Malicious IP Address Feed

Newly reported malicious IP addresses; 90,460 tracked.

37 indicators match · newest first · updated 2026-10-12 11:51 UTC

First seen	Indicator	Category	Family	Reported by
10-12 09:30	89.46.223[.]59	Attacker	—	1 feed
10-12 08:55	2a01[:]4020[:]2[:]b[:]101[:][:]11	Attacker	—	1 feed
10-12 08:55	2a01[:]4020[:]2[:]b[:]101[:][:]248	Attacker	—	1 feed
10-12 08:55	2a01[:]4020[:]2[:]b[:]101[:][:]2bb	Attacker	—	1 feed
10-12 08:55	2a01[:]4020[:]2[:]b[:]101[:][:]633	Attacker	—	1 feed
10-12 08:20	2a01[:]4020[:]2[:]b[:]102[:][:]242	Attacker	—	1 feed
10-12 08:20	2a01[:]4020[:]2[:]b[:]102[:][:]479	Attacker	—	1 feed
10-12 08:20	2a01[:]4020[:]2[:]b[:]102[:][:]687	Attacker	—	1 feed
10-12 08:20	2a01[:]4020[:]2[:]b[:]102[:][:]79a	Attacker	—	1 feed
10-12 04:35	2a01[:]4020[:]2[:]b[:]101[:][:]255	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]148	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]196	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]19d	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]1c5	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]1fc	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]234	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]2c9	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]2ec	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]32f	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]33a	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]357	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]3d5	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]3e8	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]3f5	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]42d	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]541	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]5f9	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]65e	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]70c	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]71c	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]761	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]102[:][:]c5	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]101[:][:]cd	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]103[:][:]220	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]103[:][:]293	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]103[:][:]29a	Attacker	—	2 feeds
10-12 04:35	2a01[:]4020[:]2[:]b[:]103[:][:]41d	Attacker	—	2 feeds

Values are defanged (hxxp, [.]) so nothing here is a live link to malicious infrastructure. URL query strings are removed to protect victims. Copy copies the defanged form.

Security check