Malicious IP Address Feed
Newly reported malicious IP addresses; 90,755 tracked.
36 indicators match · newest first · updated 2026-10-12 09:36 UTC
| First seen | Indicator | Category | Family | Reported by | Where | Network | Copy |
|---|---|---|---|---|---|---|---|
| 10-12 09:30 | 49.125.209[.]23 | Attacker | — | 1 feed | |||
| 10-12 09:30 | 49.125.212[.]141 | Attacker | — | 1 feed | |||
| 10-12 08:21 | 101.99.90[.]200 | Malware | 1 feed 44 sandbox samples | ||||
| 10-12 08:21 | 103.155.92[.]70 | Malware | 1 feed 8 sandbox samples | ||||
| 10-12 08:20 | 49.124.151[.]32 | Attacker | — | 1 feed | |||
| 10-12 07:55 | 185.196.0[.]16 | Attacker | — | 1 feed | |||
| 10-12 07:53 | 103.155.92[.]58 | Malware | 1 feed 1,466 sandbox samples | ||||
| 10-12 07:53 | 103.155.93[.]196 | Malware | 1 feed 340 sandbox samples | ||||
| 10-12 07:26 | 103.169.90[.]205 | Malware | — | 1 feed 7 sandbox samples | |||
| 10-12 07:25 | 161.248.14[.]20:8790 | C2 | — | 1 feed | |||
| 10-12 07:15 | 49.124.149[.]202 | Attacker | — | 1 feed | |||
| 10-12 06:41 | 47.254.192[.]213 | Attacker | — | 3 feeds | |||
| 10-12 06:41 | 49.124.147[.]104 | Attacker | — | 1 feed | |||
| 10-12 06:10 | 118.100.187[.]12 | Attacker | — | 2 feeds | |||
| 10-12 05:55 | 14.192.214[.]23 | Attacker | — | 1 feed | |||
| 10-12 05:35 | 120.141.23[.]247 | Attacker | — | 1 feed | |||
| 10-12 05:35 | 124.82.77[.]100 | Attacker | — | 1 feed | |||
| 10-12 05:00 | 2402[:]1980[:]8c0b[:]17b7[:]414d[:]5e6[:]c18b[:]6e13 | Attacker | — | 1 feed | |||
| 10-12 04:50 | 175.136.213[.]159 | Attacker | — | 1 feed | |||
| 10-12 04:35 | 205.147.27[.]5 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 49.124.152[.]244 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 180.75.238[.]21 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 49.124.152[.]224 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 49.124.159[.]189 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 27.125.244[.]79 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 49.124.151[.]13 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 49.124.155[.]154 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 175.142.1[.]198 | Attacker | — | 3 feeds | |||
| 10-12 04:35 | 2001[:]e68[:]544d[:]4f2a[:]69a8[:]a4d2[:]6134[:]6661 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 49.124.153[.]22 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 60.49.99[.]68 | Attacker | — | 3 feeds | |||
| 10-12 04:35 | 49.124.151[.]53 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 49.124.151[.]4 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 66.118.56[.]69 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 49.124.151[.]5 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 124.217.233[.]18 | Attacker | — | 1 feed |
Values are defanged (hxxp, [.]) so nothing here is a live link to malicious infrastructure. URL query strings are removed to protect victims. Copy copies the defanged form.