 | 37.9.13.217 76 | 45.146.167.56 77 | 45.146.167.68 78 | 45.146.167.105 79 | 45.146.167.237 80 | 45.92.176.94 81 | 45.92.176.129 82 | 45.92.176.143 83 | 45.92.176.144 84 | 45.92.176.145 85 | 45.92.177.113 86 | 45.92.177.127 87 | 45.92.177.237 88 | 45.93.20.45 89 | 45.93.20.79 90 | 45.93.20.104 91 | 45.93.20.109 92 | 45.93.20.126 93 | 45.93.20.148 94 | 45.93.20.229 95 | 45.93.20.103 96 | 62.84.116.11 97 | 62.84.116.13 98 | 62.84.116.34 99 | 62.84.116.219 100 | 62.84.116.237 101 | 77.223.102.84 102 | 77.223.102.101 103 | 77.223.102.191 104 | 77.223.103.45 105 | 77.223.103.53 106 | 94.26.228.205 107 | 95.143.190.169 108 | 95.143.190.179 109 | 95.143.191.147 110 | 95.143.191.223 111 | 95.143.191.245 112 | 45.141.86.171 113 | 77.223.120.227 114 | 194.26.25.137 115 | 82.148.21.205 116 | 94.26.228.18 117 | 5.188.159.228 118 | 80.249.131.92 119 | 94.25.46.114 120 | 95.167.197.242 121 | 95.167.199.34 122 | 95.167.199.90 123 | 95.167.200.10 124 | 176.208.65.146 125 | 176.208.67.114 126 | 176.211.48.242 127 | 178.185.170.42 128 | 178.185.216.114 129 | 178.185.234.162 130 | 178.185.235.58 131 | 178.185.238.154 132 | 178.185.238.178 133 | 178.185.241.114 134 | 176.211.56.130 135 | 176.211.103.178 136 | 92.124.109.218 137 | 85.175.69.50 138 | 95.167.62.66 139 | 176.100.243.247 140 | 176.208.69.226 141 | 176.208.70.162 142 | 176.208.79.82 143 | 176.210.118.218 144 | 176.211.46.130 145 | 176.211.47.122 146 | 176.211.51.218 147 | 178.185.133.251 148 | 178.185.202.130 149 | 178.185.202.162 150 | 178.185.228.58 151 | 178.185.235.74 152 | 178.185.239.50 153 | 178.185.239.58 154 | 178.185.241.98 155 | 212.164.59.250 156 | 213.59.217.242 157 | 217.65.82.18 158 | 85.175.147.234 159 | 91.122.177.241 160 | 95.167.133.10 161 | 95.167.148.18 162 | 95.167.186.2 163 | 95.167.198.186 164 | 95.167.62.82 165 | 95.167.82.26 166 | 95.167.87.66 167 | 95.189.36.106 168 | 80.93.187.17 169 | 5.178.87.167 170 | 5.159.97.203 171 | 188.246.224.80 172 | 45.92.176.205 173 | 193.168.46.143 174 | 212.67.10.218 175 | 212.67.11.128 176 | 212.67.11.136 177 | 212.67.11.167 178 | 212.67.11.227 179 | 212.67.11.233 180 | 212.67.11.234 181 | 212.67.11.37 182 | 62.113.99.65 183 | 176.211.103.202 184 | 212.41.26.138 185 | 92.223.103.144 186 | 212.41.10.41 187 | 89.169.28.191 188 | 89.169.28.210 189 | 89.169.28.214 190 | ``` 191 | 192 | UPD 10.06.2024: 193 | 194 | Замечена схожая активность с адреса ```45.141.86.171```. Потенциально, в сканированиях могут быть задействованы и адреса с подсети ```45.141.86.0/24``` 195 | 196 | UPD 04.07.2024: 197 | 198 | Добавлен ```77.223.120.227``` (scan-03.skipa.cyberok.ru) 199 | 200 | Замечена схожая активность с адреса ```194.26.25.137``` 201 | 202 | UPD 18.07.2024: 203 | 204 | Добавлен ```82.148.21.205``` (scan-04.skipa.cyberok.ru) 205 | 206 | UPD 07.08.2024: 207 | 208 | Добавлен ```94.26.228.18``` (scan-06.skipa.cyberok.ru) 209 | 210 | UPD 18.08.2024: 211 | 212 | Добавлен ```5.188.159.228``` 213 | (scan-05.skipa.cyberok.ru) 214 | 215 | Добавлен ```80.249.131.92``` 216 | (scan-07.skipa.cyberok.ru) 217 | 218 | UPD 29.08.2024: 219 | 220 | Добавлены ```176.208.67.114```, ```178.185.238.178```, ```178.185.238.154```, ```176.211.48.242```, ```176.208.65.146```, ```95.167.199.34```, ```178.185.170.42```, ```176.211.56.130```, ```178.185.235.58```, ```95.167.200.10```, ```178.185.241.114```, ```176.211.103.178```, ```94.25.46.114```, ```178.185.234.162```, ```178.185.216.114```, ```95.167.197.242```, ```95.167.199.90``` 221 | (Zmap + идентичный характер отправки пакетов + пересечение по времени с хостами Skipa и FGUP GRCHC. Впервые замечены в апреле 2024, а 28.08.2024 с большинства из них снова регистрируется трафик) 222 | 223 | 224 | ![PACKETS](https://github.com/tread-lightly/CyberOK_Skipa_ips/blob/main/media/28082024.png) 225 | 226 | 227 | UPD 30.08.2024: 228 | 229 | Добавлен ```92.124.109.218``` 230 | 231 | UPD 31.08.2024: 232 | 233 | Добавлен ```85.175.69.50``` 234 | 235 | UPD 01.09.2024: 236 | 237 | Добавлен ```95.167.62.66``` 238 | 239 | UPD 02.09.2024: 240 | 241 | Добавлены ```176.100.243.247```, ```176.208.69.226```, ```176.208.70.162```, ```176.208.79.82```, ```176.210.118.218```, ```176.211.46.130```, ```176.211.47.122```, ```176.211.51.218```, ```178.185.133.251```, ```178.185.202.130```, ```178.185.202.162```, ```178.185.228.58```, ```178.185.235.74```, ```178.185.239.50```, ```178.185.239.58```, ```178.185.241.98```, ```212.164.59.250```, ```213.59.217.242```, ```217.65.82.18```, ```85.175.147.234```, ```91.122.177.241```, ```95.167.133.10```, ```95.167.148.18```, ```95.167.186.2 ```, ```95.167.198.186```, ```95.167.62.82```, ```95.167.82.26```, ```95.167.87.66```, ```95.189.36.106``` 242 | (Анализ репортов с AbuseIPDB + идентичный характер отправки пакетов + типичные провайдеры: sibirtelecom, rostelecom, avangarddsl) 243 | 244 | ![3RDPARTY](https://github.com/tread-lightly/CyberOK_Skipa_ips/blob/main/media/3rd_party_ips.png) 245 | 246 | UPD 08.09.2024: 247 | 248 | Добавлен диапазон ```5.143.224.100-5.143.224.107```. Прямой корреляции со скипой за несколько месяцев найти не удалось (кроме того, что используется Zmap). Немного вводных данных ([источник](https://gist.github.com/v98765/922793b6e5bfe0d9f7dd896337ab6952)): 249 | 250 | > Сообщаем Вам, что во исполнение указа Президента РФ № 250 от 1 мая 2022 года и приказа ФСБ России № 213 от 11.05.2023, НКЦКИ на постоянной основе осуществляет сбор технических характеристик и параметров ресурсов сети Интернет принадлежащих участникам ГосСОПКА на предмет выявления угроз информационной безопасности Российской Федерации. Сбор технических характеристик и параметров осуществляется с использованием адресного пространства ПАО «Ростелеком» со следующих IP адресов: 251 | > 252 | > 5.143.224.100, 5.143.224.101, 5.143.224.102, 5.143.224.103, 5.143.224.104, 5.143.224.105, 5.143.224.106, 5.143.224.107 253 | > 254 | > Данные IP-адреса используются только для решения задач НКЦКИ. 255 | > В связи с тем, что сбор технических характеристик и параметров может фиксироваться средствами обнаружения вторжений как компьютерные воздействия, просим не учитывать воздействия с вышеуказанных IP адресов. 256 | 257 | Однако, сканируются не только участники госсопки ([репорты на abuseipdb](https://www.abuseipdb.com/check-block/5.143.224.0/24)). Лукацкий, к слову, тоже [связывал](https://lukatsky.ru/legislation/ot-bumazhnoy-ib-k-prakticheskoy-novyy-prikaz-fsb-po-monitoringu-zaschischennosti.html) этот приказ фсб с балалайкой сайберока ещё в 2023 258 | 259 | UPD 09.09.2024: 260 | 261 | Добавлены ```80.93.187.17``` (scan-06.skipa.cyberok.ru) и ```5.178.87.167``` (scan-08.skipa.cyberok.ru) 262 | 263 | UPD 24.09.2024: 264 | 265 | Добавлены ```188.246.224.80``` (scan-107.skipa.cyberok.ru) и ```5.159.97.203``` (Zmap + аналогичный хаарктер отправки пакетов): 266 | 267 | ![515997203](https://github.com/tread-lightly/CyberOK_Skipa_ips/blob/main/media/515997203.png) 268 | 269 | Также сайберкок начал что-то мутить с именами своих хостов - теперь большинство из них имеют номера 100+, а не от 00 до 99, что указано в их "политике ответственного сканирования". Не такое оно уж и ответственное, получается. Вероятнее всего, идёт переход на beget 270 | 271 | Помимо этого, добавлены: ```45.92.176.205``` (scan-26.skipa.cyberok.ru), ```193.168.46.143``` (scan-30.skipa.cyberok.ru), ```212.67.10.218``` (scan-31.skipa.cyberok.ru), ```212.67.11.128``` (scan-32.skipa.cyberok.ru), ```212.67.11.136``` (scan-33.skipa.cyberok.ru), ```212.67.11.167``` (scan-34.skipa.cyberok.ru), ```212.67.11.227``` (scan-35.skipa.cyberok.ru), ```212.67.11.233``` (scan-36.skipa.cyberok.ru), ```212.67.11.234``` (scan-37.skipa.cyberok.ru), ```212.67.11.37``` (scan-38.skipa.cyberok.ru), ```62.113.99.65``` (scan-39.skipa.cyberok.ru). Активности с них пока не зарегистрировано 272 | 273 | UPD 11.10.2024: 274 | 275 | Добавлен ```176.211.103.202``` (Zmap + идентичный характер отправки пакетов + rostelecom, типичный провайдер) 276 | 277 | UPD 18.10.2024: 278 | 279 | Добавлен ```212.41.26.138``` (scan-77.skipa.cyberok.ru) 280 | 281 | 282 | UPD 22.11.2024: 283 | 284 | Добавлен ```92.38.153.17``` (scan-78.skipa.cyberok.ru). Теперь используют и edgecenter.ru 285 | 286 | UPD 29.11.2024: 287 | 288 | Добавлен ```92.38.153.240``` (scan-79.skipa.cyberok.ru) 289 | 290 | UPD 04.12.2024: 291 | 292 | Добавлен ```85.142.100.2``` (scan-73.skipa.cyberok.ru). Интересный ISP: SCIENTIFIC RESEARCH INSTITUTE FOR SYSTEM ANALYSIS OF THE NATIONAL RESEARCH CENTRE KURCHATOV INSTITUTE 293 | 294 | UPD 07.12.2024: 295 | 296 | Добавлены: ```85.142.100.107``` (scan-105.skipa.cyberok.ru), ```85.142.100.106``` (scan-103.skipa.cyberok.ru) ```85.142.100.105``` (scan-102.skipa.cyberok.ru), ```85.142.100.103``` (scan-02.skipa.cyberok.ru), ```85.142.100.3``` (scan-70.skipa.cyberok.ru), ```85.142.100.5``` (scan-72.skipa.cyberok.ru) 297 | 298 | Предлагаю банить всю подсеть ```85.142.100.0/24``` 299 | 300 | UPD 09.12.2024: 301 | 302 | Добавлены: ```85.142.100.52``` (scan-20.skipa.cyberok.ru), ```85.142.100.51``` (scan-26.skipa.cyberok.ru) 303 | 304 | Не предлагаю, а настоятельно рекомендую банить всю подсеть ```85.142.100.0/24``` 305 | 306 | UPD 10.12.2024: 307 | 308 | Добавлен ```92.38.153.100``` (scan-80.skipa.cyberok.ru) 309 | 310 | Предлагаю банить всю подсеть ```92.38.153.0/24``` 311 | 312 | UPD 13.12.2024: 313 | 314 | Добавлены: ```85.142.100.8``` (scan-76.skipa.cyberok.ru), ```85.142.100.82``` (scan-50.skipa.cyberok.ru), ```85.142.100.108``` (scan-01.skipa.cyberok.ru ), ```85.142.100.134``` (scan-106.skipa.cyberok.ru), ```85.142.100.135``` (scan-107.skipa.cyberok.ru), ```85.142.100.136``` (scan-108.skipa.cyberok.ru) 315 | 316 | В дальнейшем адреса из подсети ```85.142.100.0/24``` публиковаться не будут - в листы внесена вся подсеть 317 | 318 | UPD 19.12.2024: 319 | 320 | Добавлен ```92.223.103.144``` (scan-82.skipa.cyberok.ru) 321 | 322 | Новая (и грязная) подсеть от edgecenter.ru. [Старые репорты](https://www.abuseipdb.com/check-block/92.223.103.0/24) 323 | 324 | UPD 20.12.2024: 325 | 326 | Добавлен ```212.41.10.41``` (scan-77.skipa.cyberok.ru) 327 | 328 | UPD 17.03.2025: 329 | 330 | Добавлены ```89.169.28.210``` (p-access-01.cyberok.ru) и ```89.169.28.191``` 331 | (mongo3.cyberok.ru). Достаточно [подозрительная подсеть](https://www.abuseipdb.com/check-block/89.169.28.0/24) 332 | 333 | UPD 18.03.2025: 334 | 335 | Добавлен ```89.169.28.214``` (p-access-02.cyberok.ru) 336 | -------------------------------------------------------------------------------- /lists/skipa_checkpoint.csv: -------------------------------------------------------------------------------- 1 | #! DESCRIPTION = SKIPA,,,,,, 2 | #! REFERENCE = Skipa and GRCHC ips,,,,,, 3 | # Uniq-Name,#Value,#Type,#Confidence,#Severity,#Product,#Comment 4 | nkcki.5.143.224.x,5.143.224.100-5.143.224.107,IP Range,high,high,AB,NKCKI 5 | fgup.grchc.185.224.228.x,185.224.228.0-185.224.228.255,IP Range,high,high,AB,FGUP GRCHC 6 | fgup.grchc.185.224.230.x,185.224.230.0-185.224.230.255,IP Range,high,high,AB,FGUP GRCHC 7 | fgup.grchc.212.192.158.x,212.192.158.0-212.192.158.255,IP