Top Malicious IP Addresses — Last 30 Days
These are the 50 most frequently reported IP addresses over the past 30 days, ranked by the number of independent abuse reports received from our threat intelligence network. Each IP has been flagged by automated threat detection systems and verified reporters.
Note: The 30d view is currently in beta. For the most accurate and fastest results, use the 24-hour view which is powered by a dedicated materialized view refreshed every 5 minutes.
| # | IP Address | Reports | Severity | Categories | Country | Network |
|---|---|---|---|---|---|---|
| 1 | 185.199.111.133 | 12978 | HIGH | malware c2 | United States | Fastly, Inc. |
| 2 | 185.199.108.133 | 12978 | HIGH | malware c2 | United States | Fastly, Inc. |
| 3 | 185.199.109.133 | 12975 | HIGH | malware c2 | United States | Fastly, Inc. |
| 4 | 185.199.110.133 | 12283 | HIGH | malware c2 | United States | Fastly, Inc. |
| 5 | 196.244.192.202 | 2995 | MEDIUM | generic bruteforce,high threat,intrusion attempt,malware distribution,ssh bruteforce,suspicious activity,tcp scan | Finland | Orion Network Limited |
| 6 | 45.148.10.230 | 2439 | MEDIUM | high threat,suspicious activity,tcp scan | The Netherlands | Techoff Srv Limited |
| 7 | 142.93.136.140 | 2423 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | The Netherlands | DigitalOcean, LLC |
| 8 | 80.94.92.128 | 2012 | MEDIUM | botnet c2,generic bruteforce,high threat,intrusion attempt,malware distribution,repeat offender,ssh bruteforce,suspicious activity,tcp scan | Romania | Unmanaged Ltd |
| 9 | 4.208.26.197 | 1713 | HIGH | malware c2 | Ireland | Microsoft Corporation |
| 10 | 213.209.159.25 | 1705 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | Germany | Feo Prest SRL |
| 11 | 195.178.110.30 | 1619 | MEDIUM | high threat,malware distribution,ssh bruteforce,suspicious activity,tcp scan | Bulgaria | Techoff Srv Limited |
| 12 | 213.209.159.26 | 1572 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | Germany | Feo Prest SRL |
| 13 | 62.60.130.219 | 1569 | MEDIUM | malware distribution,suspicious activity,tcp scan | Iran | Cipher Operations Doo Beograd - Novi Beograd |
| 14 | 2.57.122.238 | 1500 | MEDIUM | high threat,malware distribution,moderate threat,repeat offender,ssh bruteforce,suspicious activity,tcp scan | Romania | Unmanaged Ltd |
| 15 | 62.60.130.148 | 1495 | MEDIUM | malware distribution,suspicious activity,tcp scan | Iran | Cipher Operations Doo Beograd - Novi Beograd |
| 16 | 68.209.56.42 | 1486 | MEDIUM | generic bruteforce,high threat,intrusion attempt,ssh bruteforce,suspicious activity,tcp scan | The Netherlands | B2 Net Solutions Inc. |
| 17 | 93.123.109.6 | 1449 | MEDIUM | high threat,intrusion attempt,malware distribution,suspicious activity,tcp scan | Bulgaria | Techoff Srv Limited |
| 18 | 51.158.205.203 | 1446 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | The Netherlands | Scaleway SAS |
| 19 | 2.57.122.53 | 1289 | MEDIUM | generic bruteforce,high threat,malware distribution,repeat offender,ssh bruteforce,suspicious activity,tcp scan,web attack | Romania | Unmanaged Ltd |
| 20 | 178.105.200.202 | 1199 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | Germany | Hetzner Online GmbH |
| 21 | 94.154.43.69 | 1166 | MEDIUM | high threat,malware distribution,moderate threat,ssh bruteforce,suspicious activity,tcp scan | The Netherlands | Storm Industries LLC |
| 22 | 156.225.1.10 | 1133 | MEDIUM | high threat,suspicious activity,tcp scan | Hong Kong | AGOTOZ PTE. LTD. |
| 23 | 80.94.92.55 | 1114 | MEDIUM | generic bruteforce,high threat,malware distribution,repeat offender,ssh bruteforce,tcp scan | Romania | Unmanaged Ltd |
| 24 | 193.32.162.84 | 1110 | MEDIUM | high threat,malware distribution,ssh bruteforce,suspicious activity,tcp scan | Romania | Unmanaged Ltd |
| 25 | 2.57.122.209 | 1088 | MEDIUM | high threat,malware distribution,ssh bruteforce,tcp scan | Romania | Unmanaged Ltd |
