Top Malicious IP Addresses — Last 7 Days
These are the 50 most frequently reported IP addresses over the past week, ranked by the number of independent abuse reports received from our threat intelligence network. Each IP has been flagged by automated threat detection systems and verified reporters.
Note: The 7d view is currently in beta. For the most accurate and fastest results, use the 24-hour view which is powered by a dedicated materialized view refreshed every 5 minutes.
| # | IP Address | Reports | Severity | Categories | Country | Network |
|---|---|---|---|---|---|---|
| 1 | 185.199.111.133 | 12919 | HIGH | malware c2 | United States | Fastly, Inc. |
| 2 | 185.199.108.133 | 12919 | HIGH | malware c2 | United States | Fastly, Inc. |
| 3 | 185.199.109.133 | 12916 | HIGH | malware c2 | United States | Fastly, Inc. |
| 4 | 185.199.110.133 | 12224 | HIGH | malware c2 | United States | Fastly, Inc. |
| 5 | 4.208.26.197 | 1647 | HIGH | malware c2 | Ireland | Microsoft Corporation |
| 6 | 68.209.56.42 | 1141 | MEDIUM | generic bruteforce,high threat,intrusion attempt,ssh bruteforce,suspicious activity,tcp scan | The Netherlands | B2 Net Solutions Inc. |
| 7 | 196.244.192.202 | 935 | MEDIUM | high threat,suspicious activity,tcp scan | Finland | Orion Network Limited |
| 8 | 172.65.251.78 | 667 | HIGH | malware c2 | — | Cloudflare, Inc. |
| 9 | 142.93.136.140 | 637 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | The Netherlands | DigitalOcean, LLC |
| 10 | 45.148.10.230 | 616 | MEDIUM | high threat,suspicious activity,tcp scan | The Netherlands | Techoff Srv Limited |
| 11 | 213.209.159.25 | 414 | MEDIUM | high threat,suspicious activity,tcp scan | Germany | Feo Prest SRL |
| 12 | 2.57.122.53 | 406 | MEDIUM | generic bruteforce,high threat,malware distribution,repeat offender,ssh bruteforce,suspicious activity,tcp scan,web attack | Romania | Unmanaged Ltd |
| 13 | 213.209.159.26 | 400 | MEDIUM | high threat,suspicious activity,tcp scan | Germany | Feo Prest SRL |
| 14 | 62.60.130.219 | 392 | MEDIUM | malware distribution,suspicious activity,tcp scan | Iran | Cipher Operations Doo Beograd - Novi Beograd |
| 15 | 118.91.187.183 | 366 | MEDIUM | generic bruteforce,high threat,intrusion attempt,ssh bruteforce,suspicious activity,tcp scan | The Netherlands | iFog GmbH |
| 16 | 51.158.205.203 | 344 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | The Netherlands | Scaleway SAS |
| 17 | 62.60.130.148 | 332 | MEDIUM | malware distribution,suspicious activity,tcp scan | Iran | Cipher Operations Doo Beograd - Novi Beograd |
| 18 | 2.57.122.238 | 329 | MEDIUM | high threat,malware distribution,ssh bruteforce,suspicious activity,tcp scan | Romania | Unmanaged Ltd |
| 19 | 79.124.56.214 | 304 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | Bulgaria | Tamatiya EOOD |
| 20 | 80.94.95.109 | 301 | MEDIUM | high threat,intrusion attempt,malware distribution,suspicious activity,tcp scan | Romania | SS-Net |
| 21 | 193.32.162.84 | 282 | MEDIUM | high threat,malware distribution,ssh bruteforce,suspicious activity,tcp scan | Romania | Unmanaged Ltd |
| 22 | 94.154.43.57 | 278 | MEDIUM | generic bruteforce,high threat,malware distribution,moderate threat,ssh bruteforce,suspicious activity,tcp scan | The Netherlands | Storm Industries LLC |
| 23 | 45.148.10.240 | 276 | MEDIUM | high threat,ssh bruteforce,tcp scan | The Netherlands | Techoff Srv Limited |
| 24 | 178.105.200.202 | 272 | MEDIUM | high threat,suspicious activity,tcp scan | Germany | Hetzner Online GmbH |
| 25 | 80.94.92.55 | 271 | MEDIUM | generic bruteforce,high threat,malware distribution,repeat offender,ssh bruteforce,tcp scan | Romania | Unmanaged Ltd |
