/
← Voltar ao feed
low

GreyNoise: 11 major IP blocklists covered only ~2% of 119,842 malicious edge-scanning IPs seen on 14 May 2026

1 fonte(s) · 1 atualização(ões) · publicado 21/05/2026 21:00 · coletado há 1 dia

GreyNoise reports that on 14 May 2026 its Global Observation Grid recorded 119,842 malicious, non-spoofable IPs targeting edge infrastructure. Compared against eleven widely used OSINT and commercial feeds, average coverage was 2.0%, and no single feed exceeded 5%. Even the largest list (Avastel, about 500,000 IPs) caught under 2%, and vendor-curated firewall EDLs (e.g. Palo Alto Networks) covered under 0.5%. GreyNoise attributes the gap to the slow, manual curation of static lists against fast-churning attacker infrastructure. The article is also a promotion of GreyNoise's own Platform query-based blocklists and the GreyNoise Block product, so the figures are vendor-reported and not independently verified.

Technical Details

  • Drivers of the gap cited by GreyNoise: automated reconnaissance at scale with rapid source rotation; residential proxy botnets built from compromised consumer devices and rented residential IP pools; and ephemeral cloud/VPS infrastructure torn down before curated lists refresh.
  • Curated feed turnover is described as dozens of IPs per day, versus tens of thousands of IPs churning in actual threat infrastructure.
  • Dataset: GreyNoise 1D / Malicious / Non-Spoofable feed. Sensors are said to exclude spoofed sources from reflection/amplification attacks.
  • Feeds compared: FireHol Levels 1-4, Blocklist.de, CINS Army List, Palo Alto Known Malicious EDL, Palo Alto High Risk EDL, ShadowWhisperer Malware/Hackers, Binary Defense Ban List, Avastel 1-Day Proxy/Bot IPs.
  • Example GNQL query: last_seen_malicious:1d AND spoofable:false AND tags:*Cisco*. Blocklists are delivered as URL-based dynamic lists refreshed hourly.

Remediation

  • Do not rely solely on static, manually curated IP blocklists; supplement them with continuously updated, primary-source observation data.
  • Use short-lived, query-scoped dynamic blocklists (for example by vendor tag or CVE) ingested into firewall external dynamic lists with hourly refresh.
  • Avoid blanket-blocking residential ISP ranges; prefer targeted, time-bound blocking.

Linha do tempo

  1. greynoise.io ↗ · pub. 21/05/2026 21:00 · coletado 19/10 18:37 primeiro registro

    GreyNoise: 11 major IP blocklists covered only ~2% of 119,842 malicious edge-scanning IPs seen on 14 May 2026

    ler a análise desta fonte

    GreyNoise reports that on 14 May 2026 its Global Observation Grid recorded 119,842 malicious, non-spoofable IPs targeting edge infrastructure. Compared against eleven widely used OSINT and commercial feeds, average coverage was 2.0%, and no single feed exceeded 5%. Even the largest list (Avastel, about 500,000 IPs) caught under 2%, and vendor-curated firewall EDLs (e.g. Palo Alto Networks) covered under 0.5%. GreyNoise attributes the gap to the slow, manual curation of static lists against fast-churning attacker infrastructure. The article is also a promotion of GreyNoise's own Platform query-based blocklists and the GreyNoise Block product, so the figures are vendor-reported and not independently verified.

    Technical Details

    • Drivers of the gap cited by GreyNoise: automated reconnaissance at scale with rapid source rotation; residential proxy botnets built from compromised consumer devices and rented residential IP pools; and ephemeral cloud/VPS infrastructure torn down before curated lists refresh.
    • Curated feed turnover is described as dozens of IPs per day, versus tens of thousands of IPs churning in actual threat infrastructure.
    • Dataset: GreyNoise 1D / Malicious / Non-Spoofable feed. Sensors are said to exclude spoofed sources from reflection/amplification attacks.
    • Feeds compared: FireHol Levels 1-4, Blocklist.de, CINS Army List, Palo Alto Known Malicious EDL, Palo Alto High Risk EDL, ShadowWhisperer Malware/Hackers, Binary Defense Ban List, Avastel 1-Day Proxy/Bot IPs.
    • Example GNQL query: last_seen_malicious:1d AND spoofable:false AND tags:*Cisco*. Blocklists are delivered as URL-based dynamic lists refreshed hourly.

    Remediation

    • Do not rely solely on static, manually curated IP blocklists; supplement them with continuously updated, primary-source observation data.
    • Use short-lived, query-scoped dynamic blocklists (for example by vendor tag or CVE) ingested into firewall external dynamic lists with hourly refresh.
    • Avoid blanket-blocking residential ISP ranges; prefer targeted, time-bound blocking.