# ☁️ Cloud Providers (abused for scraping / bots)
3.0.0.0/8          # AWS
13.32.0.0/11       # AWS
15.168.0.0/14      # AWS
44.192.0.0/10      # AWS
52.0.0.0/11        # AWS
54.0.0.0/10        # AWS
99.77.128.0/17     # AWS
204.236.192.0/19   # AWS

34.64.0.0/10       # Google Cloud
35.192.0.0/12      # Google Cloud
64.233.160.0/19    # Google LLC
66.249.64.0/19     # Googlebot (optional)
74.125.0.0/16      # Googlebot (optional)

13.64.0.0/11       # Azure
40.64.0.0/10       # Azure
104.208.0.0/13     # Azure
128.0.0.0/10       # Azure
157.55.0.0/16      # Azure

198.41.128.0/17    # Cloudflare

# 🕷️ Scanners / Crawlers / Research
46.161.9.0/24      # Scraper
71.6.135.0/24      # Shodan
94.102.49.0/24     # Nmap / Scanners
141.98.10.0/24     # AbuseIPDB scanner
162.216.149.0/24   # Shodan
173.234.0.0/18     # Scraper hosting
185.232.52.0/24    # Generic bots
192.184.0.0/15     # Bulk scraping
198.20.69.74       # Shodan
198.20.69.96/28    # Shodan
208.100.26.0/24    # Censys
162.142.125.0/24   # Censys

# ☣️ AbuseIPDB / Known Malicious
45.142.120.0/22    # AbuseIPDB
91.191.209.0/24    # AbuseIPDB
93.174.90.0/24     # AbuseIPDB
167.94.138.0/24    # Emerging threats
185.100.87.0/24    # AbuseIPDB
185.173.35.0/24    # Spamhaus DROP
185.191.171.0/24   # AbuseIPDB
185.220.101.0/24   # Dark relays
209.141.38.0/24    # AbuseIPDB
209.141.62.0/23    # AbuseIPDB
212.102.57.0/24    # Spamhaus DROP

# 🧪 Honeypots / Research / Decoys
65.49.20.0/22      # Project Honeypot
74.82.47.0/24      # Project Honeypot
85.92.85.0/24      # Honeypot
88.202.240.0/21    # Honeypot
162.244.32.0/19    # Research honeypots
198.108.66.0/23    # Research honeypots

# 🧅 Tor Exit Nodes / Anonymizers
45.66.0.0/16       # Tor exit
89.234.157.0/24    # Tor exit
104.244.72.0/22    # Tor exit
185.220.100.0/22   # Tor / hosted proxy
185.220.102.0/24   # Dark web relay
192.42.116.0/24    # Tor exit
199.249.230.0/24   # Tor exit

# 🚨 Additional Risky / C2 Networks
80.82.77.0/24      # Feodo Tracker
103.152.143.0/24   # Suspicious VPS
109.248.148.0/24   # Proxy pool
198.144.121.0/24   # Malicious
202.46.36.0/24     # Malicious

# 🤖 AI & Large Language Model Crawlers
# These are used to train AI models and can consume significant bandwidth.
8.34.208.0/20      # OpenAI
13.88.147.80/28    # Microsoft AI
20.189.173.0/24    # Microsoft AI
23.96.0.0/13       # Microsoft AI
40.74.0.0/15       # Microsoft AI
40.80.0.0/12       # Microsoft AI
40.90.128.0/17     # Microsoft AI
52.142.0.0/17      # Microsoft AI
52.148.0.0/15      # Microsoft AI
52.151.0.0/17      # Microsoft AI
52.224.0.0/11      # Microsoft AI
199.21.99.0/24     # CommonCrawl
38.108.147.0/24    # Google-Extended (Vertex AI)

# 🏢 Additional Hosting & Datacenter Providers
# Often used for hosting bots and scrapers due to low cost.
62.171.128.0/17    # Contabo
65.108.0.0/16      # Hetzner
65.21.0.0/16       # Hetzner
95.216.0.0/16      # Hetzner
149.102.128.0/17   # OVH
152.228.0.0/14     # OVH
167.114.0.0/16     # OVH

# 🛡️ Additional Security & Threat Intelligence
# IPs identified by other security vendors and researchers.
1.1.1.0/24         # APNIC Research
103.21.244.0/22    # FireHOL Level 1
103.22.200.0/22    # FireHOL Level 1
103.31.4.0/22      # FireHOL Level 1
149.28.0.0/16      # Vultr (often abused)
199.247.0.0/18     # DigitalOcean (often abused)


