Malicious IP Address Feed
Newly reported malicious IP addresses; 90,741 tracked.
32 indicators match · newest first · updated 2026-10-12 12:35 UTC
| First seen | Indicator | Category | Family | Reported by | Where | Network | Copy |
|---|---|---|---|---|---|---|---|
| 10-12 12:20 | 96.126.117[.]80 | Attacker | — | 1 feed | |||
| 10-12 12:20 | 176.58.103[.]233 | Attacker | — | 1 feed | |||
| 10-12 12:15 | 97.107.131[.]250 | Attacker | — | 1 feed | |||
| 10-12 12:15 | 104.237.150[.]235 | Attacker | — | 1 feed | |||
| 10-12 11:15 | 172.233.111[.]227 | Attacker | — | 1 feed | |||
| 10-12 11:05 | 172.236.130[.]202 | Attacker | — | 1 feed | |||
| 10-12 11:05 | 2600[:]3c15[:][:]2000[:]edff[:]fe05[:]754 | Attacker | — | 1 feed | |||
| 10-12 11:04 | 198.58.118[.]167 | Malware | 1 feed 787 sandbox samples | ||||
| 10-12 11:04 | 45.56.79[.]23 | Malware | 1 feed 864 sandbox samples | ||||
| 10-12 11:04 | 96.126.123[.]244 | Malware | 1 feed 521 sandbox samples | ||||
| 10-12 11:04 | 173.255.194[.]134 | Malware | 1 feed 917 sandbox samples | ||||
| 10-12 11:04 | 45.33.23[.]183 | Malware | 1 feed 664 sandbox samples | ||||
| 10-12 11:04 | 45.33.30[.]197 | Malware | 1 feed 616 sandbox samples | ||||
| 10-12 11:04 | 72.14.185[.]43 | Malware | 1 feed 541 sandbox samples | ||||
| 10-12 11:04 | 45.33.2[.]79 | Malware | 1 feed 679 sandbox samples | ||||
| 10-12 11:04 | 72.14.178[.]174 | Malware | 1 feed 560 sandbox samples | ||||
| 10-12 11:04 | 45.79.19[.]196 | Malware | 1 feed 601 sandbox samples | ||||
| 10-12 10:10 | 172.105.58[.]98 | Attacker | — | 1 feed | |||
| 10-12 10:10 | 23.239.13[.]74 | Attacker | — | 1 feed | |||
| 10-12 09:10 | 139.162.176[.]75 | Attacker | — | 1 feed | |||
| 10-12 09:04 | 172.105.27[.]61 | Malware | 1 feed 75 sandbox samples | ||||
| 10-12 08:10 | 139.162.187[.]74 | Attacker | — | no longer listed | |||
| 10-12 07:55 | 172.234.230[.]37 | Attacker | — | 1 feed | |||
| 10-12 07:26 | 172.105.115[.]71 | Malware | 1 feed 93 sandbox samples | ||||
| 10-12 06:55 | 172.235.168[.]96 | Attacker | — | 1 feed | |||
| 10-12 06:55 | 172.104.10[.]247 | Attacker | — | 1 feed | |||
| 10-12 06:10 | 172.105.12[.]250 | Attacker | — | 1 feed | |||
| 10-12 05:55 | 172.236.250[.]48 | Attacker | — | 1 feed | |||
| 10-12 05:55 | 172.236.31[.]90 | Attacker | — | 1 feed | |||
| 10-12 05:35 | 45.79.152[.]14 | Attacker | — | 2 feeds | |||
| 10-12 05:00 | 172.236.228[.]208 | Attacker | — | 1 feed | |||
| 10-12 04:35 | 2600[:]3c17[:][:]2000[:]ebff[:]fe66[:]fca9 | Attacker | — | 2 feeds |
Values are defanged (hxxp, [.]) so nothing here is a live link to malicious infrastructure. URL query strings are removed to protect victims. Copy copies the defanged form.