Malicious IP Address Feed

Newly reported malicious IP addresses; 90,755 tracked.

59 indicators match · newest first · updated 2026-10-12 09:36 UTC

First seen	Indicator	Category	Family	Reported by
10-12 09:30	103.67.163[.]25	Attacker	—	1 feed
10-12 09:30	36.50.55[.]224	Attacker	—	1 feed
10-12 08:55	2001[:]ee0[:]53f7[:]cd60[:]ca40[:]915[:]e372[:]ea62	Attacker	—	1 feed
10-12 08:20	116.97.109[.]120	Attacker	—	1 feed
10-12 07:50	1.53.53[.]163	Attacker	—	1 feed
10-12 07:15	103.171.92[.]209	Attacker	—	1 feed
10-12 07:15	42.1.120[.]158	Attacker	—	1 feed
10-12 06:41	115.79.24[.]90	Attacker	—	1 feed
10-12 06:10	117.6.63[.]135	Attacker	—	1 feed
10-12 05:35	14.230.144[.]255	Attacker	—	1 feed
10-12 05:00	113.161.56[.]97	Attacker	—	1 feed
10-12 05:00	123.28.133[.]206	Attacker	—	1 feed
10-12 05:00	14.177.134[.]155	Attacker	—	1 feed
10-12 05:00	14.224.216[.]251	Attacker	—	1 feed
10-12 05:00	210.245.35[.]207	Attacker	—	1 feed
10-12 04:35	160.191.89[.]223	Attacker	—	2 feeds
10-12 04:35	171.238.24[.]170	Attacker	—	2 feeds
10-12 04:35	180.93.1[.]64	Attacker	—	2 feeds
10-12 04:35	160.30.137[.]77	Attacker	—	2 feeds
10-12 04:35	115.77.57[.]26	Attacker	—	2 feeds
10-12 04:35	42.115.214[.]236	Attacker	—	2 feeds
10-12 04:35	116.98.218[.]147	Attacker	—	2 feeds
10-12 04:35	171.244.8[.]227	Attacker	—	2 feeds
10-12 04:35	171.250.215[.]103	Attacker	—	3 feeds
10-12 04:35	171.225.139[.]147	Attacker	—	2 feeds
10-12 04:35	14.169.67[.]237	Attacker	—	2 feeds
10-12 04:35	171.243.148[.]90	Attacker	—	2 feeds
10-12 04:35	171.231.176[.]253	Attacker	—	2 feeds
10-12 04:35	116.101.14[.]169	Attacker	—	2 feeds
10-12 04:35	14.164.48[.]5	Attacker	—	2 feeds
10-12 04:35	183.80.249[.]235	Attacker	—	2 feeds
10-12 04:35	27.74.71[.]111	Attacker	—	2 feeds
10-12 04:35	42.114.69[.]155	Attacker	—	2 feeds
10-12 04:35	103.72.57[.]221	Attacker	—	2 feeds
10-12 04:35	2402[:]800[:]6139[:]35d4[:]9905[:]366e[:]298e[:]47a2	Attacker	—	2 feeds
10-12 04:35	14.235.121[.]91	Attacker	—	2 feeds
10-12 04:35	42.114.56[.]20	Attacker	—	2 feeds
10-12 04:35	171.252.189[.]37	Attacker	—	2 feeds
10-12 04:35	2403[:]6a40[:]0[:]84[:]ca1f[:]66ff[:]feee[:]4721	Attacker	—	2 feeds
10-12 04:35	116.104.87[.]58	Attacker	—	3 feeds
10-12 04:35	14.190.48[.]177	Attacker	—	2 feeds
10-12 04:35	27.79.41[.]27	Attacker	—	2 feeds
10-12 04:35	160.250.186[.]241	Attacker	—	2 feeds
10-12 04:35	103.216.119[.]20	Attacker	—	3 feeds
10-12 04:35	103.78.1[.]160	Attacker	—	3 feeds
10-12 04:35	103.82.38[.]188	Attacker	—	2 feeds
10-12 04:35	116.99.168[.]110	Attacker	—	2 feeds
10-12 04:35	123.22.212[.]68	Attacker	—	2 feeds
10-12 04:35	45.118.138[.]136	Attacker	—	2 feeds
10-12 04:35	103.74.122[.]88	Attacker	—	3 feeds
10-12 04:35	171.244.38[.]3	Attacker	—	2 feeds
10-12 04:35	180.93.115[.]138	Attacker	—	2 feeds
10-12 04:35	222.253.48[.]203	Attacker	—	2 feeds
10-12 04:35	42.115.242[.]192	Attacker	—	2 feeds
10-12 04:35	116.110.159[.]55	Attacker	—	2 feeds
10-12 04:35	125.234.213[.]17	Attacker	—	2 feeds
10-12 04:35	113.160.225[.]252	Attacker	—	2 feeds
10-12 04:35	210.211.127[.]114	Attacker	—	2 feeds
10-12 04:35	119.17.222[.]93	Attacker	—	1 feed

Values are defanged (hxxp, [.]) so nothing here is a live link to malicious infrastructure. URL query strings are removed to protect victims. Copy copies the defanged form.

Security check