Know who's knocking before you open the door.

Instant IP threat intelligence from 73 honeypots and 22+ threat feeds.

Your public IP is 216.73.216.50. Press Lookup for an instant threat-intelligence report — geolocation, ISP, blacklist presence, Tor / proxy / hosting flags, and a threat score.

Or try one of these:
Google DNS 8.8.8.8 Known scanner 167.94.138.49 Tor exit node 185.220.101.1
Lookup an IP
Geolocation, ISP, blacklist presence and threat score for any IPv4 or IPv6 address.
Download a blocklist
Country, category and full malicious-IP feeds in plaintext, CSV and JSON.
Get an API key
Free REST API for IP enrichment and bulk lookups — OpenAPI 3.1, Swagger UI.

73 honeypots 22+ threat feeds 101,079,414 IPs analysed refreshed every 4 hours

Independently operated · Methodology public · No data resale · Supported by UK Cyber Defence Ltd

Live threat intelligence — what the platform is currently watching

The numbers below are not marketing copy. They are the live counters from a network of 73 honeypots, tarpits and deception devices, cross-referenced against major blocklists and threat-intelligence feeds.

7,888
Attackers, last 4 hours
650,186
Malicious IPs listed
220
Countries observed
2026-08-27 12:03Z
Last refresh (UTC)

Recent malicious IPs

Live · connecting

Brand-new attackers picked up by the sensor estate in the last 60 minutes, in priority order. Country, category and threat score for each address; the page updates visibly without a reload.

IP Country Category Threat First seen Last seen
79.139.115.233 Poland Network Attack 100
79.139.115.139 Poland Network Attack 100
79.139.115.51 Poland Network Attack 100
79.139.115.254 Poland Network Attack 100
79.139.115.222 Poland Network Attack 100
79.139.114.173 Poland Network Attack 100
79.139.115.149 Poland Network Attack 100
79.139.113.71 Poland Network Attack 100
79.139.113.7 Poland Network Attack 100
79.139.114.96 Poland Network Attack 100
79.139.115.72 Poland Network Attack 100
79.139.114.210 Poland Network Attack 100
79.139.114.193 Poland Network Attack 100
79.139.113.122 Poland Network Attack 100
185.67.11.93 Poland Network Attack 100
185.67.11.150 Poland Network Attack 100
151.243.11.12 United Arab Emirates Network Attack 100
79.139.115.133 Poland Network Attack 100
79.139.112.210 Poland Network Attack 100
185.67.11.198 Poland Network Attack 100
When attackers are most active right now
AI Agent Traffic (Last 24 Hours) methodology v1.0
0.0%
share of observed sources classed probable or confirmed agentic in the last 24 hours
Probable: 0
Confirmed: 0
of 0 total
90-day daily trend of unique sources classed probable or confirmed. Methodology
Where attacks are coming from right now
What attackers are trying to do this week
Country league table — every country hosting malicious activity right now

Sort by listings, dominant category or recency; filter by category and risk level. Click a country to drill in.

