Threat Scan Active — Real-time Intelligence

Malicious IP
Intel Database

Confirmed botnet C2 servers, malware distribution hosts, and exploit staging infrastructure. Aggregated from multiple global threat feeds and our own sensor network.

C2 Tracking Networks Malware Dist Feeds Multi-Source Correlation Sensor Network WAF Telemetry
⟳ DATA REFRESHES HOURLY · CROSS-VERIFIED BEFORE LISTING
THREAT SCAN ACTIVE
419,703
Total IPs
50,588
Active (7d)
14845+
Hostile ASNs
5,592
Reappeared
16052
CVE-Linked
369,114
Expired
🆕
+5,981
New IPs detected
♻️
+5,592
IPs reappeared
🔗
16,052
CVE-linked IPs
📡
14845+
Hostile networks
// 7-Day Detection History derived from last_seen timestamps
Today
Yest
2d
3d
4d
5d
6d
46,446
Seen This Week
8,466
Peak Day
6,635
Daily Average
8,466
Today
Recent Malicious IPs ● LIVE 2026-10-13 20:22 UTC
⌕
Status IP Address Type Malware / CVE Country Conf. Last seen
Active
39.86.250.41 Malware Dist —
8m ago
Active
119.116.35.92 Malware Dist —
8m ago
Active
175.165.80.226 Malware Dist —
8m ago
Active
175.165.44.137 Malware Dist —
8m ago
Active
104.244.76.33 Malware Dist —
8m ago
Active
74.113.234.62 Malware Dist —
8m ago
Active
91.188.254.62 Malware Dist —
8m ago
Active
172.86.108.117 Malware Dist —
8m ago
Active
221.203.143.17 Malware Dist —
8m ago
Active
217.60.195.62 Malware Dist —
8m ago
Active
150.251.113.186 Malware Dist —
8m ago
Active
182.116.112.72 Malware Dist —
8m ago
Active
182.121.148.252 Malware Dist —
8m ago
Active
182.122.120.82 Malware Dist —
8m ago
Active
119.117.173.221 Malware Dist —
8m ago
Active
119.114.62.34 Malware Dist —
8m ago
Active
115.55.57.11 Malware Dist —
8m ago
Active
105.224.56.184 Malware Dist —
8m ago
Active
218.61.29.147 Malware Dist —
8m ago
Active
78.159.121.136 TOR Exit 🇩🇪 DE
9m ago
Active
198.167.206.187 TOR Exit —
9m ago
Active
60.1.254.20 Scanner 🇨🇳 CN
2h ago
Active
57.154.175.6 Scanner 🇺🇸 US
2h ago
Active
85.214.52.114 Scanner 🇩🇪 DE
2h ago
Active
200.13.195.238 Scanner 🇺🇸 US
2h ago
Active
17.166.155.229 Scanner 🇺🇸 US
2h ago
Active
192.144.204.86 Scanner 🇨🇳 CN
2h ago
Active
2405:4802:22e4:330:69b8:df7b:e789:a3b1 Scanner 🇻🇳 VN
2h ago
Active
5.77.205.220 Scanner 🇦🇲 AM
2h ago
Active
2a04:4e41:0:413a::c85f:413a Scanner 🇺🇸 US
2h ago
Active
144.124.196.63 Scanner 🇺🇿 UZ
2h ago
Active
43.154.14.253 Scanner 🇭🇰 HK
2h ago
Active
3.90.214.79 Scanner 🇺🇸 US
2h ago
Active
105.225.109.217 Scanner 🇿🇦 ZA
2h ago
Active
2407:4280:c06:bcc1:f436:dcb9:280:e9d1 Scanner LA
2h ago
Active
98.80.130.54 Scanner 🇺🇸 US
2h ago
Active
17.166.153.26 Scanner 🇺🇸 US
2h ago
Active
186.179.18.48 Scanner 🇺🇸 US
2h ago
Active
186.247.188.94 Scanner 🇺🇸 US
2h ago
Active
16.216.88.112 Scanner 🇨🇦 CA
2h ago
Active
150.109.197.251 Scanner 🇯🇵 JP
2h ago
Active
182.134.221.80 Scanner 🇨🇳 CN
2h ago
Active
148.222.129.184 Scanner PY
2h ago
Active
41.100.159.188 Scanner 🇩🇿 DZ
2h ago
Active
34.231.135.81 Scanner 🇺🇸 US
2h ago
Active
43.130.91.75 Scanner 🇺🇸 US
2h ago
Active
32.196.82.58 Scanner 🇺🇸 US
2h ago
Active
74.7.229.132 Scanner 🇺🇸 US
2h ago
Active
2606:54c1:1:14ed::4f8:29 Scanner 🇺🇸 US
2h ago
Active
48.192.92.48 Scanner 🇺🇸 US
2h ago
No IPs match your search or filter.
Top Countries
1 🇧🇪 Belgium
7,131
2 🇦🇷 Argentina
4,657
3 🇧🇩 Bangladesh
2,160
4 🇦🇺 Australia
1,981
5 🇦🇪 UAE
1,071
6 🇧🇬 Bulgaria
891
7 🇦🇹 Austria
408
8 🇦🇱 Albania
357
9 🇦🇿 Azerbaijan
338
10 🇦🇲 AM
255
11 🇦🇩 AD
169
12 🌐 BH
166
Malware Families
Mozi
358
elf
221
32-bit
215
mips
179
Mirai Botnet
83
None
54
arm
38
win.vshell
11
Threat Type Split
scanner
88%
malware dist
10%
mixed
2%
tor
1%
Hostile ASNs 14845+ Networks
AS0 Excitel Broadband Pvt Ltd 29 IPs
AS10010 TOKAI 3 IPs
AS10013 FreeBit Co., Ltd. 3 IPs
AS0 Bluevps.com 1 IPs
AS10 Nunes Telecom 1 IPs
AS10002 Igaueno Cable Television Co., 1 IPs
AS10003 Ogaki Cable Television Co., 1 IPs
AS10010 ACROSS 1 IPs
→ Full ASN Directory
// Developer API
Integrate IP Threat Intel
into Your Security Stack
Real-time malicious IP lookup, bulk feed, and ASN threat data — REST API with JSON responses. Integrate into your SIEM, firewall, or custom tooling in minutes.
# IP reputation lookup
GET /v1/ip/{ip}
Authorization: Bearer <token>

# Bulk threat feed (CIDR aware)
GET /v1/ip/feed?asn=AS9009

# CVE-linked IPs only
GET /v1/ip/feed?has_cve=true
Get API Access View Documentation
// About This Data
Sources & Collection
IP threat data is aggregated from multiple global threat intelligence networks, honeypot sensor arrays, and passive traffic monitoring infrastructure. Each IP is cross-referenced across independent corroborating sources before being confirmed malicious — false positives are actively suppressed.
Confidence Scoring
Each IP receives a confidence score (0–100%) based on the number of independent corroborating sources, recency of observations, and type of malicious activity. High-confidence IPs have been observed by 3+ sources within the last 7 days.
Retention & Updates
Active threats are updated continuously. IPs that have not been observed for 7 days are marked as expired but retained in the database for historical analysis. The feed covers IPv4 and IPv6. All data is available via the API for programmatic access.