Range,high,high,AB,FGUP GRCHC 8 | skipa.kurchatov.85.142.100.x,85.142.100.0-85.142.100.255,IP Range,high,high,AB,Skipa 9 | skipa.edgecenter.92.38.153.x,92.38.153.0-92.38.153.255,IP Range,high,high,AB,Skipa 10 | 188.68.217.207,188.68.217.207,IP,high,high,AB,Skipa or similar 11 | 212.41.12.45,212.41.12.45,IP,high,high,AB,Skipa or similar 12 | 212.41.12.46,212.41.12.46,IP,high,high,AB,Skipa or similar 13 | 212.41.12.47,212.41.12.47,IP,high,high,AB,Skipa or similar 14 | 212.41.12.48,212.41.12.48,IP,high,high,AB,Skipa or similar 15 | 212.41.13.23,212.41.13.23,IP,high,high,AB,Skipa or similar 16 | 212.41.13.24,212.41.13.24,IP,high,high,AB,Skipa or similar 17 | 212.41.13.25,212.41.13.25,IP,high,high,AB,Skipa or similar 18 | 31.131.251.106,31.131.251.106,IP,high,high,AB,Skipa or similar 19 | 31.131.251.235,31.131.251.235,IP,high,high,AB,Skipa or similar 20 | 31.131.255.205,31.131.255.205,IP,high,high,AB,Skipa or similar 21 | 31.131.255.206,31.131.255.206,IP,high,high,AB,Skipa or similar 22 | 31.131.255.207,31.131.255.207,IP,high,high,AB,Skipa or similar 23 | 31.131.255.208,31.131.255.208,IP,high,high,AB,Skipa or similar 24 | 31.131.255.209,31.131.255.209,IP,high,high,AB,Skipa or similar 25 | 31.131.255.210,31.131.255.210,IP,high,high,AB,Skipa or similar 26 | 31.131.255.211,31.131.255.211,IP,high,high,AB,Skipa or similar 27 | 31.131.255.212,31.131.255.212,IP,high,high,AB,Skipa or similar 28 | 31.131.255.240,31.131.255.240,IP,high,high,AB,Skipa or similar 29 | 37.9.13.54,37.9.13.54,IP,high,high,AB,Skipa or similar 30 | 37.9.13.84,37.9.13.84,IP,high,high,AB,Skipa or similar 31 | 37.9.13.105,37.9.13.105,IP,high,high,AB,Skipa or similar 32 | 37.9.13.217,37.9.13.217,IP,high,high,AB,Skipa or similar 33 | 45.146.167.56,45.146.167.56,IP,high,high,AB,Skipa or similar 34 | 45.146.167.68,45.146.167.68,IP,high,high,AB,Skipa or similar 35 | 45.146.167.105,45.146.167.105,IP,high,high,AB,Skipa or similar 36 | 45.146.167.237,45.146.167.237,IP,high,high,AB,Skipa or similar 37 | 45.92.176.94,45.92.176.94,IP,high,high,AB,Skipa or similar 38 | 45.92.176.129,45.92.176.129,IP,high,high,AB,Skipa or similar 39 | 45.92.176.143,45.92.176.143,IP,high,high,AB,Skipa or similar 40 | 45.92.176.144,45.92.176.144,IP,high,high,AB,Skipa or similar 41 | 45.92.176.145,45.92.176.145,IP,high,high,AB,Skipa or similar 42 | 45.92.177.113,45.92.177.113,IP,high,high,AB,Skipa or similar 43 | 45.92.177.127,45.92.177.127,IP,high,high,AB,Skipa or similar 44 | 45.92.177.237,45.92.177.237,IP,high,high,AB,Skipa or similar 45 | 45.93.20.45,45.93.20.45,IP,high,high,AB,Skipa or similar 46 | 45.93.20.79,45.93.20.79,IP,high,high,AB,Skipa or similar 47 | 45.93.20.104,45.93.20.104,IP,high,high,AB,Skipa or similar 48 | 45.93.20.109,45.93.20.109,IP,high,high,AB,Skipa or similar 49 | 45.93.20.126,45.93.20.126,IP,high,high,AB,Skipa or similar 50 | 45.93.20.148,45.93.20.148,IP,high,high,AB,Skipa or similar 51 | 45.93.20.229,45.93.20.229,IP,high,high,AB,Skipa or similar 52 | 45.93.20.103,45.93.20.103,IP,high,high,AB,Skipa or similar 53 | 62.84.116.11,62.84.116.11,IP,high,high,AB,Skipa or similar 54 | 62.84.116.13,62.84.116.13,IP,high,high,AB,Skipa or similar 55 | 62.84.116.34,62.84.116.34,IP,high,high,AB,Skipa or similar 56 | 62.84.116.219,62.84.116.219,IP,high,high,AB,Skipa or similar 57 | 62.84.116.237,62.84.116.237,IP,high,high,AB,Skipa or similar 58 | 77.223.102.84,77.223.102.84,IP,high,high,AB,Skipa or similar 59 | 77.223.102.101,77.223.102.101,IP,high,high,AB,Skipa or similar 60 | 77.223.102.191,77.223.102.191,IP,high,high,AB,Skipa or similar 61 | 77.223.103.45,77.223.103.45,IP,high,high,AB,Skipa or similar 62 | 77.223.103.53,77.223.103.53,IP,high,high,AB,Skipa or similar 63 | 