Malicious IP Address Feed

Newly reported malicious IP addresses; 90,755 tracked.

171 indicators match · newest first · updated 2026-10-12 09:36 UTC

First seen	Indicator	Category	Family	Reported by	Network
10-12 09:30	34.12.225[.]42	Attacker	—	1 feed
10-12 09:30	89.46.223[.]59	Attacker	—	1 feed
10-12 09:30	91.92.242[.]121	Attacker	—	1 feed
10-12 09:10	45.9.2[.]178	Attacker	—	3 feeds
10-12 09:04	5.79.71[.]225	Malware		1 feed 170 sandbox samples
10-12 09:04	5.79.71[.]205	Malware		1 feed 163 sandbox samples
10-12 09:04	167.99.35[.]88	Malware		1 feed 266 sandbox samples
10-12 09:04	185.177.125[.]94	Malware		1 feed 255 sandbox samples
10-12 08:55	2a01[:]4020[:]2[:]b[:]101[:][:]11	Attacker	—	1 feed
10-12 08:55	2a01[:]4020[:]2[:]b[:]101[:][:]248	Attacker	—	1 feed
10-12 08:55	2a01[:]4020[:]2[:]b[:]101[:][:]2bb	Attacker	—	1 feed
10-12 08:55	2a01[:]4020[:]2[:]b[:]101[:][:]633	Attacker	—	1 feed
10-12 08:55	45.156.87[.]28	Attacker	—	1 feed
10-12 08:46	140.82.59[.]108	Malware		1 feed 1,022 sandbox samples
10-12 08:46	37.0.8[.]39	Malware		1 feed 527 sandbox samples
10-12 08:25	84.38.133[.]187:3270	C2		1 feed
10-12 08:21	85.17.31[.]122	Malware		1 feed 143 sandbox samples
10-12 08:21	45.133.1[.]182	Malware		1 feed 871 sandbox samples
10-12 08:21	178.237.33[.]50	Malware		1 feed 1,159 sandbox samples
10-12 08:21	91.242.229[.]77	Malware		1 feed 96 sandbox samples	—
10-12 08:21	80.85.142[.]179	Malware		1 feed 50 sandbox samples
10-12 08:21	163.123.143[.]12	Malware		1 feed 11 sandbox samples
10-12 08:20	2a01[:]4020[:]2[:]b[:]102[:][:]242	Attacker	—	1 feed
10-12 08:20	2a01[:]4020[:]2[:]b[:]102[:][:]479	Attacker	—	1 feed
10-12 08:20	2a01[:]4020[:]2[:]b[:]102[:][:]687	Attacker	—	1 feed
10-12 08:20	2a01[:]4020[:]2[:]b[:]102[:][:]79a	Attacker	—	1 feed
10-12 08:10	104.248.192[.]7	Attacker	—	1 feed
10-12 08:10	152.42.138[.]189	Attacker	—	1 feed
10-12 08:10	157.245.73[.]143	Attacker	—	1 feed
10-12 08:10	161.35.94[.]154	Attacker	—	1 feed
10-12 08:10	164.92.219[.]13	Attacker	—	1 feed
10-12 08:10	174.138.3[.]141	Attacker	—	1 feed
10-12 08:10	178.128.255[.]217	Attacker	—	1 feed
10-12 07:55	45.156.128[.]71	Attacker	—	2 feeds
10-12 07:55	213.152.161[.]130	Attacker	—	1 feed
10-12 07:53	45.133.1[.]107	Malware		1 feed 1,135 sandbox samples
10-12 07:53	79.137.198[.]102	Malware	—	1 feed 16 sandbox samples
10-12 07:50	130.49.79[.]161	Attacker	—	1 feed
10-12 07:50	206.54.181[.]21	Attacker	—	1 feed
10-12 07:50	34.13.197[.]159	Attacker	—	1 feed
10-12 07:26	85.17.31[.]82	Malware		1 feed 141 sandbox samples
10-12 07:26	2.59.169[.]43	Malware		1 feed 3 sandbox samples
10-12 07:26	178.23.190[.]242	Malware	—	1 feed 17 sandbox samples	—
10-12 07:26	79.137.194[.]132	Malware		1 feed 4 sandbox samples
10-12 07:15	159.65.197[.]5	Attacker	—	1 feed
10-12 07:15	2a10[:]3c0[:]3[:]0[:]1[:]31[:]0[:]2	Attacker	—	1 feed
10-12 07:15	178.162.175[.]5	Tor exit	—	1 feed
10-12 07:04	188.166.12[.]8:443	C2		1 feed
10-12 07:04	64.227.72[.]68:443	C2		1 feed
