Malicious IP Address Feed

Newly reported malicious IP addresses; 89,329 tracked.

154 indicators match · newest first · updated 2026-10-12 10:35 UTC

First seen	Indicator	Category	Family	Reported by	Network
10-12 10:30	91.194.91[.]202	Attacker	—	3 feeds 5 sandbox samples
10-12 10:30	195.96.139[.]12	Attacker	—	1 feed
10-12 10:30	195.96.139[.]23	Attacker	—	1 feed
10-12 10:30	51.195.244[.]223	Attacker	—	1 feed
10-12 10:30	84.247.41[.]230	Attacker	—	1 feed
10-12 10:30	87.236.176[.]22	Attacker	—	1 feed
10-12 10:15	104.248.169[.]7	Attacker	—	1 feed
10-12 10:15	157.245.34[.]217	Attacker	—	1 feed
10-12 10:15	206.189.116[.]1	Attacker	—	2 feeds
10-12 10:08	51.145.123[.]29	Malware		1 feed 9,870 sandbox samples
10-12 10:08	145.239.202[.]9	Malware		1 feed 32 sandbox samples
10-12 10:00	159.65.91[.]223	Attacker	—	1 feed
10-12 10:00	51.77.107[.]231	Attacker	—	1 feed
10-12 09:53	149.154.167[.]99	Malware		1 feed 5,471 sandbox samples
10-12 09:44	194.31.197[.]68:25200	C2		1 feed
10-12 09:44	194.31.197[.]146:25211	C2		1 feed
10-12 09:44	194.31.197[.]63:25201	C2		1 feed
10-12 09:44	194.31.197[.]64:25201	C2		1 feed
10-12 09:44	194.31.197[.]67:25200	C2		1 feed
10-12 09:43	157.173.119[.]22:4443	C2		1 feed
10-12 09:43	154.82.149[.]37:25201	C2		1 feed	—
10-12 09:30	195.96.139[.]145	Attacker	—	1 feed
10-12 09:10	135.136.20[.]8	Attacker	—	1 feed
10-12 09:10	135.136.20[.]28	Attacker	—	1 feed
10-12 09:10	135.136.20[.]25	Attacker	—	1 feed
10-12 09:10	135.136.20[.]3	Attacker	—	1 feed
10-12 09:10	135.136.20[.]26	Attacker	—	1 feed
10-12 09:10	135.136.20[.]30	Attacker	—	1 feed
10-12 09:10	135.136.20[.]12	Attacker	—	1 feed
10-12 08:55	198.244.242[.]7	Attacker	—	1 feed
10-12 08:55	54.38.147[.]83	Attacker	—	1 feed
10-12 08:21	45.141.233[.]6	Malware		1 feed 52 sandbox samples
10-12 08:21	89.185.84[.]2	Malware		1 feed 9 sandbox samples
10-12 08:21	62.204.41[.]144	Malware		1 feed 49 sandbox samples
10-12 08:20	185.108.132[.]216	Attacker	—	1 feed
10-12 08:20	185.108.135[.]126	Attacker	—	1 feed
10-12 08:20	198.244.242[.]152	Attacker	—	1 feed
10-12 08:20	2a01[:]4020[:]1[:]1[:]101[:][:]49	Attacker	—	1 feed
10-12 08:20	51.195.215[.]82	Attacker	—	1 feed
10-12 08:10	46.101.77[.]221	Attacker	—	1 feed
10-12 08:10	138.68.167[.]17	Attacker	—	2 feeds
10-12 08:10	138.68.180[.]110	Attacker	—	2 feeds
10-12 08:10	139.59.175[.]48	Attacker	—	2 feeds
10-12 08:10	139.59.179[.]185	Attacker	—	2 feeds
10-12 08:10	142.93.37[.]226	Attacker	—	2 feeds
10-12 08:10	165.227.234[.]227	Attacker	—	1 feed
10-12 08:10	165.227.238[.]90	Attacker	—	2 feeds
10-12 08:10	167.172.50[.]215	Attacker	—	2 feeds
10-12 08:10	167.172.50[.]253	Attacker	—	1 feed