# Country Dominant category Blacklisted IPs ▼ Risk Most recent listing
1 United States (US) malicious 86,493 Critical
2 China (CN) Network Attack 71,368 Critical
3 Poland (PL) Network Attack 50,754 Critical
4 Türkiye (TR) Network Attack 36,349 Critical
5 Brazil (BR) Network Attack 28,690 Critical
6 Vietnam (VN) Network Attack 17,103 Critical
7 Russia (RU) malicious 14,450 Critical
8 India (IN) Network Attack 12,466 Critical
9 Germany (DE) malicious 12,261 Critical
10 United Kingdom (GB) malicious 9,653 Critical
11 The Netherlands (NL) malicious 8,640 Critical
12 Belgium (BE) Network Attack 7,741 Critical
13 Hong Kong (HK) malicious 7,427 Critical
14 Singapore (SG) malicious 7,260 Critical
15 France (FR) malicious 6,927 Critical
16 Indonesia (ID) Network Attack 6,105 Critical
17 Ukraine (UA) Network Attack 5,873 Critical
18 South Korea (KR) malicious 5,572 Critical
19 Bangladesh (BD) Network Attack 5,461 Critical
20 Japan (JP) malicious 5,451 Critical
21 Pakistan (PK) Network Attack 5,314 Critical
22 Argentina (AR) Network Attack 4,805 Critical
23 Mexico (MX) Network Attack 4,722 Critical
24 Canada (CA) Network Attack 4,237 High
25 Taiwan (TW) Network Attack 3,625 High
26 Italy (IT) Network Attack 2,913 High
27 Thailand (TH) Network Attack 2,854 High
28 Sweden (SE) malicious 2,569 High
29 Spain (ES) Network Attack 2,568 High
30 Iran (IR) Network Attack 2,434 High
31 South Africa (ZA) Network Attack 2,173 High
32 Colombia (CO) Network Attack 2,136 High
33 Australia (AU) Network Attack 2,129 High
34 Malaysia (MY) malicious 2,056 High
35 Seychelles (SC) malicious 1,982 High
36 Ireland (IE) Network Attack 1,978 High
37 Switzerland (CH) Network Attack 1,775 High
38 Bulgaria (BG) malicious 1,601 High
39 Uzbekistan (UZ) malicious 1,357 High
40 Philippines (PH) Network Attack 1,310 High
41 Chile (CL) Network Attack 1,304 High
42 Saudi Arabia (SA) Network Attack 1,247 High
43 Romania (RO) malicious 1,198 High
44 Finland (FI) malicious 1,159 High
45 United Arab Emirates (AE) Network Attack 1,145 High
46 Egypt (EG) Network Attack 1,090 High
47 Israel (IL) Network Attack 1,086 High
48 Morocco (MA) Network Attack 963 High
49 Portugal (PT) malicious 952 High
50 Ecuador (EC) Network Attack 903 High
51 Venezuela (VE) Network Attack 850 High
52 Kenya (KE) Network Attack 769 High
53 Republic of Lithuania (LT) malicious 708 High
54 Croatia (HR) Network Attack 656 High
55 Kazakhstan (KZ) Network Attack 653 High
56 Uruguay (UY) Network Attack 644 Medium
57 Czechia (CZ) Network Attack 617 Medium
58 Iraq (IQ) malicious 595 Medium
59 Republic of Moldova (MD) malicious 593 Medium
60 Nigeria (NG) Network Attack 593 Medium
61 Austria (AT) malicious 588 Medium
62 Peru (PE) Network Attack 560 Medium
63 Norway (NO) Network Attack 550 Medium
64 Denmark (DK) Network Attack 494 Medium
65 Hungary (HU) malicious 446 Medium
66 Algeria (DZ) Network Attack 440 Medium
67 Greece (GR) Network Attack 421 Medium
68 Tanzania (TZ) Network Attack 393 Medium
69 Tunisia (TN) Network Attack 392 Medium
70 Dominican Republic (DO) Network Attack 376 Medium
71 Azerbaijan (AZ) Network Attack 371 Medium
72 Georgia (GE) Network Attack 365 Medium
73 Nepal (NP) Network Attack 357 Medium
74 Mauritius (MU) Network Attack 356 Medium
75 Slovenia (SI) Network Attack 354 Medium
76 Latvia (LV) malicious 348 Medium
77 Cambodia (KH) Network Attack 311 Medium
78 Armenia (AM) Network Attack 302 Medium
79 Bolivia (BO) Network Attack 300 Medium
80 Turkmenistan (TM) malicious 285 Medium
81 Myanmar (MM) Network Attack 280 Medium
82 New Zealand (NZ) Network Attack 274 Medium
83 Sri Lanka (LK) Network Attack 269 Medium
84 Serbia (RS) Network Attack 259 Medium
85 Qatar (QA) Network Attack 258 Medium
86 Senegal (SN) Network Attack 253 Medium
87 Panama (PA) Network Attack 234 Medium
88 Albania (AL) Network Attack 229 Medium
89 Palestine (PS) Network Attack 226 Medium
90 Paraguay (PY) Network Attack 222 Medium
91 Costa Rica (CR) Network Attack 213 Medium
92 Ethiopia (ET) Network Attack 209 Medium
93 Jordan (JO) Network Attack 209 Medium
94 Belarus (BY) Network Attack 208 Medium
95 Ghana (GH) malicious 192 Medium
96 British Virgin Islands (VG) malicious 192 Medium
97 Oman (OM) Network Attack 190 Medium
98 Estonia (EE) malicious 180 Medium
99 Cyprus (CY) Network Attack 170 Medium
100 Luxembourg (LU) Network Attack 168 Medium
101 Mongolia (MN) Network Attack 167 Medium
102 Slovakia (SK) malicious 161 Medium
103 North Macedonia (MK) Network Attack 160 Medium
104 Honduras (HN) Network Attack 159 Medium
105 Bahrain (BH) Network Attack 158 Medium
106 Kuwait (KW) Network Attack 156 Medium
107 Syria (SY) Network Attack 147 Medium