10-12 06:58	217.195.155[.]154	Malware	—	1 feed 60 sandbox samples
10-12 06:58	81.4.105[.]174	Malware		1 feed 43 sandbox samples
10-12 06:58	212.32.237[.]92	Malware		1 feed 77 sandbox samples
10-12 06:55	172.235.168[.]96	Attacker	—	1 feed
10-12 06:32	51.15.65[.]182	Malware		1 feed 143 sandbox samples
10-12 06:32	46.249.58[.]152	Malware		1 feed 23 sandbox samples
10-12 06:11	31.59.220[.]26:5900	C2		2 feeds	—
10-12 06:10	64.227.65[.]24	Attacker	—	1 feed
10-12 06:10	68.183.14[.]68	Attacker	—	1 feed
10-12 06:10	104.248.199[.]239	Attacker	—	1 feed
10-12 06:10	104.248.93[.]115	Attacker	—	1 feed
10-12 06:10	134.209.95[.]137	Attacker	—	1 feed
10-12 06:10	142.93.129[.]217	Attacker	—	1 feed
10-12 06:10	146.190.22[.]46	Attacker	—	1 feed
10-12 06:10	159.223.208[.]99	Attacker	—	1 feed
10-12 06:10	164.92.159[.]92	Attacker	—	1 feed
10-12 06:10	167.172.40[.]251	Attacker	—	1 feed
10-12 06:10	167.172.40[.]29	Attacker	—	1 feed
10-12 06:10	167.172.43[.]72	Attacker	—	1 feed
10-12 06:10	167.99.221[.]87	Attacker	—	1 feed
10-12 06:10	178.128.252[.]170	Attacker	—	1 feed
10-12 06:10	178.128.253[.]153	Attacker	—	1 feed
10-12 06:10	206.189.111[.]55	Attacker	—	1 feed
10-12 06:10	206.189.15[.]147	Attacker	—	1 feed
10-12 06:10	209.38.108[.]205	Attacker	—	1 feed
10-12 06:10	104.23.170[.]168	Attacker	—	1 feed
10-12 06:10	172.71.182[.]197	Attacker	—	1 feed
10-12 06:10	172.71.182[.]99	Attacker	—	1 feed
10-12 06:10	2400[:]cb00[:]555[:]1000[:]8652[:]7ae9[:]a249[:]4ad3	Attacker	—	1 feed	—
10-12 06:10	2400[:]cb00[:]555[:]1000[:]9373[:]607c[:]be1c[:]6fcf	Attacker	—	1 feed	—
10-12 06:10	2400[:]cb00[:]996[:]1000[:]214f[:]8fc9[:]6726[:]8834	Attacker	—	1 feed
10-12 06:10	2400[:]cb00[:]996[:]1000[:]4bde[:]af76[:]59bb[:]5c0f	Attacker	—	1 feed
10-12 06:10	2400[:]cb00[:]996[:]1000[:]93fc[:]25bb[:]e705[:]b8d6	Attacker	—	1 feed
10-12 06:10	2400[:]cb00[:]996[:]1000[:]f0c8[:]cca4[:]fa25[:]481b	Attacker	—	1 feed
10-12 06:10	34.6.54[.]54	Attacker	—	1 feed
10-12 05:55	185.242.226[.]11	Attacker	—	2 feeds
10-12 05:55	109.160.32[.]40	Attacker	—	3 feeds
10-12 05:55	86.54.28[.]27	Attacker	—	1 feed
10-12 05:35	104.248.193[.]172	Attacker	—	1 feed
10-12 05:15	45.159.189[.]105	Malware	—	1 feed 40 sandbox samples
10-12 05:10	217.60.195[.]219:2404	C2		1 feed
10-12 05:02	178.16.53[.]56:9034	C2		1 feed
10-12 05:00	192.42.116[.]41	Malware		1 feed 296 sandbox samples
10-12 05:00	20.73.194[.]208	Malware		1 feed 193 sandbox samples
10-12 04:45	52.142.223[.]178	Malware		1 feed 634 sandbox samples
10-12 04:35	176.65.139[.]231	Attacker	—	3 feeds
10-12 04:35	192.87.28[.]82	Attacker	—	2 feeds 19 sandbox samples
10-12 04:35	192.87.28[.]28	Attacker	—	2 feeds 21 sandbox samples
10-12 04:35	45.156.128[.]148	Attacker	—	3 feeds
10-12 04:35	176.65.149[.]188	Attacker	—	3 feeds
10-12 04:35	192.42.116[.]144	Attacker	—	3 feeds

Values are defanged (hxxp, [.]) so nothing here is a live link to malicious infrastructure. URL query strings are removed to protect victims. Copy copies the defanged form.

Security check