Malicious IP Address Feed

Newly reported malicious IP addresses; 89,329 tracked.

323 indicators match · newest first · updated 2026-10-12 10:30 UTC

First seen	Indicator	Category	Family	Reported by	Network
10-12 10:30	103.148.152[.]132	Attacker	—	1 feed
10-12 10:30	103.148.152[.]187	Attacker	—	1 feed
10-12 10:30	103.169.56[.]27	Attacker	—	1 feed
10-12 10:30	103.171.246[.]164	Attacker	—	1 feed
10-12 10:30	103.182.106[.]157	Attacker	—	1 feed
10-12 10:30	103.42.175[.]249	Attacker	—	2 feeds
10-12 10:30	106.222.251[.]5	Attacker	—	1 feed
10-12 10:30	111.235.68[.]114	Attacker	—	1 feed
10-12 10:30	125.19.227[.]210	Attacker	—	2 feeds
10-12 10:30	223.181.59[.]2	Attacker	—	1 feed
10-12 10:30	223.235.96[.]22	Attacker	—	1 feed
10-12 10:30	223.235.99[.]178	Attacker	—	1 feed
10-12 10:30	2401[:]4900[:]1ca2[:]62ee[:]79f7[:]cda7[:]9894[:]6bb2	Attacker	—	1 feed
10-12 10:30	2401[:]4900[:]883b[:]f27c[:]70e7[:]50f5[:]73f8[:]dee1	Attacker	—	1 feed
10-12 10:30	2401[:]4900[:]88bc[:]8962[:]6c8e[:]874e[:]6b20[:]3212	Attacker	—	1 feed	—
10-12 10:30	2401[:]4900[:]8fc4[:]2b5b[:]dc92[:]ca1f[:]11d5[:]249e	Attacker	—	1 feed
10-12 10:30	2401[:]4900[:]c258[:]99c8[:]e9a5[:]70ad[:]4f7d[:]6bb1	Attacker	—	1 feed
10-12 10:30	2405[:]201[:]6015[:]d1ad[:]e9ea[:]1012[:]116a[:]db0c	Attacker	—	1 feed
10-12 10:30	49.206.123[.]122	Attacker	—	2 feeds
10-12 10:15	134.209.144[.]190	Attacker	—	1 feed
10-12 10:15	139.59.5[.]74	Attacker	—	2 feeds
10-12 10:15	139.59.88[.]134	Attacker	—	1 feed
10-12 10:10	172.105.58[.]98	Attacker	—	1 feed
10-12 10:10	59.90.30[.]81	Attacker	—	1 feed
10-12 10:10	117.205.169[.]217	Attacker	—	1 feed
10-12 10:00	103.185.100[.]92	Attacker	—	1 feed
10-12 10:00	103.214.63[.]113	Attacker	—	1 feed
10-12 10:00	106.202.111[.]172	Attacker	—	1 feed
10-12 10:00	117.223.43[.]226	Attacker	—	1 feed
10-12 10:00	183.82.1[.]98	Attacker	—	1 feed
10-12 10:00	2401[:]4900[:]8901[:]b138[:]50d5[:]1cd2[:]9293[:]e384	Attacker	—	1 feed
10-12 10:00	43.225.68[.]34	Attacker	—	1 feed
10-12 10:00	49.37.10[.]119	Attacker	—	1 feed
10-12 09:30	103.122.15[.]164	Attacker	—	1 feed
10-12 09:30	103.167.194[.]138	Attacker	—	1 feed
10-12 09:30	106.0.40[.]253	Attacker	—	1 feed
10-12 09:30	122.163.121[.]16	Attacker	—	1 feed
10-12 09:30	125.23.220[.]130	Attacker	—	1 feed
10-12 09:30	157.15.235[.]102	Attacker	—	1 feed
10-12 09:30	2402[:]a00[:]403[:]1cc2[:]a51b[:]b784[:]6443[:]d8dc	Attacker	—	1 feed
10-12 09:30	2409[:]40d2[:]6b[:]a741[:]807f[:]2a83[:]cba2[:]4850	Attacker	—	1 feed
10-12 09:30	43.252.194[.]250	Attacker	—	1 feed
10-12 09:30	47.30.54[.]145	Attacker	—	1 feed
10-12 09:30	49.36.138[.]240	Attacker	—	1 feed
10-12 09:10	137.97.80[.]58	Attacker	—	2 feeds
10-12 09:10	103.66.98[.]192	Attacker	—	1 feed
10-12 09:10	150.107.9[.]150	Attacker	—	1 feed
10-12 09:10	210.212.97[.]243	Attacker	—	1 feed
10-12 09:10	144.48.48[.]73	Attacker	—	1 feed
10-12 09:10	103.91.72[.]217	Attacker	—	1 feed