94.26.228.205,94.26.228.205,IP,high,high,AB,Skipa or similar 64 | 95.143.190.169,95.143.190.169,IP,high,high,AB,Skipa or similar 65 | 95.143.190.179,95.143.190.179,IP,high,high,AB,Skipa or similar 66 | 95.143.191.147,95.143.191.147,IP,high,high,AB,Skipa or similar 67 | 95.143.191.223,95.143.191.223,IP,high,high,AB,Skipa or similar 68 | 95.143.191.245,95.143.191.245,IP,high,high,AB,Skipa or similar 69 | 45.141.86.171,45.141.86.171,IP,high,high,AB,Skipa or similar 70 | 77.223.120.227,77.223.120.227,IP,high,high,AB,Skipa or similar 71 | 194.26.25.137,194.26.25.137,IP,high,high,AB,Skipa or similar 72 | 82.148.21.205,82.148.21.205,IP,high,high,AB,Skipa or similar 73 | 94.26.228.18,94.26.228.18,IP,high,high,AB,Skipa or similar 74 | 5.188.159.228,5.188.159.228,IP,high,high,AB,Skipa or similar 75 | 80.249.131.92,80.249.131.92,IP,high,high,AB,Skipa or similar 76 | 94.25.46.114,94.25.46.114,IP,high,high,AB,Skipa or similar 77 | 95.167.197.242,95.167.197.242,IP,high,high,AB,Skipa or similar 78 | 95.167.199.34,95.167.199.34,IP,high,high,AB,Skipa or similar 79 | 95.167.199.90,95.167.199.90,IP,high,high,AB,Skipa or similar 80 | 95.167.200.10,95.167.200.10,IP,high,high,AB,Skipa or similar 81 | 176.208.65.146,176.208.65.146,IP,high,high,AB,Skipa or similar 82 | 176.208.67.114,176.208.67.114,IP,high,high,AB,Skipa or similar 83 | 176.211.48.242,176.211.48.242,IP,high,high,AB,Skipa or similar 84 | 178.185.170.42,178.185.170.42,IP,high,high,AB,Skipa or similar 85 | 178.185.216.114,178.185.216.114,IP,high,high,AB,Skipa or similar 86 | 178.185.234.162,178.185.234.162,IP,high,high,AB,Skipa or similar 87 | 178.185.235.58,178.185.235.58,IP,high,high,AB,Skipa or similar 88 | 178.185.238.154,178.185.238.154,IP,high,high,AB,Skipa or similar 89 | 178.185.238.178,178.185.238.178,IP,high,high,AB,Skipa or similar 90 | 178.185.241.114,178.185.241.114,IP,high,high,AB,Skipa or similar 91 | 176.211.56.130,176.211.56.130,IP,high,high,AB,Skipa or similar 92 | 176.211.103.178,176.211.103.178,IP,high,high,AB,Skipa or similar 93 | 92.124.109.218,92.124.109.218,IP,high,high,AB,Skipa or similar 94 | 85.175.69.50,85.175.69.50,IP,high,high,AB,Skipa or similar 95 | 95.167.62.66,95.167.62.66,IP,high,high,AB,Skipa or similar 96 | 176.100.243.247,176.100.243.247,IP,high,high,AB,Skipa or similar 97 | 176.208.69.226,176.208.69.226,IP,high,high,AB,Skipa or similar 98 | 176.208.70.162,176.208.70.162,IP,high,high,AB,Skipa or similar 99 | 176.208.79.82,176.208.79.82,IP,high,high,AB,Skipa or similar 100 | 176.210.118.218,176.210.118.218,IP,high,high,AB,Skipa or similar 101 | 176.211.46.130,176.211.46.130,IP,high,high,AB,Skipa or similar 102 | 176.211.47.122,176.211.47.122,IP,high,high,AB,Skipa or similar 103 | 176.211.51.218,176.211.51.218,IP,high,high,AB,Skipa or similar 104 | 178.185.133.251,178.185.133.251,IP,high,high,AB,Skipa or similar 105 | 178.185.202.130,178.185.202.130,IP,high,high,AB,Skipa or similar 106 | 178.185.202.162,178.185.202.162,IP,high,high,AB,Skipa or similar 107 | 178.185.228.58,178.185.228.58,IP,high,high,AB,Skipa or similar 108 | 178.185.235.74,178.185.235.74,IP,high,high,AB,Skipa or similar 109 | 178.185.239.50,178.185.239.50,IP,high,high,AB,Skipa or similar 110 | 178.185.239.58,178.185.239.58,IP,high,high,AB,Skipa or similar 111 | 178.185.241.98,178.185.241.98,IP,high,high,AB,Skipa or similar 112 | 212.164.59.250,212.164.59.250,IP,high,high,AB,Skipa or similar 113 | 213.59.217.242,213.59.217.242,IP,high,high,AB,Skipa or similar 114 | 217.65.82.18,217.65.82.18,IP,high,high,AB,Skipa or similar 115 | 85.175.147.234,85.175.147.234,IP,high,high,AB,Skipa or similar 116 | 91.122.177.241,91.122.177.241,IP,high,high,AB,Skipa or similar 117 | 