| 26 | 80.94.92.234 | 268 | MEDIUM | generic bruteforce,high threat,malware distribution,ssh bruteforce,tcp scan,web attack | Romania | Unmanaged Ltd |
| 27 | 77.239.124.130 | 265 | MEDIUM | high threat,malware distribution,tcp scan | United States | Banatsync Srl |
| 28 | 2.57.122.150 | 259 | MEDIUM | high threat,malware distribution,repeat offender,ssh bruteforce,tcp scan | Romania | Unmanaged Ltd |
| 29 | 176.32.193.16 | 259 | MEDIUM | high threat,malware distribution,tcp scan | Armenia | Ucom CJSC |
| 30 | 156.225.1.10 | 255 | MEDIUM | high threat,suspicious activity,tcp scan | Hong Kong | AGOTOZ PTE. LTD. |
| 31 | 80.94.92.179 | 254 | MEDIUM | generic bruteforce,high threat,malware distribution,repeat offender,ssh bruteforce,tcp scan,web attack | Romania | Unmanaged Ltd |
| 32 | 2.57.122.168 | 253 | MEDIUM | high threat,malware distribution,tcp scan | Romania | Unmanaged Ltd |
| 33 | 71.6.199.23 | 248 | MEDIUM | high threat,malware distribution,tcp scan | United States | CariNet, Inc. |
| 34 | 66.240.205.34 | 248 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | United States | CariNet, Inc. |
| 35 | 80.82.77.139 | 247 | MEDIUM | high threat,malware distribution,tcp scan | The Netherlands | IP Volume inc |
| 36 | 207.90.244.17 | 247 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | United States | Cogent Communications, LLC |
| 37 | 207.90.244.18 | 246 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | United States | Cogent Communications, LLC |
| 38 | 207.90.244.19 | 245 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | United States | Cogent Communications, LLC |
| 39 | 93.174.95.106 | 244 | MEDIUM | high threat,malware distribution,tcp scan | The Netherlands | IP Volume inc |
| 40 | 94.154.43.63 | 244 | MEDIUM | generic bruteforce,high threat,intrusion attempt,malware distribution,moderate threat,ssh bruteforce,suspicious activity,tcp scan | The Netherlands | Storm Industries LLC |
| 41 | 193.46.255.86 | 243 | MEDIUM | high threat,malware distribution,ssh bruteforce,tcp scan | Romania | Unmanaged Ltd |
| 42 | 89.248.167.131 | 243 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | The Netherlands | IP Volume inc |
| 43 | 156.225.1.87 | 243 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | Hong Kong | AGOTOZ PTE. LTD. |
| 44 | 156.225.1.98 | 241 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | Hong Kong | AGOTOZ PTE. LTD. |
| 45 | 31.184.195.246 | 241 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | Russia | Petersburg Internet Network ltd. |
| 46 | 45.91.64.7 | 241 | MEDIUM | high threat,malware distribution,tcp scan | Russia | JSC F6 |
| 47 | 71.6.135.131 | 240 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | United States | CariNet, Inc. |
| 48 | 80.82.77.33 | 239 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | The Netherlands | IP Volume inc |
| 49 | 156.225.1.99 | 237 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | Hong Kong | AGOTOZ PTE. LTD. |
| 50 | 207.90.244.12 | 237 | MEDIUM | high threat,malware distribution,suspicious activity,tcp scan | United States | Cogent Communications, LLC |
About This Data
This ranking is compiled from abuse reports submitted by a network of verified threat reporters, automated monitoring systems, and threat intelligence feeds including curated blocklists, community abuse databases, and malware trackers. IP addresses that appear on this list have been independently verified by multiple sources. The data updates in real-time and reflects the most actively malicious IP addresses targeting internet infrastructure worldwide.
Use the WAYSCloud API to check any IP address programmatically, or search directly using the threat intelligence dashboard.