# 🎯 Botnet Command & Control
45.95.147.0/24     # Feodo C2
81.17.18.0/24      # TrickBot C2
185.254.122.0/24   # QakBot C2
103.248.172.42
104.131.223.*
107.170.*.*
107.178.194.*
107.178.195.*
107.20.181.*
108.162.215.*
108.162.246.*
109.186.*.*
12.148.196.*
12.148.209.*
124.66.185.*
128.242.*.*
131.212.*.*
131.253.*.*
133.11.204.*
141.101.104.*
149.20.*.*
149.20.54.*
157.54.*.*
158.108.*.*
159.203.0.156
162.158.*.*
162.158.7.*
162.158.72.*
162.158.95.*
162.243.187.126
165.227.0.128
165.227.39.194
167.24.*.*
168.188.*.*
173.194.*.*
173.239.*.*
173.239.230.97
173.239.240.147
173.244.36.*
173.245.55.*
176.195.231.*
178.43.117.*
184.173.*.*
185.2.138.*
185.229.190.140
188.165.83.*
188.244.39.*
192.115.134.*
192.118.48.*
192.232.213.*
193.220.178.*
193.253.199.*
193.47.80.*
194.153.113.*
194.52.68.*
194.72.238.*
194.90.*.*
195.128.227.*
198.25.*.*
198.41.243.*
198.54.*.*
198.60.236.*
199.30.228.*
202.108.252.*
202.160.*.*
204.14.48.*
206.207.*.*
206.253.226.*
206.28.72.*
207.126.144.*
207.46.*.*
207.68.*.*
208.65.144.*
208.91.115.*
209.191.*.*
209.73.228.*
209.85.*.*
209.85.128.*
212.143.*.*
212.150.*.*
212.235.*.*
212.29.192.*
212.29.224.*
212.50.193.*
212.8.79.*
216.239.*.*
216.239.32.*
216.252.167.*
217.132.*.*
217.74.103.*
37.140.188.*
38.100.*.*
38.105.*.*
38.144.36.*
38.74.138.*
46.101.119.24
46.101.94.163
46.116.*.*
46.244.*.*
46.4.120.*
47.30.133.89
50.7.*.*
50.97.*.*
54.176.*.*
62.116.207.*
62.141.65.*
62.90.*.*
62.99.77.*
64.106.213.*
64.124.14.*
64.18.*.*
64.233.160.*
64.233.191.*
64.27.2.*
64.37.103.*
64.4.*.*
64.62.136.*
64.62.175.*
65.52.*.*
66.102.*.*
66.135.200.*
66.150.14.*
66.196.*.*
66.205.64.*
66.207.120.*
66.221.*.*
66.228.*.*
66.249.*.*
67.15.*.*
67.195.*.*
67.209.128.*
68.142.*.*
68.65.53.71
69.164.145.*
69.61.12.*
69.65.*.*
72.14.*.*
72.14.192.*
72.30.*.*
72.52.96.*
74.125.*.*
74.6.*.*
78.148.13.*
8.12.*.*
81.161.59.*
82.102.27.75
82.166.*.*
83.31.118.*
83.31.69.*
85.250.*.*
85.64.*.*
85.9.7.*
87.106.251.*
87.113.96.90
89.138.*.*
91.103.66.*
91.231.*.*
91.231.212.*
92.103.69.*
93.172.*.*
93.54.82.*
94.26.*.*
95.108.194.*
95.85.*.*
98.136.*.*
# DigitalOcean (AS14061) — add these /16s & blocks
64.225.0.0/16
64.227.0.0/16
68.183.0.0/16
104.248.0.0/16
128.199.0.0/16
134.122.0.0/16
134.209.0.0/16
137.184.0.0/16
138.68.0.0/16
138.197.0.0/16
139.59.0.0/16
143.198.0.0/16
146.190.0.0/16
147.182.0.0/16
157.245.0.0/16
159.65.0.0/16
159.89.0.0/16
161.35.0.0/16
164.90.0.0/16
167.71.0.0/16
174.138.0.0/16
178.62.0.0/16
188.166.0.0/16
192.241.0.0/16
198.199.64.0/18
206.81.0.0/16
207.154.0.0/16
209.38.0.0/16
# (source: DigitalOcean geofeed)
# Vultr (AS20473) — common netblocks
45.32.0.0/15
66.42.0.0/16
95.179.128.0/17
104.238.128.0/17
108.61.0.0/16
207.246.64.0/18
209.250.0.0/16
216.10.240.0/20
# (source: Vultr geofeed)
# Linode / Akamai Connected Cloud (AS63949) — widely used ranges
45.79.0.0/16
50.116.0.0/16
66.175.208.0/20
69.164.0.0/16
74.207.224.0/19
96.126.96.0/19
104.200.24.0/22
104.200.28.0/22
139.162.0.0/16
172.104.0.0/15
192.155.80.0/20
198.58.96.0/19
# (source: Linode geofeed)
# Oracle Cloud Infrastructure (OCI)
129.146.0.0/15
130.61.0.0/16
132.226.0.0/16
140.238.0.0/16
141.148.0.0/16
144.24.0.0/16
152.67.0.0/16
152.70.0.0/16
158.101.0.0/16
193.122.0.0/16
# (source: Oracle public IP ranges JSON)
# Hetzner (AS24940) — big blocks often used by scrapers
49.12.0.0/16
78.46.0.0/15
88.198.0.0/16
94.130.0.0/16
138.201.0.0/16
144.76.0.0/16
148.251.0.0/16
157.90.0.0/16
159.69.0.0/16
167.235.0.0/16
176.9.0.0/16
188.40.0.0/16
195.201.0.0/16
# (source: AS24940)
# OVHcloud (AS16276) — additional high-volume ranges
51.38.0.0/16
51.68.0.0/14
51.75.0.0/16
51.77.0.0/16
51.178.0.0/16
51.195.0.0/16
54.36.0.0/14
91.121.0.0/16
137.74.0.0/16
141.95.0.0/16
145.239.0.0/16
178.32.0.0/15
192.95.0.0/18
198.27.64.0/18
# (source: AS16276)
# Scaleway / Online.net (AS12876)
51.15.0.0/16
51.159.0.0/17
62.210.0.0/16
163.172.0.0/16
212.47.224.0/19
212.83.128.0/19
# (source: AS12876)
# Cloudflare (edge egress seen at origin — if you want to block proxied traffic)
173.245.48.0/20
141.101.64.0/18
108.162.192.0/18
190.93.240.0/20
188.114.96.0/20
197.234.240.0/22
104.16.0.0/13
104.24.0.0/14
162.158.0.0/15
# (source: Cloudflare IPs)
149.154.161.233