Top Malicious IP Addresses — Last 24 Hours

These are the 50 most frequently reported IP addresses in the last 24 hours, ranked by the number of independent abuse reports received from our threat intelligence network. Each IP has been flagged by automated threat detection systems and verified reporters.

24 Hours 7 Days 30 Days
# IP Address Reports Severity Categories Country Network
1 80.94.92.128 34 MEDIUM ssh bruteforce Romania Unmanaged Ltd
2 103.11.41.10 20 HIGH malware c2 Philippines Sunbridge worldwide LTD
3 103.11.41.20 19 HIGH malware c2 Philippines Sunbridge worldwide LTD
4 185.115.164.59 16 HIGH malware c2 Philippines Sunbridge worldwide LTD
5 195.178.110.30 16 MEDIUM ssh bruteforce Bulgaria Techoff Srv Limited
6 185.115.164.60 15 HIGH malware c2 Philippines Sunbridge worldwide LTD
7 147.93.191.75 13 HIGH malware c2 United States Contabo Inc.
8 103.11.41.19 11 HIGH malware c2 Philippines Sunbridge worldwide LTD
9 159.89.133.65 10 MEDIUM ssh bruteforce United States DigitalOcean, LLC
10 172.94.18.103 9 HIGH malware c2 Germany M247 Europe SRL
11 102.220.160.222 9 HIGH malware c2 Slovenia VPS Dedicated LLC
12 31.57.184.154 9 HIGH malware c2 United States VPS Dedicated LLC
13 117.72.39.83 9 HIGH malware c2 China China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch
14 80.94.92.128 8 MEDIUM generic bruteforce Romania Unmanaged Ltd
15 116.198.233.179 7 HIGH malware c2 China CHINATELECOM Jiangsu Suqian IDC network
16 155.103.69.30 7 HIGH malware c2 United States Fiba Cloud Operation Company, LLC
17 141.98.10.150 7 HIGH malware c2 Lithuania UAB Host Baltic
18 54.38.94.225 7 HIGH malware c2 France OVH SAS
19 155.103.71.115 7 HIGH malware c2 Türkiye Fiba Cloud Operation Company, LLC
20 31.58.179.214 7 MEDIUM ssh bruteforce United Arab Emirates —
21 216.9.225.38 7 HIGH malware c2 United States Fiba Cloud Operation Company, LLC
22 157.20.182.18 6 HIGH malware c2 The Netherlands Hosterdaddy Private Limited
23 101.36.104.242 6 MEDIUM ssh bruteforce Japan UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED
24 81.70.21.248 6 HIGH malware c2 China Shenzhen Tencent Computer Systems Company Limited
25 209.200.246.194 6 HIGH malware c2 Canada Regxa Company for Information Technology Ltd
26 37.72.172.58 6 HIGH malware c2 United States HIVELOCITY, Inc.
27 198.23.185.136 6 HIGH malware c2 United States NOHAVPS LLC
28 103.142.147.18 6 HIGH malware c2 Hong Kong 19 Chun Wang Street, Tseung Kwan O Industrial Estate, N.T. Hong Kong
29 85.206.168.238 5 HIGH malware c2 Lithuania Informacines sistemos ir technologijos, UAB
30 27.102.137.139 5 HIGH malware c2 South Korea DAOU TECHNOLOGY
31 80.94.92.234 5 MEDIUM ssh bruteforce Romania Unmanaged Ltd
32 104.243.248.63 5 HIGH malware c2 Germany Voxility LLP
33 119.45.160.160 5 HIGH malware c2 China Shenzhen Tencent Computer Systems Company Limited
34 89.42.134.220 5 HIGH malware c2 Italy NetJoin srl
35 159.203.1.105 5 HIGH malware c2 Canada DigitalOcean, LLC
36 217.60.195.194 5 HIGH malware c2 United Arab Emirates Swissnet LLC
37 179.43.186.214 5 HIGH malware c2 Switzerland Private Layer INC
38 157.20.182.17 5 HIGH malware c2 The Netherlands Hosterdaddy Private Limited
39 51.222.87.16 5 HIGH malware c2 Canada OVH SAS
40 107.173.9.99 5 HIGH malware c2 United States HostPapa
41 45.87.53.6 5 HIGH malware c2 Singapore STAR FAX GROUP PTE LTD
42 20.243.208.191 5 HIGH ssh bruteforce Japan Microsoft Corporation
43 195.178.110.232 5 MEDIUM ssh bruteforce Bulgaria Techoff Srv Limited
44 195.178.110.137 5 MEDIUM ssh bruteforce Bulgaria Techoff Srv Limited
45 172.245.195.233 5 HIGH malware c2 United States HostPapa
46 154.219.115.123 5 HIGH malware c2 Hong Kong cognetcloud INC
47 101.109.26.14 4 HIGH reconnaissance Thailand TOT Public Company Limited
48 1.24.16.65 4 HIGH reconnaissance China CHINA UNICOM China169 Backbone
49 101.109.32.150 4 HIGH reconnaissance Thailand TOT Public Company Limited
50 101.109.27.1 4 HIGH reconnaissance Thailand TOT Public Company Limited

About This Data

This ranking is compiled from abuse reports submitted by a network of verified threat reporters, automated monitoring systems, and threat intelligence feeds including curated blocklists, community abuse databases, and malware trackers. IP addresses that appear on this list have been independently verified by multiple sources. The data updates in real-time and reflects the most actively malicious IP addresses targeting internet infrastructure worldwide.

Use the WAYSCloud API to check any IP address programmatically, or search directly using the threat intelligence dashboard.

Latest Cyber Attacks → ASN Threat Ranking → Country Risk Trends → Country Threat Ranking → Live Threat Map → AI Threat Forecast →