108 Ivory Coast (CI) Network Attack 137 Medium
109 Iceland (IS) malicious 132 Medium
110 Guatemala (GT) Network Attack 127 Low
111 Burkina Faso (BF) Network Attack 113 Low
112 Puerto Rico (PR) Network Attack 113 Low
113 Uganda (UG) malicious 113 Low
114 Bosnia and Herzegovina (BA) malicious 105 Low
115 Botswana (BW) malicious 102 Low
116 Lebanon (LB) Network Attack 99 Low
117 Laos (LA) Network Attack 96 Low
118 Trinidad and Tobago (TT) Network Attack 95 Low
119 Angola (AO) Network Attack 91 Low
120 Kyrgyzstan (KG) Network Attack 88 Low
121 Macao (MO) Network Attack 86 Low
122 Mozambique (MZ) Network Attack 84 Low
123 Belize (BZ) Network Attack 82 Low
124 Cameroon (CM) malicious 78 Low
125 Jamaica (JM) Network Attack 78 Low
126 Togo (TG) Network Attack 71 Low
127 El Salvador (SV) Network Attack 67 Low
128 Zambia (ZM) Network Attack 66 Low
129 Kosovo (XK) Network Attack 62 Low
130 Malta (MT) Network Attack 61 Low
131 Libya (LY) malicious 60 Low
132 Zimbabwe (ZW) Network Attack 59 Low
133 Congo Republic (CG) Network Attack 57 Low
134 Mali (ML) Network Attack 51 Low
135 Rwanda (RW) Network Attack 51 Low
136 Maldives (MV) Network Attack 48 Low
137 Namibia (NA) Network Attack 45 Low
138 Tajikistan (TJ) Network Attack 44 Low
139 Nicaragua (NI) Network Attack 43 Low
140 Réunion (RE) Network Attack 38 Low
141 Benin (BJ) malicious 37 Low
142 Madagascar (MG) Network Attack 36 Low
143 Gabon (GA) Network Attack 35 Low
144 Afghanistan (AF) malicious 33 Low
145 Liberia (LR) Network Attack 32 Low
146 Barbados (BB) Network Attack 31 Low
147 Guadeloupe (GP) Network Attack 31 Low
148 Brunei (BN) malicious 28 Low
149 Congo (DRC) (CD) Network Attack 28 Low
150 Montenegro (ME) malicious 28 Low
151 Yemen (YE) malicious 28 Low
152 Monaco (MC) malicious 27 Low
153 Guam (GU) Network Attack 26 Low
154 Bhutan (BT) malicious 24 Low
155 Fiji (FJ) Network Attack 23 Low
156 Gambia (GM) Network Attack 22 Low
157 Andorra (AD) Network Attack 21 Low
158 Guyana (GY) Network Attack 21 Low
159 Martinique (MQ) Network Attack 21 Low
160 New Caledonia (NC) Network Attack 21 Low
161 Haiti (HT) Network Attack 20 Low
162 Liechtenstein (LI) tor_exit 18 Low
163 Suriname (SR) Network Attack 17 Low
164 Djibouti (DJ) Network Attack 16 Low
165 French Polynesia (PF) Network Attack 16 Low
166 Sint Maarten (SX) Network Attack 16 Low
167 Lesotho (LS) Network Attack 15 Low
168 Cabo Verde (CV) Network Attack 14 Low
169 Cayman Islands (KY) Network Attack 14 Low
170 Malawi (MW) Network Attack 14 Low
171 Somalia (SO) malicious 14 Low
172 Curaçao (CW) Network Attack 13 Low
173 French Guiana (GF) Network Attack 13 Low
174 Bahamas (BS) Network Attack 11 Low
175 Mauritania (MR) malicious 11 Low
176 Isle of Man (IM) malicious 9 Low
177 Grenada (GD) Network Attack 8 Low
178 Sudan (SD) malicious 8 Low
179 Eritrea (ER) malicious 7 Low
180 Niger (NE) Network Attack 7 Low
181 Papua New Guinea (PG) Network Attack 7 Low
182 Antigua and Barbuda (AG) malicious 6 Low
183 Mayotte (YT) Network Attack 6 Low
184 American Samoa (AS) Network Attack 5 Low
185 Burundi (BI) malicious 5 Low
186 Eswatini (SZ) malicious 5 Low
187 Timor-Leste (TL) Network Attack 5 Low
188 U.S. Virgin Islands (VI) Network Attack 5 Low
189 Dominica (DM) malicious 4 Low
190 Guernsey (GG) Network Attack 4 Low
191 Equatorial Guinea (GQ) Network Attack 4 Low
192 Jersey (JE) Network Attack 4 Low
193 Solomon Islands (SB) Network Attack 4 Low
194 Chad (TD) Network Attack 4 Low
195 Vanuatu (VU) Network Attack 4 Low
196 Greenland (GL) Network Attack 3 Low
197 Guinea (GN) Network Attack 3 Low
198 Comoros (KM) Network Attack 3 Low
199 Sierra Leone (SL) Network Attack 3 Low
200 South Sudan (SS) Network Attack 3 Low
201 Samoa (WS) Network Attack 3 Low
202 Aruba (AW) Network Attack 2 Low
203 Åland Islands (AX) malicious 2 Low
204 Bermuda (BM) Network Attack 2 Low
205 Cuba (CU) Network Attack 2 Low
206 Faroe Islands (FO) malicious 2 Low
207 Kiribati (KI) Network Attack 2 Low
208 Saint Kitts and Nevis (KN) Network Attack 2 Low
209 Tonga (TO) Network Attack 2 Low
210 Saint Vincent and the Grenadines (VC) Network Attack 2 Low
211 Anguilla (AI) Network Attack 1 Low
212 Bonaire, Sint Eustatius and Saba (BQ) malicious 1 Low
213 Central African Republic (CF) Network Attack 1 Low
214 Gibraltar (GI) Network Attack 1 Low
215 Saint Lucia (LC) Network Attack 1 Low
216 Northern Mariana Islands (MP) Network Attack 1 Low
217 Saint Pierre and Miquelon (PM) Network Attack 1 Low
Integrates with
Wazuh Graylog Sentinel Splunk pfSense OPNsense Suricata NGINX Fail2ban CrowdSec Cloudflare WAF Cloudflare Workers n8n TheHive Home Assistant
Latest research