95.167.133.10,95.167.133.10,IP,high,high,AB,Skipa or similar 118 | 95.167.148.18,95.167.148.18,IP,high,high,AB,Skipa or similar 119 | 95.167.186.2 ,95.167.186.2 ,IP,high,high,AB,Skipa or similar 120 | 95.167.198.186,95.167.198.186,IP,high,high,AB,Skipa or similar 121 | 95.167.62.82,95.167.62.82,IP,high,high,AB,Skipa or similar 122 | 95.167.82.26,95.167.82.26,IP,high,high,AB,Skipa or similar 123 | 95.167.87.66,95.167.87.66,IP,high,high,AB,Skipa or similar 124 | 95.189.36.106,95.189.36.106,IP,high,high,AB,Skipa or similar 125 | 80.93.187.17,80.93.187.17,IP,high,high,AB,Skipa or similar 126 | 5.178.87.167,5.178.87.167,IP,high,high,AB,Skipa or similar 127 | 5.159.97.203,5.159.97.203,IP,high,high,AB,Skipa or similar 128 | 188.246.224.80,188.246.224.80,IP,high,high,AB,Skipa or similar 129 | 45.92.176.205,45.92.176.205,IP,high,high,AB,Skipa or similar 130 | 193.168.46.143,193.168.46.143,IP,high,high,AB,Skipa or similar 131 | 212.67.10.218,212.67.10.218,IP,high,high,AB,Skipa or similar 132 | 212.67.11.128,212.67.11.128,IP,high,high,AB,Skipa or similar 133 | 212.67.11.136,212.67.11.136,IP,high,high,AB,Skipa or similar 134 | 212.67.11.167,212.67.11.167,IP,high,high,AB,Skipa or similar 135 | 212.67.11.227,212.67.11.227,IP,high,high,AB,Skipa or similar 136 | 212.67.11.233,212.67.11.233,IP,high,high,AB,Skipa or similar 137 | 212.67.11.234,212.67.11.234,IP,high,high,AB,Skipa or similar 138 | 212.67.11.37,212.67.11.37,IP,high,high,AB,Skipa or similar 139 | 62.113.99.65,62.113.99.65,IP,high,high,AB,Skipa or similar 140 | 176.211.103.202,176.211.103.202,IP,high,high,AB,Skipa or similar 141 | 212.41.26.138,212.41.26.138,IP,high,high,AB,Skipa or similar 142 | 85.142.100.2,85.142.100.2,IP,high,high,AB,Skipa or similar 143 | 92.223.103.144,92.223.103.144,IP,high,high,AB,Skipa or similar 144 | 212.41.10.41,212.41.10.41,IP,high,high,AB,Skipa or similar 145 | 89.169.28.210,89.169.28.210,IP,high,high,AB,Skipa or similar 146 | 89.169.28.191,89.169.28.191,IP,high,high,AB,Skipa or similar 147 | 89.169.28.214,89.169.28.214,IP,high,high,AB,Skipa or similar 148 | -------------------------------------------------------------------------------- /lists/skipa_cidr.txt: -------------------------------------------------------------------------------- 1 | 5.143.224.100/30 2 | 5.143.224.104/30 3 | 185.224.228.0/24 4 | 185.224.230.0/24 5 | 212.192.158.0/24 6 | 85.142.100.0/24 7 | 92.38.153.0/24 8 | 188.68.217.207/32 9 | 212.41.12.45/32 10 | 212.41.12.46/32 11 | 212.41.12.47/32 12 | 212.41.12.48/32 13 | 212.41.13.23/32 14 | 212.41.13.24/32 15 | 212.41.13.25/32 16 | 31.131.251.106/32 17 | 31.131.251.235/32 18 | 31.131.255.205/32 19 | 31.131.255.206/32 20 | 31.131.255.207/32 21 | 31.131.255.208/32 22 | 31.131.255.209/32 23 | 31.131.255.210/32 24 | 31.131.255.211/32 25 | 31.131.255.212/32 26 | 31.131.255.240/32 27 | 37.9.13.54/32 28 | 37.9.13.84/32 29 | 37.9.13.105/32 30 | 37.9.13.217/32 31 | 45.146.167.56/32 32 | 45.146.167.68/32 33 | 45.146.167.105/32 34 | 45.146.167.237/32 35 | 45.92.176.94/32 36 | 45.92.176.129/32 37 | 45.92.176.143/32 38 | 45.92.176.144/32 39 | 45.92.176.145/32 40 | 45.92.177.113/32 41 | 45.92.177.127/32 42 | 45.92.177.237/32 43 | 45.93.20.45/32 44 | 45.93.20.79/32 45 | 45.93.20.104/32 46 | 45.93.20.109/32 47 | 45.93.20.126/32 48 | 45.93.20.148/32 49 | 45.93.20.229/32 50 | 45.93.20.103/32 51 | 62.84.116.11/32 52 | 62.84.116.13/32 53 | 62.84.116.34/32 54 | 62.84.116.219/32 55 | 62.84.116.237/32 56 | 77.223.102.84/32 57 | 77.223.102.101/32 58 | 77.223.102.191/32 59 | 77.223.103.45/32 60 | 77.223.103.53/32 61 | 94.26.228.205/32 62 | 95.143.190.169/32 63 | 95.143.190.179/32 64 | 95.143.191.147/32 65 | 95.143.191.223/32 66 | 95.143.191.245/32 67 | 