AIP

Stratosphere Laboratory · Czech Technical University in Prague

Attacker IP
Prioritization

AIP generates compact, resource-friendly IP blocklists from attacks observed by honeypot networks. It helps defenders focus on the attackers that matter most.

Get the blocklists View the source

What it does

Useful threat intelligence without an oversized list.

Every day, AIP processes network traffic collected by our honeypots. Its models identify recent, persistent, and emerging attackers and publish the results as ready-to-use IPv4 blocklists.

AIP is free software developed by the Stratosphere Laboratory at the Czech Technical University in Prague.

Updated daily

Choose a blocklist.

Prioritize Consistent

Ranks persistent IPs that repeatedly attack our sensors.

Download CSV

Prioritize New

Ranks new and emerging attackers ahead of familiar ones.

Download CSV

Looking for documentation or historical data? Browse the complete dataset.

Run it yourself

Open source and ready for your honeypot data.

The AIP tool can generate the same models from your own Zeek network-flow data. The recommended installation uses Docker.

Read the usage guide