Top Malicious IP Addresses — Last 24 Hours

These are the 50 most frequently reported IP addresses in the last 24 hours, ranked by the number of independent abuse reports received from our threat intelligence network. Each IP has been flagged by automated threat detection systems and verified reporters.

24 Hours 7 Days 30 Days
# IP Address Reports Severity Categories Country Network
1 80.94.92.128 45 MEDIUM ssh bruteforce Romania Unmanaged Ltd
2 182.23.2.163 31 HIGH malware c2 Indonesia PT Aplikanusa Lintasarta
3 185.242.3.195 17 MEDIUM ssh bruteforce The Netherlands Netiface America, Inc.
4 103.11.41.20 14 HIGH malware c2 Philippines Sunbridge worldwide LTD
5 147.93.191.75 13 HIGH malware c2 United States Contabo Inc.
6 45.148.10.157 13 HIGH ssh bruteforce The Netherlands Techoff Srv Limited
7 103.11.41.10 13 HIGH malware c2 Philippines Sunbridge worldwide LTD
8 80.94.92.128 12 MEDIUM generic bruteforce Romania Unmanaged Ltd
9 176.53.159.198 12 HIGH ssh bruteforce Türkiye ZORNTECH WEB SOLUTIONS
10 45.227.254.170 11 HIGH ssh bruteforce Panama Flyservers S.A.
11 45.148.10.151 11 HIGH ssh bruteforce The Netherlands Techoff Srv Limited
12 195.178.110.137 11 MEDIUM ssh bruteforce Bulgaria Techoff Srv Limited
13 31.57.184.154 11 HIGH malware c2 United States VPS Dedicated LLC
14 185.115.164.60 11 HIGH malware c2 Philippines Sunbridge worldwide LTD
15 176.53.159.197 10 HIGH ssh bruteforce Türkiye ZORNTECH WEB SOLUTIONS
16 62.60.130.219 10 HIGH ssh bruteforce Iran Cipher Operations Doo Beograd - Novi Beograd
17 45.148.10.147 10 HIGH ssh bruteforce The Netherlands Techoff Srv Limited
18 102.220.160.222 10 HIGH malware c2 Slovenia VPS Dedicated LLC
19 185.115.164.59 10 HIGH malware c2 Philippines Sunbridge worldwide LTD
20 45.148.10.152 10 HIGH ssh bruteforce The Netherlands Techoff Srv Limited
21 80.94.92.179 9 MEDIUM ssh bruteforce Romania Unmanaged Ltd
22 172.94.18.103 9 HIGH malware c2 Germany M247 Europe SRL
23 172.245.195.233 8 HIGH malware c2 United States HostPapa
24 103.11.41.19 8 HIGH malware c2 Philippines Sunbridge worldwide LTD
25 94.154.43.192 8 HIGH malware c2 The Netherlands Storm Industries LLC
26 54.38.94.225 8 HIGH malware c2 France OVH SAS
27 45.148.10.141 7 HIGH ssh bruteforce The Netherlands Techoff Srv Limited
28 209.200.246.194 7 HIGH malware c2 Canada Regxa Company for Information Technology Ltd
29 141.98.10.150 7 HIGH malware c2 Lithuania UAB Host Baltic
30 155.103.71.115 7 HIGH malware c2 Türkiye Fiba Cloud Operation Company, LLC
31 80.94.92.234 6 HIGH ssh bruteforce Romania Unmanaged Ltd
32 198.23.185.136 6 HIGH malware c2 United States NOHAVPS LLC
33 172.210.53.195 6 HIGH ssh bruteforce United States Microsoft Corporation
34 92.118.39.71 5 HIGH ssh bruteforce United States Unmanaged Ltd
35 116.110.210.97 5 MEDIUM ssh bruteforce Vietnam Viettel Corporation
36 171.231.179.55 5 MEDIUM ssh bruteforce Vietnam Viettel Group
37 107.173.9.99 5 HIGH malware c2 United States HostPapa
38 194.116.236.239 5 HIGH malware c2 Türkiye Fiba Cloud Operation Company, LLC
39 159.203.35.164 5 HIGH malware c2 Canada DigitalOcean, LLC
40 96.44.167.215 5 HIGH malware c2 Canada HostPapa
41 89.42.134.220 5 HIGH malware c2 Italy NetJoin srl
42 217.60.195.194 5 HIGH malware c2 United Arab Emirates Swissnet LLC
43 165.22.109.43 5 HIGH malware c2 Singapore DigitalOcean, LLC
44 195.178.110.217 5 MEDIUM ssh bruteforce Bulgaria Techoff Srv Limited
45 207.180.250.181 5 HIGH malware c2 France Contabo GmbH
46 155.103.69.30 5 HIGH malware c2 United States Fiba Cloud Operation Company, LLC
47 1.24.16.74 4 HIGH reconnaissance China CHINA UNICOM China169 Backbone
48 101.35.29.208 4 HIGH reconnaissance China Shenzhen Tencent Computer Systems Company Limited
49 1.24.16.75 4 HIGH reconnaissance China CHINA UNICOM China169 Backbone
50 101.36.114.198 4 HIGH reconnaissance South Korea UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED

About This Data

This ranking is compiled from abuse reports submitted by a network of verified threat reporters, automated monitoring systems, and threat intelligence feeds including curated blocklists, community abuse databases, and malware trackers. IP addresses that appear on this list have been independently verified by multiple sources. The data updates in real-time and reflects the most actively malicious IP addresses targeting internet infrastructure worldwide.

Use the WAYSCloud API to check any IP address programmatically, or search directly using the threat intelligence dashboard.

Latest Cyber Attacks → ASN Threat Ranking → Country Risk Trends → Country Threat Ranking → Live Threat Map → AI Threat Forecast →