Malicious IP Address Feed
Newly reported malicious IP addresses; 89,329 tracked.
32 indicators match · newest first · updated 2026-10-12 10:35 UTC
| First seen | Indicator | Category | Family | Reported by | Where | Network | Copy |
|---|---|---|---|---|---|---|---|
| 10-12 10:10 | 48.193.42[.]209 | Attacker | — | 1 feed | |||
| 10-12 10:10 | 134.138.132[.]1 | Attacker | — | 1 feed | |||
| 10-12 10:08 | 20.99.132[.]105 | Malware | 1 feed 16k sandbox samples | ||||
| 10-12 10:08 | 51.145.123[.]29 | Malware | 1 feed 9,870 sandbox samples | ||||
| 10-12 10:08 | 52.123.128[.]14 | Malware | 1 feed 3,777 sandbox samples | ||||
| 10-12 10:08 | 52.111.236[.]23 | Malware | 1 feed 343 sandbox samples | ||||
| 10-12 09:53 | 52.142.223[.]178 | Malware | 1 feed 634 sandbox samples | ||||
| 10-12 09:53 | 20.54.36[.]229 | Malware | 1 feed 47 sandbox samples | ||||
| 10-12 09:36 | 138.91.171[.]81 | Malware | 1 feed 630 sandbox samples | ||||
| 10-12 09:30 | 20.24.84[.]218 | Attacker | — | 1 feed | |||
| 10-12 09:10 | 20.22.226[.]84 | Attacker | — | 1 feed | |||
| 10-12 09:04 | 52.140.118[.]28 | Malware | 1 feed 244 sandbox samples | ||||
| 10-12 08:55 | 40.83.91[.]59 | Attacker | — | 1 feed | |||
| 10-12 08:46 | 20.42.65[.]92 | Malware | 1 feed 1,616 sandbox samples | ||||
| 10-12 08:46 | 20.190.151[.]8 | Malware | 1 feed 125 sandbox samples | ||||
| 10-12 08:20 | 52.248.42[.]71 | Attacker | — | 1 feed | |||
| 10-12 07:50 | 40.77.167[.]25 | Attacker | — | 1 feed | |||
| 10-12 06:58 | 52.182.143[.]212 | Malware | 1 feed 1,405 sandbox samples | ||||
| 10-12 06:41 | 20.171.192[.]137 | Attacker | — | 2 feeds | |||
| 10-12 06:41 | 40.124.123[.]33 | Attacker | — | 2 feeds | |||
| 10-12 06:41 | 40.124.168[.]247 | Attacker | — | 2 feeds | |||
| 10-12 06:32 | 52.191.219[.]104 | Malware | 1 feed 301 sandbox samples | ||||
| 10-12 06:32 | 52.137.106[.]217 | Malware | 1 feed 288 sandbox samples | ||||
| 10-12 06:10 | 20.106.34[.]57 | Attacker | — | 1 feed | |||
| 10-12 06:10 | 20.29.54[.]34 | Attacker | — | 2 feeds | |||
| 10-12 06:10 | 40.124.186[.]190 | Attacker | — | 2 feeds | |||
| 10-12 06:08 | 13.89.179[.]12 | Malware | 1 feed 1,490 sandbox samples | ||||
| 10-12 06:08 | 40.127.240[.]158 | Malware | 1 feed 143 sandbox samples | ||||
| 10-12 05:31 | 20.42.73[.]31 | Malware | 1 feed 27 sandbox samples | ||||
| 10-12 05:00 | 20.73.194[.]208 | Malware | 1 feed 193 sandbox samples | ||||
| 10-12 05:00 | 150.171.109[.]74 | Malware | 1 feed 67 sandbox samples | ||||
| 10-12 05:00 | 207.46.13[.]102 | Attacker | — | 1 feed |
Values are defanged (hxxp, [.]) so nothing here is a live link to malicious infrastructure. URL query strings are removed to protect victims. Copy copies the defanged form.