Malicious IP Address Feed
Newly reported malicious IP addresses; 90,418 tracked.
20 indicators match · newest first · updated 2026-10-12 11:31 UTC
| First seen | Indicator | Category | Family | Reported by | Where | Network | Copy |
|---|---|---|---|---|---|---|---|
| 10-12 10:30 | 2407[:]1400[:]b002[:]3640[:]7d81[:]8457[:]fabd[:]e0f2 | Attacker | — | 1 feed | |||
| 10-12 09:30 | 111.119.48[.]229 | Attacker | — | 1 feed | |||
| 10-12 08:20 | 2403[:]3800[:]2206[:]2ffb[:]ad39[:]7a52[:]f6be[:]3f5c | Attacker | — | 1 feed | |||
| 10-12 08:20 | 2407[:]1400[:]b000[:]4900[:]54e0[:]512d[:]e4d8[:]33e3 | Attacker | — | 1 feed | |||
| 10-12 08:20 | 49.244.244[.]159 | Attacker | — | 1 feed | |||
| 10-12 07:50 | 103.86.56[.]83 | Attacker | — | 1 feed | |||
| 10-12 07:50 | 2407[:]1400[:]b001[:]ad00[:]54e0[:]512d[:]e4d8[:]33e3 | Attacker | — | 1 feed | |||
| 10-12 06:41 | 103.134.218[.]165 | Attacker | — | 1 feed | |||
| 10-12 05:00 | 124.41.228[.]116 | Attacker | — | 1 feed | |||
| 10-12 04:50 | 202.166.198[.]189 | Attacker | — | 1 feed | |||
| 10-12 04:35 | 2407[:]1400[:]b000[:]d2e8[:]e8f9[:]3408[:]4321[:]b16e | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 49.244.243[.]209 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 2407[:]1400[:]aa3f[:]57d0[:]a5c3[:]ae84[:]d3a6[:]9b02 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 2407[:]1400[:]aa35[:]3628[:]1de0[:]9850[:]c585[:]bc2f | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 139.5.71[.]26 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 27.34.67[.]175 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 2400[:]1a00[:]4ba1[:]5d26[:]5433[:]9bf3[:]f5e4[:]688e | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 27.34.70[.]35 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 103.13.194[.]81 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 103.13.194[.]88 | Attacker | — | 2 feeds |
Values are defanged (hxxp, [.]) so nothing here is a live link to malicious infrastructure. URL query strings are removed to protect victims. Copy copies the defanged form.