Malicious IP Address Feed

Newly reported malicious IP addresses; 89,329 tracked.

55 indicators match · newest first · updated 2026-10-12 10:40 UTC

First seenIndicatorCategoryFamilyReported byWhereNetworkCopy
10-12 10:302405[:]201[:]6015[:]d1ad[:]e9ea[:]1012[:]116a[:]db0cAttacker—1 feed
10-12 10:0049.37.10[.]119Attacker—1 feed
10-12 09:302409[:]40d2[:]6b[:]a741[:]807f[:]2a83[:]cba2[:]4850Attacker—1 feed
10-12 09:3047.30.54[.]145Attacker—1 feed
10-12 09:3049.36.138[.]240Attacker—1 feed
10-12 09:10137.97.80[.]58Attacker—2 feeds
10-12 08:55152.58.37[.]115Attacker—1 feed
10-12 08:552409[:]4090[:]808f[:]9403[:]8121[:]a100[:]4c9[:]5170Attacker—1 feed
10-12 08:552409[:]4090[:]808f[:]9403[:]ec23[:]fab5[:]b9e9[:]b553Attacker—1 feed
10-12 08:5549.47.133[.]139Attacker—1 feed
10-12 08:20152.59.146[.]217Attacker—1 feed
10-12 08:202409[:]40d0[:]1398[:]a19e[:]b4c1[:]95c2[:]6e58[:]9551Attacker—1 feed
10-12 08:2049.37.73[.]167Attacker—1 feed
10-12 07:502405[:]201[:]901b[:]6050[:]20c3[:]388c[:]73cd[:]d99aAttacker—1 feed
10-12 07:502409[:]40d2[:]10d9[:]ca91[:]b916[:]16a8[:]6304[:]e601Attacker—1 feed
10-12 07:152409[:]40d2[:]12ac[:]b76f[:]548a[:]7d80[:]f8e5[:]8ffaAttacker—1 feed
10-12 07:152409[:]40f4[:]1116[:]d2da[:]c940[:]52c3[:]e904[:]4176Attacker—1 feed
10-12 07:1547.15.216[.]149Attacker—1 feed
10-12 06:102409[:]4090[:]b066[:]b014[:]849a[:]a89c[:]43dd[:]c13dAttacker—1 feed
10-12 05:35157.49.70[.]35Attacker—1 feed
10-12 05:35157.49.80[.]108Attacker—1 feed
10-12 05:3549.47.133[.]194Attacker—1 feed
10-12 05:00115.245.111[.]246Attacker—2 feeds
10-12 05:002405[:]201[:]a431[:]885b[:]c0af[:]fcf6[:]6d9e[:]6672Attacker—1 feed
10-12 04:35152.56.14[.]155Attacker—2 feeds
10-12 04:35152.59.182[.]28Attacker—2 feeds
10-12 04:352405[:]201[:]6836[:]a020[:]a9ea[:]1a1[:]3766[:]411eAttacker—2 feeds
10-12 04:35152.59.183[.]101Attacker—2 feeds
10-12 04:3547.15.114[.]148Attacker—2 feeds
10-12 04:3549.43.227[.]169Attacker—2 feeds
10-12 04:352409[:]40d2[:]2145[:]1dc8[:]9dd[:]dfe7[:]c929[:]3346Attacker—2 feeds
10-12 04:352409[:]40e3[:]1e1[:]5eb3[:]456a[:]930f[:]cbff[:]da54Attacker—2 feeds
10-12 04:352405[:]201[:]4014[:]b05e[:]4d83[:]8c9f[:]d45[:]38deAttacker—2 feeds
10-12 04:352409[:]40c2[:]8001[:]c659[:]7182[:]3d4e[:]3e5[:]bd3eAttacker—2 feeds
10-12 04:35152.59.8[.]254Attacker—2 feeds
10-12 04:352409[:]40e4[:]6e[:]fc8e[:]3d0e[:]db5e[:]1fbd[:]3936Attacker—2 feeds
10-12 04:3549.36.177[.]217Attacker—2 feeds
10-12 04:352405[:]201[:]6022[:]30aa[:]7458[:]dec9[:]14fc[:]f588Attacker—2 feeds
10-12 04:3549.36.223[.]112Attacker—2 feeds
10-12 04:3549.36.71[.]150Attacker—3 feeds
10-12 04:3549.37.102[.]151Attacker—2 feeds
10-12 04:352405[:]201[:]6815[:]609c[:]29fe[:]cfcb[:]283[:]f98fAttacker—2 feeds
10-12 04:3549.47.130[.]227Attacker—2 feeds
10-12 04:352409[:]4091[:]2062[:]8603[:]d0e[:]4e40[:]92bb[:]1b93Attacker—2 feeds
10-12 04:35152.56.14[.]227Attacker—2 feeds
10-12 04:35157.49.80[.]7Attacker—2 feeds
10-12 04:35139.167.225[.]126Attacker—3 feeds
10-12 04:3549.37.194[.]101Attacker—2 feeds
10-12 04:3549.43.196[.]179Attacker—2 feeds
10-12 04:352405[:]201[:]a431[:]885b[:]116a[:]ca16[:]96b3[:]6600Attacker—2 feeds
10-12 04:35157.49.3[.]71Attacker—2 feeds
10-12 04:35115.240.169[.]234Attacker—3 feeds
10-12 04:35157.48.79[.]206Attacker—2 feeds
10-12 04:352409[:]40e1[:]302d[:]ca00[:]3dbd[:]aadd[:]34fa[:]db16Attacker—2 feeds
10-12 04:352405[:]201[:]c041[:]e941[:]d58f[:]cf69[:]409f[:]70ccAttacker—2 feeds

Values are defanged (hxxp, [.]) so nothing here is a live link to malicious infrastructure. URL query strings are removed to protect victims. Copy copies the defanged form.