Know who's knocking before you open the door.

Instant IP threat intelligence from 73 honeypots and 22+ threat feeds.

Your public IP is 216.73.217.63. Press Lookup for an instant threat-intelligence report — geolocation, ISP, blacklist presence, Tor / proxy / hosting flags, and a threat score.

Or try one of these:
Google DNS 8.8.8.8 Known scanner 167.94.138.49 Tor exit node 185.220.101.1
Lookup an IP
Geolocation, ISP, blacklist presence and threat score for any IPv4 or IPv6 address.
Download a blocklist
Country, category and full malicious-IP feeds in plaintext, CSV and JSON.
Get an API key
Free REST API for IP enrichment and bulk lookups — OpenAPI 3.1, Swagger UI.

73 honeypots 22+ threat feeds 100,775,707 IPs analysed refreshed every 4 hours

Independently operated · Methodology public · No data resale · Supported by UK Cyber Defence Ltd

Live threat intelligence — what the platform is currently watching

The numbers below are not marketing copy. They are the live counters from a network of 73 honeypots, tarpits and deception devices, cross-referenced against major blocklists and threat-intelligence feeds.

4,731
Attackers, last 4 hours
921,145
Malicious IPs listed
224
Countries observed
2026-06-09 20:03Z
Last refresh (UTC)

Recent malicious IPs

Live · refreshing every 60s

Brand-new attackers picked up by the sensor estate in the last 60 minutes, in priority order. Country, category and threat score for each address; the page updates visibly without a reload.

IP Country Category Threat First seen Last seen
177.202.14.122 Brazil Network Attack 100
177.75.155.39 Brazil Network Attack 100
45.224.0.132 Brazil Network Attack 100
37.65.66.197 France Network Attack 100
187.137.156.149 Mexico Network Attack 100
123.158.51.33 China Network Attack 100
223.199.168.124 China Network Attack 100
101.67.136.126 China Network Attack 100
8.219.97.250 Singapore Network Attack 100
47.237.68.221 Singapore Network Attack 100
51.159.7.14 France Network Attack 100
105.209.148.33 South Africa Network Attack 100
112.201.131.185 Philippines Network Attack 100
201.33.72.81 Brazil Network Attack 100
35.207.242.14 India Network Attack 100
177.23.116.185 Brazil Network Attack 100
138.84.33.39 Chile Network Attack 100
119.74.30.85 Singapore Network Attack 100
60.16.206.105 China Network Attack 100
27.8.172.187 China Network Attack 100
When attackers are most active right now
AI Agent Traffic (Last 24 Hours) methodology v1.0
0.0%
share of observed sources classed probable or confirmed agentic in the last 24 hours
Probable: 0
Confirmed: 0
of 0 total
90-day daily trend of unique sources classed probable or confirmed. Methodology
Where attacks are coming from right now
What attackers are trying to do this week
The countries hosting the most malicious activity today
Country Blacklisted IPs
Brazil (BR) 186,341
United States (US) 148,613
China (CN) 115,509
Hong Kong (HK) 88,846
Türkiye (TR) 21,245
India (IN) 13,673
Russia (RU) 12,784
Germany (DE) 11,515
United Kingdom (GB) 9,853
Seychelles (SC) 9,039
Integrates with
Wazuh Graylog Microsoft Sentinel Splunk TheHive / MISP Cloudflare WAF
Brute-force activity — this week vs. last week
59,235 unique attackers
in the last 7 days (vs. 30,526 the week before)
+94%
week-over-week change
ASN & ISP league table — top 20 networks hosting malicious activity

Networks ranked by the number of currently-flagged IPs they host. Click an ASN for the full profile.

# ASN Network / ISP Malicious IPs Risk score
1 AS400619 AROSSCLOUD INC. 46,189 99 critical
2 AS45753 NETSEC-HK Netsec Limited, HK 44,232 100 critical
3 AS133199 SONDERCLOUDLIMITED-AS-AP SonderCloud Limited, HK 43,772 100 critical
4 AS4837 CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN 42,416 72 critical
5 AS55933 CLOUDIE-AS-AP Cloudie Limited, HK 42,222 100 critical
6 AS4134 No.31,Jin-rong Street 30,195 32 medium
7 AS16509 Amazon.com, Inc. 13,240 63 high
8 AS53158 Net Turbo Telecom, BR 11,258 100 critical
9 AS52630 MOTTANET TI - SERVICOS DE TECNOLOGIA DA INFO, BR 11,254 100 critical
10 AS28634 Life Tecnologia Ltda., BR 10,921 67 high
11 AS53107 EVEO S.A., BR 10,499 81 critical
12 AS396982 GOOGLE-CLOUD-PLATFORM, US 10,225 59 high
13 AS45102 ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN 9,191 61 high
14 AS28299 LWSA SA 8,190 100 critical
15 AS263536 MICROSET MAQUINAS E SERVICOS LTDA, BR 8,098 100 critical
16 AS262740 VELOO NET LTDA, BR 7,295 67 high
17 AS262988 Pombonet Telecomunicacoes e Informatica, BR 6,418 100 critical
18 AS14061 DigitalOcean, LLC 5,487 37 medium
19 AS135386 LTG-AS-AP LinkChina Telecom Global Limited., HK 5,247 100 critical
20 AS61851 Garra Telecom Ltda, BR 5,116 99 critical
Weekly digest — by email

A short Monday-morning email summarising the headline movements: brute-force trend, the ASN league table, the noisiest categories, and the IPs propagating fastest across the sensor estate. Opt in, unsubscribe with one click.

Embeddable badge

Drop this badge into your blog or status page — it always shows the live count:

Powered by ipinsights.io — 83,841 IPs blocked this week