Top Malicious IP Addresses — Last 24 Hours

These are the 50 most frequently reported IP addresses in the last 24 hours, ranked by the number of independent abuse reports received from our threat intelligence network. Each IP has been flagged by automated threat detection systems and verified reporters.

24 Hours 7 Days 30 Days
# IP Address Reports Severity Categories Country Network
1 80.94.92.128 22 MEDIUM ssh bruteforce Romania Unmanaged Ltd
2 195.178.110.30 16 MEDIUM ssh bruteforce Bulgaria Techoff Srv Limited
3 104.243.248.63 15 HIGH malware c2 Germany Voxility LLP
4 124.163.212.119 15 HIGH malware c2 China CHINA UNICOM China169 Backbone
5 62.60.130.253 13 HIGH ssh bruteforce Iran Cipher Operations Doo Beograd - Novi Beograd
6 45.148.10.141 11 HIGH ssh bruteforce The Netherlands Techoff Srv Limited
7 31.57.184.154 11 HIGH malware c2 United States VPS Dedicated LLC
8 193.47.62.69 11 HIGH ssh bruteforce Bulgaria BestDC Limited
9 193.32.162.27 10 MEDIUM ssh bruteforce Romania Unmanaged Ltd
10 159.203.69.210 10 HIGH malware c2 United States DigitalOcean, LLC
11 45.148.10.151 10 HIGH ssh bruteforce The Netherlands Techoff Srv Limited
12 62.60.130.201 9 HIGH ssh bruteforce Iran Cipher Operations Doo Beograd - Novi Beograd
13 45.148.10.152 9 HIGH ssh bruteforce The Netherlands Techoff Srv Limited
14 62.60.130.242 9 HIGH ssh bruteforce Iran Cipher Operations Doo Beograd - Novi Beograd
15 43.128.113.133 9 HIGH malware c2 Singapore Tencent Building, Kejizhongyi Avenue
16 43.134.49.218 8 HIGH malware c2 Singapore Tencent Building, Kejizhongyi Avenue
17 54.38.94.225 8 HIGH malware c2 France OVH SAS
18 45.148.10.157 8 HIGH ssh bruteforce The Netherlands Techoff Srv Limited
19 176.53.159.198 8 HIGH ssh bruteforce Türkiye ZORNTECH WEB SOLUTIONS
20 45.207.213.109 8 HIGH ssh bruteforce Seychelles cognetcloud INC
21 150.109.93.78 8 HIGH malware c2 Singapore Tencent Building, Kejizhongyi Avenue
22 176.53.159.197 8 HIGH ssh bruteforce Türkiye ZORNTECH WEB SOLUTIONS
23 172.94.18.103 7 HIGH malware c2 Germany M247 Europe SRL
24 89.19.223.68 7 HIGH malware c2 Russia Sysect D.o.o.
25 27.79.1.70 7 MEDIUM ssh bruteforce Vietnam Viettel Group
26 193.32.162.15 7 MEDIUM ssh bruteforce Romania Unmanaged Ltd
27 178.254.177.119 7 HIGH ddos Germany Blockchain Creek B.V.
28 195.178.110.137 7 MEDIUM ssh bruteforce Bulgaria Techoff Srv Limited
29 116.99.170.194 7 MEDIUM ssh bruteforce Vietnam Viettel Corporation
30 80.94.92.128 7 MEDIUM generic bruteforce Romania Unmanaged Ltd
31 157.20.182.21 6 HIGH malware c2 The Netherlands Hosterdaddy Private Limited
32 195.178.110.30 6 MEDIUM generic bruteforce Bulgaria Techoff Srv Limited
33 209.99.190.23 6 HIGH malware c2 Switzerland SKN Subnet & Telecom Ltd
34 185.34.147.33 6 HIGH malware c2 United States CNServer LLC
35 130.12.182.39 6 HIGH malware c2 Slovenia VPS Dedicated LLC
36 82.165.79.60 5 HIGH malware c2 Germany IONOS SE
37 156.224.18.21 5 HIGH malware c2 Hong Kong CORENET CLOUD SDN. BHD.
38 185.199.197.93 5 HIGH malware c2 The Netherlands Local NCC Ltd.
39 186.169.88.130 5 HIGH malware c2 Colombia COLOMBIA TELECOMUNICACIONES S.A. ESP BIC
40 193.32.162.42 5 HIGH ssh bruteforce Romania Unmanaged Ltd
41 185.34.147.31 5 HIGH malware c2 United States CNServer LLC
42 45.154.244.193 5 MEDIUM ssh bruteforce Seychelles Shereverov Marat Ahmedovich
43 185.34.147.34 5 HIGH malware c2 United States CNServer LLC
44 203.98.68.17 5 HIGH malware c2 United Kingdom HosterDaddy Private Limited
45 37.72.172.58 5 HIGH malware c2 United States HIVELOCITY, Inc.
46 103.83.87.87 5 HIGH malware c2 Türkiye Fiba Cloud Operation Company, LLC
47 89.42.134.220 5 HIGH malware c2 Italy NetJoin srl
48 103.185.249.199 5 HIGH malware c2 Hong Kong cognetcloud INC
49 147.93.191.75 5 HIGH malware c2 United States Contabo Inc.
50 185.34.147.32 5 HIGH malware c2 United States CNServer LLC

About This Data

This ranking is compiled from abuse reports submitted by a network of verified threat reporters, automated monitoring systems, and threat intelligence feeds including curated blocklists, community abuse databases, and malware trackers. IP addresses that appear on this list have been independently verified by multiple sources. The data updates in real-time and reflects the most actively malicious IP addresses targeting internet infrastructure worldwide.

Use the WAYSCloud API to check any IP address programmatically, or search directly using the threat intelligence dashboard.

Latest Cyber Attacks → ASN Threat Ranking → Country Risk Trends → Country Threat Ranking → Live Threat Map → AI Threat Forecast →