Know who's knocking before you open the door.

Instant IP threat intelligence from 73 honeypots and 22+ threat feeds.

Your public IP is 216.73.217.83. Press Lookup for an instant threat-intelligence report — geolocation, ISP, blacklist presence, Tor / proxy / hosting flags, and a threat score.

Or try one of these:
Google DNS 8.8.8.8 Known scanner 167.94.138.49 Tor exit node 185.220.101.1
Lookup an IP
Geolocation, ISP, blacklist presence and threat score for any IPv4 or IPv6 address.
Download a blocklist
Country, category and full malicious-IP feeds in plaintext, CSV and JSON.
Get an API key
Free REST API for IP enrichment and bulk lookups — OpenAPI 3.1, Swagger UI.

73 honeypots 22+ threat feeds 100,780,369 IPs analysed refreshed every 4 hours

Independently operated · Methodology public · No data resale · Supported by UK Cyber Defence Ltd

Live threat intelligence — what the platform is currently watching

The numbers below are not marketing copy. They are the live counters from a network of 73 honeypots, tarpits and deception devices, cross-referenced against major blocklists and threat-intelligence feeds.

5,430
Attackers, last 4 hours
927,722
Malicious IPs listed
224
Countries observed
2026-06-12 00:03Z
Last refresh (UTC)

Recent malicious IPs

Live · refreshing every 60s

Brand-new attackers picked up by the sensor estate in the last 60 minutes, in priority order. Country, category and threat score for each address; the page updates visibly without a reload.

IP Country Category Threat First seen Last seen
12.125.34.242 United States malicious 100
94.173.97.220 United Kingdom Network Attack 100
34.14.165.208 India Network Attack 100
18.144.164.78 United States Network Attack 100
66.75.233.85 United States Network Attack 100
185.172.128.30 Russia Network Attack 100
213.6.115.245 Palestine Network Attack 100
201.148.118.194 Brazil Network Attack 100
186.221.16.109 Brazil Network Attack 100
123.145.10.68 China Network Attack 100
119.48.135.192 China Network Attack 100
60.16.218.211 China Network Attack 100
118.250.51.69 China malicious 100
185.189.114.116 Hungary Network Attack 100
36.65.107.107 Indonesia Network Attack 100
142.252.234.152 United States Network Attack 100
77.111.101.160 Brazil Network Attack 100
194.32.120.218 United Kingdom Network Attack 100
41.141.170.17 Morocco Network Attack 100
84.32.41.141 United Kingdom Network Attack 100
When attackers are most active right now
AI Agent Traffic (Last 24 Hours) methodology v1.0
0.0%
share of observed sources classed probable or confirmed agentic in the last 24 hours
Probable: 0
Confirmed: 0
of 0 total
90-day daily trend of unique sources classed probable or confirmed. Methodology
Where attacks are coming from right now
What attackers are trying to do this week
The countries hosting the most malicious activity today
Country Blacklisted IPs
Brazil (BR) 186,666
United States (US) 149,208
China (CN) 115,614
Hong Kong (HK) 88,984
Türkiye (TR) 21,277
Russia (RU) 14,117
India (IN) 13,567
Germany (DE) 11,575
United Kingdom (GB) 9,896
Seychelles (SC) 9,047
Integrates with
Wazuh Graylog Microsoft Sentinel Splunk TheHive / MISP Cloudflare WAF
Brute-force activity — this week vs. last week
55,325 unique attackers
in the last 7 days (vs. 30,727 the week before)
+80.1%
week-over-week change
ASN & ISP league table — top 20 networks hosting malicious activity

Networks ranked by the number of currently-flagged IPs they host. Click an ASN for the full profile.

# ASN Network / ISP Malicious IPs Risk score
1 AS400619 AROSSCLOUD INC. 46,188 99 critical
2 AS45753 NETSEC-HK Netsec Limited, HK 44,232 100 critical
3 AS133199 SONDERCLOUDLIMITED-AS-AP SonderCloud Limited, HK 43,772 100 critical
4 AS55933 CLOUDIE-AS-AP Cloudie Limited, HK 42,223 100 critical
5 AS4837 CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN 42,213 72 critical
6 AS4134 No.31,Jin-rong Street 30,373 32 medium
7 AS16509 Amazon.com, Inc. 13,559 63 high
8 AS53158 Net Turbo Telecom, BR 11,258 100 critical
9 AS52630 MOTTANET TI - SERVICOS DE TECNOLOGIA DA INFO, BR 11,254 100 critical
10 AS28634 Life Tecnologia Ltda., BR 10,921 67 high
11 AS53107 EVEO S.A., BR 10,499 81 critical
12 AS396982 GOOGLE-CLOUD-PLATFORM, US 10,385 59 high
13 AS45102 ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN 9,331 61 high
14 AS28299 LWSA SA 8,190 100 critical
15 AS263536 MICROSET MAQUINAS E SERVICOS LTDA, BR 8,098 100 critical
16 AS262740 VELOO NET LTDA, BR 7,295 67 high
17 AS262988 Pombonet Telecomunicacoes e Informatica, BR 6,418 100 critical
18 AS14061 DigitalOcean, LLC 5,490 37 medium
19 AS135386 LTG-AS-AP LinkChina Telecom Global Limited., HK 5,247 100 critical
20 AS61851 Garra Telecom Ltda, BR 5,116 99 critical
Weekly digest — by email

A short Monday-morning email summarising the headline movements: brute-force trend, the ASN league table, the noisiest categories, and the IPs propagating fastest across the sensor estate. Opt in, unsubscribe with one click.

Embeddable badge

Drop this badge into your blog or status page — it always shows the live count:

Powered by ipinsights.io — 81,251 IPs blocked this week