Jose’s list of 2009 malicious links is a fun read. Here are the IPs:

8.12.206.126
60.173.8.0/21
64.34.228.126
66.220.17.154
67.29.139.153
68.169.70.134
78.108.0.0/14
94.75.207.219
121.11.0.0/16
195.2.253.240/30
209.84.29.126
209.205.196.16
216.240.157.91
218.149.84.0/25

One of the comments is a complaint — Jose did not put his list in htaccess format.

I find this comment quite odd.

I suppose some people think this should be setup for automation, but Jose’s blog is more about threat analysis and thinking than silent automation.

Moreover, it’s only 14 IPs and easy to convert. If you add “deny from” in front of the IPs, it’s the format for htaccess. Add the line, for example, “deny from 64.34.228.126″…

Examples of lists without any analysis can be found on many sites such as Country IP Blocks already formatted for quick inclusion. What they lack versus Jose’s list should be obvious. Ukraine (ua) has one of the largest blocks of bad agents of any country, with little or no explanation why.