Top Malicious IP Addresses — Last 24 Hours

These are the 50 most frequently reported IP addresses in the last 24 hours, ranked by the number of independent abuse reports received from our threat intelligence network. Each IP has been flagged by automated threat detection systems and verified reporters.

24 Hours 7 Days 30 Days
# IP Address Reports Severity Categories Country Network
1 80.94.92.128 24 MEDIUM ssh bruteforce Romania Unmanaged Ltd
2 195.178.110.30 17 MEDIUM ssh bruteforce Bulgaria Techoff Srv Limited
3 124.163.212.119 15 HIGH malware c2 China CHINA UNICOM China169 Backbone
4 104.243.248.63 15 HIGH malware c2 Germany Voxility LLP
5 5.182.210.174 12 HIGH malware c2 The Netherlands SpectraIP B.V.
6 62.60.130.253 12 HIGH ssh bruteforce Iran Cipher Operations Doo Beograd - Novi Beograd
7 31.57.184.154 11 HIGH malware c2 United States VPS Dedicated LLC
8 193.47.62.69 11 HIGH ssh bruteforce Bulgaria BestDC Limited
9 159.203.69.210 10 HIGH malware c2 United States DigitalOcean, LLC
10 193.32.162.27 10 MEDIUM ssh bruteforce Romania Unmanaged Ltd
11 45.148.10.141 10 HIGH ssh bruteforce The Netherlands Techoff Srv Limited
12 45.148.10.151 9 HIGH ssh bruteforce The Netherlands Techoff Srv Limited
13 45.148.10.152 9 HIGH ssh bruteforce The Netherlands Techoff Srv Limited
14 43.128.113.133 9 HIGH malware c2 Singapore Tencent Building, Kejizhongyi Avenue
15 80.94.92.128 8 MEDIUM generic bruteforce Romania Unmanaged Ltd
16 45.148.10.157 8 HIGH ssh bruteforce The Netherlands Techoff Srv Limited
17 150.109.93.78 8 HIGH malware c2 Singapore Tencent Building, Kejizhongyi Avenue
18 62.60.130.201 8 HIGH ssh bruteforce Iran Cipher Operations Doo Beograd - Novi Beograd
19 54.38.94.225 8 HIGH malware c2 France OVH SAS
20 62.60.130.242 8 HIGH ssh bruteforce Iran Cipher Operations Doo Beograd - Novi Beograd
21 45.207.213.109 8 HIGH ssh bruteforce Seychelles cognetcloud INC
22 43.134.49.218 8 HIGH malware c2 Singapore Tencent Building, Kejizhongyi Avenue
23 172.94.18.103 7 HIGH malware c2 Germany M247 Europe SRL
24 89.19.223.68 7 HIGH malware c2 Russia Sysect D.o.o.
25 116.99.170.194 7 MEDIUM ssh bruteforce Vietnam Viettel Corporation
26 176.53.159.197 7 HIGH ssh bruteforce Türkiye ZORNTECH WEB SOLUTIONS
27 176.53.159.198 7 HIGH ssh bruteforce Türkiye ZORNTECH WEB SOLUTIONS
28 27.79.1.70 7 MEDIUM ssh bruteforce Vietnam Viettel Group
29 193.32.162.15 7 MEDIUM ssh bruteforce Romania Unmanaged Ltd
30 157.20.182.21 6 HIGH malware c2 The Netherlands Hosterdaddy Private Limited
31 195.178.110.30 6 MEDIUM generic bruteforce Bulgaria Techoff Srv Limited
32 185.34.147.33 6 HIGH malware c2 United States CNServer LLC
33 130.12.182.39 6 HIGH malware c2 Slovenia VPS Dedicated LLC
34 195.178.110.137 6 MEDIUM ssh bruteforce Bulgaria Techoff Srv Limited
35 178.254.177.119 6 HIGH ddos Germany Blockchain Creek B.V.
36 209.99.190.23 6 HIGH malware c2 Switzerland SKN Subnet & Telecom Ltd
37 80.190.77.86 5 HIGH malware c2 Germany Contabo Inc.
38 82.165.79.60 5 HIGH malware c2 Germany IONOS SE
39 156.224.18.21 5 HIGH malware c2 Hong Kong CORENET CLOUD SDN. BHD.
40 185.199.197.93 5 HIGH malware c2 The Netherlands Local NCC Ltd.
41 186.169.88.130 5 HIGH malware c2 Colombia COLOMBIA TELECOMUNICACIONES S.A. ESP BIC
42 103.185.249.199 5 HIGH malware c2 Hong Kong cognetcloud INC
43 117.72.39.83 5 HIGH malware c2 China China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch
44 178.16.53.176 5 HIGH malware c2 The Netherlands Omegatech LTD
45 147.93.191.75 5 HIGH malware c2 United States Contabo Inc.
46 45.154.244.193 5 MEDIUM ssh bruteforce Seychelles Shereverov Marat Ahmedovich
47 185.34.147.31 5 HIGH malware c2 United States CNServer LLC
48 185.34.147.34 5 HIGH malware c2 United States CNServer LLC
49 103.83.87.87 5 HIGH malware c2 Türkiye Fiba Cloud Operation Company, LLC
50 203.98.68.17 5 HIGH malware c2 United Kingdom HosterDaddy Private Limited

About This Data

This ranking is compiled from abuse reports submitted by a network of verified threat reporters, automated monitoring systems, and threat intelligence feeds including curated blocklists, community abuse databases, and malware trackers. IP addresses that appear on this list have been independently verified by multiple sources. The data updates in real-time and reflects the most actively malicious IP addresses targeting internet infrastructure worldwide.

Use the WAYSCloud API to check any IP address programmatically, or search directly using the threat intelligence dashboard.

Latest Cyber Attacks → ASN Threat Ranking → Country Risk Trends → Country Threat Ranking → Live Threat Map → AI Threat Forecast →