All research

How we measure threats

Every score on the platform is rooted in a public methodology: 73 honeypots and tarpits across multiple regions, cross-referenced with 22+ open-source feeds and refreshed every four hours. We publish the signals, the cadence and the caveats so you can replicate our maths.

Read the methodology

Brute-force activity — this week vs. last week
80,561 unique attackers
in the last 7 days (vs. 52,281 the week before)
+54.1%
week-over-week change
ASN & ISP league table — top 20 networks hosting malicious activity

Networks ranked by the number of currently-flagged IPs they host. Click an ASN for the full profile.

# ASN Network / ISP Malicious IPs Risk score
1 AS4837 CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN 26,363 35 medium
2 AS4134 No.31,Jin-rong Street 22,955 21 low
3 AS396982 GOOGLE-CLOUD-PLATFORM, US 13,960 50 high
4 AS16509 Amazon.com, Inc. 12,261 38 medium
5 AS13335 CLOUDFLARENET, US 8,358 73 critical
6 AS45102 ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN 8,339 44 medium
7 AS14061 DigitalOcean, LLC 6,754 14 low
8 AS14618 Amazon.com, Inc. 6,164 55 high
9 AS8075 MICROSOFT-CORP-MSN-AS-BLOCK, US 6,071 47 medium
10 AS41931 EURONET-AS, PL 5,358 100 critical
11 AS50467 BESKID-MEDIA-AS, PL 5,253 100 critical
12 AS50188 KOLNET Sp. z o.o. 5,205 100 critical
13 AS6823 TR-3C1B-TELEKOM, TR 4,165 100 critical
14 AS42910 PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR 3,727 100 critical
15 AS62425 Mailbox Internet Hizmetleri Ltd. Sti. 3,575 100 critical
16 AS135905 VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN 3,438 95 critical
17 AS37963 Hangzhou Alibaba Advertising Co.,Ltd. 3,091 38 medium
18 AS14789 CLOUDFLARENET-A, US 3,048 82 critical
19 AS202281 C3 NET Sp. z o.o. Sp. k. 2,964 100 critical
20 AS6205 HIZLINET-TEKNOLOJI, TR 2,867 100 critical
Weekly digest — by email

A short Monday-morning email summarising the headline movements: brute-force trend, the ASN league table, the noisiest categories, and the IPs propagating fastest across the sensor estate. Opt in, unsubscribe with one click.

Embeddable badge

Drop this badge into your blog or status page — it always shows the live count:

Powered by ipinsights.io — 107,164 IPs blocked this week