Malicious IP Address Feed
Newly reported malicious IP addresses; 89,329 tracked.
35 indicators match · newest first · updated 2026-10-12 10:40 UTC
| First seen | Indicator | Category | Family | Reported by | Where | Network | Copy |
|---|---|---|---|---|---|---|---|
| 10-12 10:30 | 167.99.209[.]139 | Attacker | — | 1 feed | |||
| 10-12 10:15 | 142.93.134[.]19 | Attacker | — | 1 feed | |||
| 10-12 10:15 | 142.93.235[.]143 | Attacker | — | 1 feed | |||
| 10-12 10:15 | 146.190.21[.]254 | Attacker | — | 1 feed | |||
| 10-12 10:15 | 165.22.193[.]86 | Attacker | — | 1 feed | |||
| 10-12 09:04 | 167.99.35[.]88 | Malware | 1 feed 266 sandbox samples | ||||
| 10-12 08:10 | 104.248.192[.]7 | Attacker | — | 1 feed | |||
| 10-12 08:10 | 152.42.138[.]189 | Attacker | — | 1 feed | |||
| 10-12 08:10 | 157.245.73[.]143 | Attacker | — | 1 feed | |||
| 10-12 08:10 | 161.35.94[.]154 | Attacker | — | 1 feed | |||
| 10-12 08:10 | 164.92.219[.]13 | Attacker | — | 1 feed | |||
| 10-12 08:10 | 174.138.3[.]141 | Attacker | — | 1 feed | |||
| 10-12 08:10 | 178.128.255[.]217 | Attacker | — | 1 feed | |||
| 10-12 07:15 | 159.65.197[.]5 | Attacker | — | 1 feed | |||
| 10-12 07:04 | 188.166.12[.]8:443 | C2 | 1 feed | ||||
| 10-12 07:04 | 64.227.72[.]68:443 | C2 | 1 feed | ||||
| 10-12 06:10 | 64.227.65[.]24 | Attacker | — | 1 feed | |||
| 10-12 06:10 | 68.183.14[.]68 | Attacker | — | 1 feed | |||
| 10-12 06:10 | 104.248.199[.]239 | Attacker | — | 1 feed | |||
| 10-12 06:10 | 104.248.93[.]115 | Attacker | — | 1 feed | |||
| 10-12 06:10 | 134.209.95[.]137 | Attacker | — | 1 feed | |||
| 10-12 06:10 | 142.93.129[.]217 | Attacker | — | 1 feed | |||
| 10-12 06:10 | 146.190.22[.]46 | Attacker | — | 1 feed | |||
| 10-12 06:10 | 159.223.208[.]99 | Attacker | — | 1 feed | |||
| 10-12 06:10 | 164.92.159[.]92 | Attacker | — | 1 feed | |||
| 10-12 06:10 | 167.172.40[.]251 | Attacker | — | 1 feed | |||
| 10-12 06:10 | 167.172.40[.]29 | Attacker | — | 1 feed | |||
| 10-12 06:10 | 167.172.43[.]72 | Attacker | — | 1 feed | |||
| 10-12 06:10 | 167.99.221[.]87 | Attacker | — | 1 feed | |||
| 10-12 06:10 | 178.128.252[.]170 | Attacker | — | 1 feed | |||
| 10-12 06:10 | 178.128.253[.]153 | Attacker | — | 1 feed | |||
| 10-12 06:10 | 206.189.111[.]55 | Attacker | — | 1 feed | |||
| 10-12 06:10 | 206.189.15[.]147 | Attacker | — | 1 feed | |||
| 10-12 06:10 | 209.38.108[.]205 | Attacker | — | 1 feed | |||
| 10-12 05:35 | 104.248.193[.]172 | Attacker | — | 1 feed |
Values are defanged (hxxp, [.]) so nothing here is a live link to malicious infrastructure. URL query strings are removed to protect victims. Copy copies the defanged form.