Blacklists of Known (Suspected) Malicious URLs, Domain Names, and IP Addresses

In an attempt to consolidate pointers to blacklists of malicious/suspected URLs, domains, and IPs, I thought of sharing this list I compiled. The lists vary in data format, freshness, usage restrictions, and collection methodology. I personally use such lists as starters for collecting potentially malicious targets on the Web. So, before using these lists for serious experiments, it is obviously important to independently verify whether they are really linked to and in deed initiate some malicious activity. One method is to use a honeyclient such as HoneyC or Capture-HPC.  

I hope to update this list every month as new blacklists may be born, some blacklists may perish, some may become too old to be useful, or some turn to commercial. 

Useful Blacklists:

• PhishTank Phishing Blacklist
• Malware Blacklist of URLs and IPs
• Malware Domain List
• Malicious Hosts List
• Malicious Code and Domain Blacklist
• Malware Domain and Spyware List
• Malware and Phishing sites
• SpyEye Binary URLs
• ZeuS Binary URLs
• Spywared Malicious Domains
• Trend Micro Top 10 Vulnerabilities
• VX Vault Malware Blacklist
• Malekal Malware Blacklist
• BadMalweb Malicious URLs
• IBlock List
• Project Honeypot Malicious IPs
• Chinese and Korean IP Blocks
• ZeuS IP Block List
• No Think Malware Archive, Network Activity and Honeypot Statistics
• Spam Domain Blacklist
• Wikimedia Spam Blacklist
• Most Aggressively Spreading Malware Binaries
• ATLAS from Arbor Networks
• CLEAN-MX Realtime Database
• CYMRU Bogon List
• Shadow Server IP and URLs

Note: This list is by no means exhaustive.