45.141.86.171/32 68 | 77.223.120.227/32 69 | 194.26.25.137/32 70 | 82.148.21.205/32 71 | 94.26.228.18/32 72 | 5.188.159.228/32 73 | 80.249.131.92/32 74 | 94.25.46.114/32 75 | 95.167.197.242/32 76 | 95.167.199.34/32 77 | 95.167.199.90/32 78 | 95.167.200.10/32 79 | 176.208.65.146/32 80 | 176.208.67.114/32 81 | 176.211.48.242/32 82 | 178.185.170.42/32 83 | 178.185.216.114/32 84 | 178.185.234.162/32 85 | 178.185.235.58/32 86 | 178.185.238.154/32 87 | 178.185.238.178/32 88 | 178.185.241.114/32 89 | 176.211.56.130/32 90 | 176.211.103.178/32 91 | 92.124.109.218/32 92 | 85.175.69.50/32 93 | 95.167.62.66/32 94 | 176.100.243.247/32 95 | 176.208.69.226/32 96 | 176.208.70.162/32 97 | 176.208.79.82/32 98 | 176.210.118.218/32 99 | 176.211.46.130/32 100 | 176.211.47.122/32 101 | 176.211.51.218/32 102 | 178.185.133.251/32 103 | 178.185.202.130/32 104 | 178.185.202.162/32 105 | 178.185.228.58/32 106 | 178.185.235.74/32 107 | 178.185.239.50/32 108 | 178.185.239.58/32 109 | 178.185.241.98/32 110 | 212.164.59.250/32 111 | 213.59.217.242/32 112 | 217.65.82.18/32 113 | 85.175.147.234/32 114 | 91.122.177.241/32 115 | 95.167.133.10/32 116 | 95.167.148.18/32 117 | 95.167.186.2/32 118 | 95.167.198.186/32 119 | 95.167.62.82/32 120 | 95.167.82.26/32 121 | 95.167.87.66/32 122 | 95.189.36.106/32 123 | 80.93.187.17/32 124 | 5.178.87.167/32 125 | 5.159.97.203/32 126 | 188.246.224.80/32 127 | 45.92.176.205/32 128 | 193.168.46.143/32 129 | 212.67.10.218/32 130 | 212.67.11.128/32 131 | 212.67.11.136/32 132 | 212.67.11.167/32 133 | 212.67.11.227/32 134 | 212.67.11.233/32 135 | 212.67.11.234/32 136 | 212.67.11.37/32 137 | 62.113.99.65/32 138 | 176.211.103.202/32 139 | 212.41.26.138/32 140 | 85.142.100.2/32 141 | 92.223.103.144/32 142 | 212.41.10.41/32 143 | 89.169.28.210/32 144 | 89.169.28.191/32 145 | 89.169.28.214/32 146 | -------------------------------------------------------------------------------- /lists/skipa_range.txt: -------------------------------------------------------------------------------- 1 | 5.143.224.100-5.143.224.107 2 | 185.224.228.0-185.224.228.255 3 | 185.224.230.0-185.224.230.255 4 | 212.192.158.0-212.192.158.255 5 | 85.142.100.0-85.142.100.255 6 | 92.38.153.0-92.38.153.255 7 | 188.68.217.207 8 | 212.41.12.45 9 | 212.41.12.46 10 | 212.41.12.47 11 | 212.41.12.48 12 | 212.41.13.23 13 | 212.41.13.24 14 | 212.41.13.25 15 | 31.131.251.106 16 | 31.131.251.235 17 | 31.131.255.205 18 | 31.131.255.206 19 | 31.131.255.207 20 | 31.131.255.208 21 | 31.131.255.209 22 | 31.131.255.210 23 | 31.131.255.211 24 | 31.131.255.212 25 | 31.131.255.240 26 | 37.9.13.54 27 | 37.9.13.84 28 | 37.9.13.105 29 | 37.9.13.217 30 | 45.146.167.56 31 | 45.146.167.68 32 | 45.146.167.105 33 | 45.146.167.237 34 | 45.92.176.94 35 | 45.92.176.129 36 | 45.92.176.143 37 | 45.92.176.144 38 | 45.92.176.145 39 | 45.92.177.113 40 | 45.92.177.127 41 | 45.92.177.237 42 | 45.93.20.45 43 | 45.93.20.79 44 | 45.93.20.104 45 | 45.93.20.109 46 | 45.93.20.126 47 | 45.93.20.148 48 | 45.93.20.229 49 | 45.93.20.103 50 | 62.84.116.11 51 | 62.84.116.13 52 | 62.84.116.34 53 | 62.84.116.219 54 | 62.84.116.237 55 | 77.223.102.84 56 | 77.223.102.101 57 | 77.223.102.191 58 | 77.223.103.45 59 | 77.223.103.53 60 | 94.26.228.205 61 | 95.143.190.169 62 | 95.143.190.179 63 | 95.143.191.147 64 | 95.143.191.223 65 | 95.143.191.245 66 | 45.141.86.171 67 | 77.223.120.227 68 | 194.26.25.137 69 | 82.148.21.205 70 | 94.26.228.18 71 | 5.188.159.228 72 | 80.249.131.92 73 | 94.25.46.114 74 | 95.167.197.242 75 | 95.167.199.34 76 | 95.167.199.90 77 | 95.167.200.10 78 | 176.208.65.146 79 | 176.208.67.114 80 | 176.211.48.242 81 | 178.185.170.42 82 | 178.185.216.114 83 | 178.185.234.162 84 | 178.185.235.58 85 | 