diff --git a/respodns/ips.py b/respodns/ips.py
index 60ddaf1..d6c78a7 100644
--- a/respodns/ips.py
+++ b/respodns/ips.py
@@ -11,6 +11,7 @@ china = {
     "58.222.226.146",
     "112.67.171.231",
     "114.254.201.131",
+    "180.76.76.76",
     "180.163.223.236",
     # "202.57.32.49",  # not china but seems to be poisoned
     # "204.13.152.3",  # likewise
@@ -26,25 +27,45 @@ china = {
 # known IPs (not servers) that are used to deny access to websites:
 blocks = {
     "1.2.3.4",          # timeout
+    "3.215.231.251",
     "5.129.186.222",
+    "27.54.116.70",
     "31.204.161.41",
     "34.218.72.125",
     "36.86.63.185",
     "49.128.177.13",
     "52.15.96.207",
+    "52.25.92.0",
+    "54.65.172.3",
     "54.242.237.204",
     "62.77.154.37",
     "62.85.160.222",
     "62.113.48.25",
+    "64.13.192.76",
     "64.13.232.149",
+    "75.2.78.201",
     "85.214.151.164",
     "91.195.127.75",
     "93.158.134.250",
+    "94.140.14.33",
     "95.77.94.80",
+    "99.83.232.37",
+    "101.255.0.226",
+    "101.255.1.226",
+    "103.10.121.34",
+    "103.87.69.47",
+    "103.144.182.26",
+    "103.144.182.27",
+    "104.16.252.55",
+    "104.244.43.104",
+    "104.244.43.228",
     "114.6.128.8",
     "118.97.116.27",
+    "119.235.28.59",
     "119.235.29.59",
+    "124.40.255.100",
     "124.40.255.99",
+    "125.26.170.3",
     "146.112.61.104",
     "146.112.61.105",
     "146.112.61.106",
@@ -55,6 +76,11 @@ blocks = {
     "146.112.61.111",
     "146.112.61.112",
     "146.112.61.113",
+    "149.28.172.145",
+    "157.240.3.50",
+    "157.240.17.14",
+    "157.240.21.9",
+    "162.241.226.169",
     "163.28.10.160",
     "165.21.74.4",
     "175.139.142.25",
@@ -73,9 +99,13 @@ blocks = {
     "195.186.208.169",
     "195.208.152.206",
     "195.234.22.137",
+    "199.59.150.11",
     "202.40.187.91",
+    "202.51.96.6",
+    "202.152.0.14",
     "202.162.209.133",
     "202.165.36.253",
+    "202.165.36.42",
     "202.169.44.80",
     "203.119.13.75",
     "203.119.13.76",
@@ -98,6 +128,29 @@ blocks = {
     "154.72.193.28",
     "198.105.244.23",
     "198.105.254.23",
+
+    # TODO: timeouts, rejections:
+#   "58.217.249.141",
+#   "62.2.16.116",
+#   "62.33.207.196",
+#   "62.33.207.197",
+#   "67.228.235.91",
+#   "67.228.235.93",
+#   "89.23.201.131",
+#   "93.46.8.89",
+#   "119.235.28.59",
+#   "192.121.44.204",
+#   "199.16.158.190",
+#   "211.233.91.10",
+
+    # this showed up for the sinkhole. it's an error page, but is it wrong?
+#   "159.100.251.128",
+
+    # this might be a sinkhole as well? gives 404 for non-sinkhole domains.
+#   "212.179.240.96",
+
+    # timeout for the sinkhole... not a good sign.
+#   "116.31.102.47",
 }
 
 block_checks = [