| 26 | 77.239.124.130 | 1077 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | United States | Banatsync Srl |
| 27 | 176.32.193.16 | 1067 | MEDIUM | high threat,malware distribution,tcp scan | Armenia | Ucom CJSC |
| 28 | 193.187.110.214 | 1066 | MEDIUM | generic bruteforce,high threat,intrusion attempt,malware distribution,moderate threat,sip bruteforce,ssh bruteforce,suspicious activity,tcp scan | Türkiye | FAST ZONE IT |
| 29 | 80.94.92.179 | 1054 | MEDIUM | generic bruteforce,high threat,malware distribution,repeat offender,ssh bruteforce,tcp scan,web attack | Romania | Unmanaged Ltd |
| 30 | 2.57.122.150 | 1053 | MEDIUM | generic bruteforce,high threat,malware distribution,repeat offender,ssh bruteforce,tcp scan,web attack | Romania | Unmanaged Ltd |
| 31 | 156.225.1.87 | 1042 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | Hong Kong | AGOTOZ PTE. LTD. |
| 32 | 94.154.43.223 | 1041 | MEDIUM | high threat,malware distribution,moderate threat,ssh bruteforce,suspicious activity,tcp scan | The Netherlands | Storm Industries LLC |
| 33 | 66.240.205.34 | 1039 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | United States | CariNet, Inc. |
| 34 | 93.174.95.106 | 1033 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | The Netherlands | IP Volume inc |
| 35 | 2.57.122.168 | 1029 | MEDIUM | high threat,malware distribution,ssh bruteforce,suspicious activity,tcp scan | Romania | Unmanaged Ltd |
| 36 | 71.6.199.23 | 1029 | MEDIUM | high threat,malware distribution,tcp scan | United States | CariNet, Inc. |
| 37 | 71.6.135.131 | 1024 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | United States | CariNet, Inc. |
| 38 | 80.82.77.33 | 1019 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | The Netherlands | IP Volume inc |
| 39 | 207.90.244.17 | 1018 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | United States | Cogent Communications, LLC |
| 40 | 156.225.1.99 | 1016 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | Hong Kong | AGOTOZ PTE. LTD. |
| 41 | 45.148.10.188 | 1015 | MEDIUM | generic bruteforce,high threat,intrusion attempt,ssh bruteforce,suspicious activity,tcp scan | The Netherlands | Techoff Srv Limited |
| 42 | 207.90.244.19 | 1015 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | United States | Cogent Communications, LLC |
| 43 | 80.82.77.139 | 1015 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | The Netherlands | IP Volume inc |
| 44 | 156.225.1.98 | 1010 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | Hong Kong | AGOTOZ PTE. LTD. |
| 45 | 207.90.244.18 | 1009 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | United States | Cogent Communications, LLC |
| 46 | 207.90.244.12 | 1007 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | United States | Cogent Communications, LLC |
| 47 | 45.91.64.7 | 1007 | MEDIUM | high threat,malware distribution,tcp scan | Russia | JSC F6 |
| 48 | 45.91.64.6 | 1002 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | Russia | JSC F6 |
| 49 | 80.94.92.234 | 1002 | MEDIUM | generic bruteforce,high threat,malware distribution,repeat offender,ssh bruteforce,suspicious activity,tcp scan,web attack | Romania | Unmanaged Ltd |
| 50 | 207.90.244.28 | 1001 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | United States | Cogent Communications, LLC |
About This Data
This ranking is compiled from abuse reports submitted by a network of verified threat reporters, automated monitoring systems, and threat intelligence feeds including curated blocklists, community abuse databases, and malware trackers. IP addresses that appear on this list have been independently verified by multiple sources. The data updates in real-time and reflects the most actively malicious IP addresses targeting internet infrastructure worldwide.
Use the WAYSCloud API to check any IP address programmatically, or search directly using the threat intelligence dashboard.