Malicious IP Address Feed
Newly reported malicious IP addresses; 89,246 tracked.
39 indicators match · newest first · updated 2026-10-12 10:25 UTC
| First seen | Indicator | Category | Family | Reported by | Where | Network | Copy |
|---|---|---|---|---|---|---|---|
| 10-12 10:10 | 89.248.171[.]24 | Attacker | — | 1 feed | |||
| 10-12 09:36 | 217.12.206[.]197 | Malware | 1 feed 12 sandbox samples | ||||
| 10-12 09:30 | 51.83.150[.]96 | Attacker | — | 1 feed | |||
| 10-12 09:19 | 148.81.111[.]121 | Malware | — | 1 feed 312 sandbox samples | |||
| 10-12 08:46 | 80.92.206[.]128 | Malware | — | 1 feed 2 sandbox samples | — | ||
| 10-12 08:10 | 37.26.193[.]84 | Attacker | — | 1 feed | |||
| 10-12 08:10 | 79.186.166[.]85 | Attacker | — | 1 feed | |||
| 10-12 07:50 | 193.239.145[.]233 | Attacker | — | 1 feed | |||
| 10-12 07:50 | 91.228.33[.]36 | Attacker | — | 1 feed | |||
| 10-12 07:15 | 185.19.118[.]57 | Attacker | — | 1 feed | |||
| 10-12 06:10 | 46.174.73[.]106 | Attacker | — | 1 feed | |||
| 10-12 06:08 | 185.16.39[.]123 | Malware | 1 feed 70 sandbox samples | ||||
| 10-12 05:35 | 195.205.4[.]147 | Attacker | — | 1 feed | |||
| 10-12 05:00 | 80.92.205[.]116 | Malware | 1 feed 48 sandbox samples | — | |||
| 10-12 05:00 | 91.240.44[.]102 | Attacker | — | 1 feed | |||
| 10-12 04:35 | 78.31.92[.]239 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 85.221.152[.]77 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 91.236.172[.]36 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 152.233.43[.]20 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 217.60.33[.]10 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 91.240.44[.]196 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 2a03[:]cfc0[:]8000[:]2d[:][:]c122[:]d611 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 94.75.78[.]249 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 213.92.222[.]99 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 91.228.33[.]72 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 91.232.165[.]90 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 83.168.93[.]187 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 91.222.142[.]131 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 213.92.222[.]125 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 195.136.4[.]6 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 185.144.246[.]137 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 57.131.198[.]207 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 89.248.172[.]11 | Attacker | — | 3 feeds | |||
| 10-12 04:35 | 89.231.35[.]28 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 195.136.4[.]3 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 45.85.208[.]4 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 185.125.4[.]17 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 213.92.223[.]8 | Attacker | — | 2 feeds | |||
| 10-12 04:35 | 2a03[:]cfc0[:]8000[:]2d[:][:]c122[:]d60e | Attacker | — | 2 feeds |
Values are defanged (hxxp, [.]) so nothing here is a live link to malicious infrastructure. URL query strings are removed to protect victims. Copy copies the defanged form.