178.185.238.154 86 | 178.185.238.178 87 | 178.185.241.114 88 | 176.211.56.130 89 | 176.211.103.178 90 | 92.124.109.218 91 | 85.175.69.50 92 | 95.167.62.66 93 | 176.100.243.247 94 | 176.208.69.226 95 | 176.208.70.162 96 | 176.208.79.82 97 | 176.210.118.218 98 | 176.211.46.130 99 | 176.211.47.122 100 | 176.211.51.218 101 | 178.185.133.251 102 | 178.185.202.130 103 | 178.185.202.162 104 | 178.185.228.58 105 | 178.185.235.74 106 | 178.185.239.50 107 | 178.185.239.58 108 | 178.185.241.98 109 | 212.164.59.250 110 | 213.59.217.242 111 | 217.65.82.18 112 | 85.175.147.234 113 | 91.122.177.241 114 | 95.167.133.10 115 | 95.167.148.18 116 | 95.167.186.2 117 | 95.167.198.186 118 | 95.167.62.82 119 | 95.167.82.26 120 | 95.167.87.66 121 | 95.189.36.106 122 | 80.93.187.17 123 | 5.178.87.167 124 | 5.159.97.203 125 | 188.246.224.80 126 | 45.92.176.205 127 | 193.168.46.143 128 | 212.67.10.218 129 | 212.67.11.128 130 | 212.67.11.136 131 | 212.67.11.167 132 | 212.67.11.227 133 | 212.67.11.233 134 | 212.67.11.234 135 | 212.67.11.37 136 | 62.113.99.65 137 | 176.211.103.202 138 | 212.41.26.138 139 | 85.142.100.2 140 | 92.223.103.144 141 | 212.41.10.41 142 | 89.169.28.210 143 | 89.169.28.191 144 | 89.169.28.214 145 | -------------------------------------------------------------------------------- /media/28082024.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tread-lightly/CyberOK_Skipa_ips/48cdac9c3ed79717426d387dc3cdab5684eedab9/media/28082024.png -------------------------------------------------------------------------------- /media/3rd_party_ips.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tread-lightly/CyberOK_Skipa_ips/48cdac9c3ed79717426d387dc3cdab5684eedab9/media/3rd_party_ips.png -------------------------------------------------------------------------------- /media/515997203.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tread-lightly/CyberOK_Skipa_ips/48cdac9c3ed79717426d387dc3cdab5684eedab9/media/515997203.png -------------------------------------------------------------------------------- /media/NGFW.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tread-lightly/CyberOK_Skipa_ips/48cdac9c3ed79717426d387dc3cdab5684eedab9/media/NGFW.png -------------------------------------------------------------------------------- /media/cybercock.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tread-lightly/CyberOK_Skipa_ips/48cdac9c3ed79717426d387dc3cdab5684eedab9/media/cybercock.png -------------------------------------------------------------------------------- /media/fgup.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tread-lightly/CyberOK_Skipa_ips/48cdac9c3ed79717426d387dc3cdab5684eedab9/media/fgup.png -------------------------------------------------------------------------------- /media/lookup.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tread-lightly/CyberOK_Skipa_ips/48cdac9c3ed79717426d387dc3cdab5684eedab9/media/lookup.png -------------------------------------------------------------------------------- /media/packets.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tread-lightly/CyberOK_Skipa_ips/48cdac9c3ed79717426d387dc3cdab5684eedab9/media/packets.png -------------------------------------------------------------------------------- /media/skipa.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tread-lightly/CyberOK_Skipa_ips/48cdac9c3ed79717426d387dc3cdab5684eedab9/media/skipa.png -------------------------------------------------------------------------------- /media/tg.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tread-lightly/CyberOK_Skipa_ips/48cdac9c3ed79717426d387dc3cdab5684eedab9/media/tg.png --------------------------------------------------------------------------------