10-12 09:10	122.160.128[.]65	Attacker	—	1 feed
10-12 09:04	52.140.118[.]28	Malware		1 feed 244 sandbox samples
10-12 08:55	103.211.15[.]74	Attacker	—	1 feed
10-12 08:55	117.213.134[.]111	Attacker	—	1 feed
10-12 08:55	117.223.189[.]239	Attacker	—	1 feed
10-12 08:55	122.162.146[.]141	Attacker	—	1 feed
10-12 08:55	152.58.37[.]115	Attacker	—	1 feed
10-12 08:55	2401[:]4900[:]1cb5[:]1bfb[:]25ff[:]4d80[:]686f[:]819c	Attacker	—	1 feed
10-12 08:55	2409[:]4090[:]808f[:]9403[:]8121[:]a100[:]4c9[:]5170	Attacker	—	1 feed
10-12 08:55	2409[:]4090[:]808f[:]9403[:]ec23[:]fab5[:]b9e9[:]b553	Attacker	—	1 feed
10-12 08:55	49.47.133[.]139	Attacker	—	1 feed
10-12 08:55	111.223.3[.]190	Attacker	—	1 feed
10-12 08:55	2401[:]4900[:]360a[:]1914[:]7df5[:]840a[:]d610[:]f984	Attacker	—	1 feed
10-12 08:21	103.83.81[.]80	Malware	—	1 feed 36 sandbox samples	—
10-12 08:20	103.172.210[.]133	Attacker	—	1 feed
10-12 08:20	103.183.90[.]233	Attacker	—	1 feed
10-12 08:20	103.74.220[.]10	Attacker	—	1 feed
10-12 08:20	106.219.227[.]226	Attacker	—	1 feed
10-12 08:20	117.194.124[.]248	Attacker	—	1 feed
10-12 08:20	122.168.2[.]247	Attacker	—	1 feed
10-12 08:20	122.168.4[.]49	Attacker	—	1 feed
10-12 08:20	122.187.229[.]160	Attacker	—	1 feed
10-12 08:20	14.99.117[.]118	Attacker	—	1 feed
10-12 08:20	152.59.146[.]217	Attacker	—	1 feed
10-12 08:20	157.119.214[.]142	Attacker	—	1 feed
10-12 08:20	223.180.182[.]165	Attacker	—	1 feed
10-12 08:20	223.184.152[.]74	Attacker	—	1 feed
10-12 08:20	2401[:]4900[:]d148[:]c31f[:]4c75[:]2bc7[:]29c5[:]9027	Attacker	—	1 feed
10-12 08:20	2409[:]40d0[:]1398[:]a19e[:]b4c1[:]95c2[:]6e58[:]9551	Attacker	—	1 feed
10-12 08:20	49.37.73[.]167	Attacker	—	1 feed
10-12 08:10	168.144.112[.]61	Attacker	—	1 feed
10-12 08:10	168.144.95[.]14	Attacker	—	1 feed
10-12 08:10	206.189.128[.]250	Attacker	—	1 feed
10-12 07:55	66.116.251[.]167	Attacker	—	1 feed
10-12 07:55	14.139.59[.]212	Attacker	—	1 feed
10-12 07:55	103.86.173[.]95	Attacker	—	1 feed
10-12 07:53	103.152.79[.]123	Malware		1 feed 125 sandbox samples
10-12 07:50	1.38.153[.]175	Attacker	—	1 feed
10-12 07:50	1.38.43[.]124	Attacker	—	1 feed
10-12 07:50	103.123.234[.]219	Attacker	—	1 feed
10-12 07:50	103.30.80[.]210	Attacker	—	1 feed
10-12 07:50	103.85.132[.]164	Attacker	—	1 feed
10-12 07:50	103.85.205[.]4	Attacker	—	1 feed
10-12 07:50	106.202.69[.]162	Attacker	—	1 feed
10-12 07:50	117.243.127[.]240	Attacker	—	1 feed
10-12 07:50	122.187.230[.]154	Attacker	—	1 feed
10-12 07:50	16.113.64[.]237	Attacker	—	1 feed
10-12 07:50	160.250.80[.]197	Attacker	—	2 feeds
10-12 07:50	203.194.105[.]248	Attacker	—	1 feed
10-12 07:50	2401[:]4900[:]a8b1[:]6677[:]65b8[:]c6fb[:]fad2[:]6411	Attacker	—	1 feed

Values are defanged (hxxp, [.]) so nothing here is a live link to malicious infrastructure. URL query strings are removed to protect victims. Copy copies the defanged form.

Security check