10-12 08:10	167.99.192[.]170	Attacker	—	2 feeds
10-12 08:10	178.62.50[.]22	Attacker	—	2 feeds
10-12 08:10	188.166.174[.]100	Attacker	—	1 feed
10-12 07:53	91.204.209[.]32:21	C2		1 feed
10-12 07:50	198.244.183[.]218	Attacker	—	1 feed
10-12 07:50	198.244.242[.]240	Attacker	—	1 feed
10-12 07:15	198.244.226[.]209	Attacker	—	1 feed
10-12 07:15	2a01[:]4020[:]1[:]1[:]103[:][:]476	Attacker	—	1 feed
10-12 07:15	2a01[:]4020[:]1[:]1[:]103[:][:]58a	Attacker	—	1 feed
10-12 06:58	62.204.41[.]252	Malware		1 feed 6 sandbox samples
10-12 06:41	134.209.188[.]23	Attacker	—	1 feed
10-12 06:41	148.113.130[.]55	Attacker	—	1 feed
10-12 06:41	51.195.183[.]236	Attacker	—	1 feed
10-12 06:41	54.38.147[.]163	Attacker	—	1 feed
10-12 06:32	45.142.215[.]47	Malware		1 feed 583 sandbox samples
10-12 06:10	46.101.86[.]32	Attacker	—	1 feed
10-12 06:10	68.183.43[.]157	Attacker	—	1 feed
10-12 06:10	78.149.123[.]230	Attacker	—	no longer listed
10-12 06:10	134.209.20[.]249	Attacker	—	1 feed
10-12 06:10	138.68.168[.]148	Attacker	—	1 feed
10-12 06:10	138.68.172[.]230	Attacker	—	1 feed
10-12 06:10	138.68.176[.]14	Attacker	—	1 feed
10-12 06:10	139.59.166[.]49	Attacker	—	1 feed
10-12 06:10	142.93.35[.]38	Attacker	—	1 feed
10-12 06:10	144.126.196[.]158	Attacker	—	1 feed
10-12 06:10	144.126.200[.]43	Attacker	—	1 feed
10-12 06:10	157.245.44[.]71	Attacker	—	1 feed
10-12 06:10	159.65.17[.]173	Attacker	—	1 feed
10-12 06:10	159.65.55[.]240	Attacker	—	1 feed
10-12 06:10	161.35.166[.]104	Attacker	—	1 feed
10-12 06:10	161.35.37[.]48	Attacker	—	1 feed
10-12 06:10	161.35.46[.]73	Attacker	—	1 feed
10-12 06:10	165.227.234[.]61	Attacker	—	1 feed
10-12 06:10	165.232.109[.]197	Attacker	—	1 feed
10-12 06:10	165.232.45[.]146	Attacker	—	1 feed
10-12 06:10	167.172.51[.]237	Attacker	—	1 feed
10-12 06:10	167.99.82[.]186	Attacker	—	1 feed
10-12 06:10	188.166.171[.]107	Attacker	—	1 feed
10-12 06:10	185.192.71[.]213	Attacker	—	1 feed
10-12 06:10	198.244.168[.]186	Attacker	—	1 feed
10-12 06:10	198.244.168[.]251	Attacker	—	1 feed
10-12 05:55	139.59.179[.]31	Attacker	—	1 feed
10-12 05:55	135.136.20[.]19	Attacker	—	1 feed
10-12 05:55	172.236.31[.]90	Attacker	—	1 feed
10-12 05:35	198.244.242[.]254	Attacker	—	1 feed
10-12 05:35	46.101.63[.]33	Attacker	—	1 feed
10-12 05:00	138.68.143[.]97	Attacker	—	1 feed
10-12 05:00	142.93.43[.]142	Attacker	—	1 feed
10-12 05:00	144.126.201[.]130	Attacker	—	1 feed
10-12 05:00	144.126.225[.]56	Attacker	—	1 feed
10-12 05:00	178.128.162[.]180	Attacker	—	1 feed

Values are defanged (hxxp, [.]) so nothing here is a live link to malicious infrastructure. URL query strings are removed to protect victims. Copy copies the defanged form.

Security check