Know who's knocking before you open the door.

Instant IP threat intelligence from 73 honeypots and 22+ threat feeds.

Your public IP is 216.73.216.226. Press Lookup for an instant threat-intelligence report — geolocation, ISP, blacklist presence, Tor / proxy / hosting flags, and a threat score.

Or try one of these:
Google DNS 8.8.8.8 Known scanner 167.94.138.49 Tor exit node 185.220.101.1
Lookup an IP
Geolocation, ISP, blacklist presence and threat score for any IPv4 or IPv6 address.
Download a blocklist
Country, category and full malicious-IP feeds in plaintext, CSV and JSON.
Get an API key
Free REST API for IP enrichment and bulk lookups — OpenAPI 3.1, Swagger UI.

73 honeypots 22+ threat feeds 100,852,440 IPs analysed refreshed every 4 hours

Independently operated · Methodology public · No data resale · Supported by UK Cyber Defence Ltd

Live threat intelligence — what the platform is currently watching

The numbers below are not marketing copy. They are the live counters from a network of 73 honeypots, tarpits and deception devices, cross-referenced against major blocklists and threat-intelligence feeds.

6,125
Attackers, last 4 hours
740,776
Malicious IPs listed
224
Countries observed
2026-07-13 20:03Z
Last refresh (UTC)

Recent malicious IPs

Live · refreshing every 60s

Brand-new attackers picked up by the sensor estate in the last 60 minutes, in priority order. Country, category and threat score for each address; the page updates visibly without a reload.

IP Country Category Threat First seen Last seen
203.144.89.131 Cambodia Network Attack 100
23.234.98.123 United States Network Attack 100
54.216.81.92 Ireland Network Attack 100
54.216.40.69 Ireland Network Attack 100
52.19.81.69 Ireland Network Attack 100
34.249.85.185 Ireland Network Attack 100
3.252.177.34 Ireland Network Attack 100
3.251.254.66 Ireland Network Attack 100
3.251.251.213 Ireland Network Attack 100
187.33.157.245 Spain Network Attack 100
171.104.81.236 China Network Attack 100
58.19.142.2 China Network Attack 100
191.102.179.210 United States Network Attack 100
35.87.226.124 United States Network Attack 100
31.77.202.73 United States Network Attack 100
143.137.166.150 United States Network Attack 100
170.254.178.210 United States Network Attack 100
194.146.134.50 United States Network Attack 100
170.254.178.220 United States Network Attack 100
170.246.53.159 United States Network Attack 100
When attackers are most active right now
AI Agent Traffic (Last 24 Hours) methodology v1.0
0.0%
share of observed sources classed probable or confirmed agentic in the last 24 hours
Probable: 0
Confirmed: 0
of 0 total
90-day daily trend of unique sources classed probable or confirmed. Methodology
Where attacks are coming from right now
What attackers are trying to do this week
The countries hosting the most malicious activity today
Country Blacklisted IPs
United States (US) 137,658
China (CN) 109,166
Hong Kong (HK) 79,211
Brazil (BR) 28,221
Türkiye (TR) 15,285
India (IN) 14,728
Russia (RU) 13,902
Germany (DE) 12,626
United Kingdom (GB) 9,857
Seychelles (SC) 9,004
Integrates with
Wazuh Graylog Microsoft Sentinel Splunk TheHive / MISP Cloudflare WAF
Brute-force activity — this week vs. last week
57,123 unique attackers
in the last 7 days (vs. 23,853 the week before)
+139.5%
week-over-week change
ASN & ISP league table — top 20 networks hosting malicious activity

Networks ranked by the number of currently-flagged IPs they host. Click an ASN for the full profile.

# ASN Network / ISP Malicious IPs Risk score
1 AS400619 AROSSCLOUD INC. 46,182 99 critical
2 AS55933 CLOUDIE-AS-AP Cloudie Limited, HK 41,244 94 critical
3 AS4837 CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN 37,489 59 high
4 AS45753 NETSEC-HK Netsec Limited, HK 35,380 80 critical
5 AS4134 No.31,Jin-rong Street 29,036 30 medium
6 AS133199 SONDERCLOUDLIMITED-AS-AP SonderCloud Limited, HK 26,289 38 medium
7 AS16509 Amazon.com, Inc. 14,406 58 high
8 AS396982 GOOGLE-CLOUD-PLATFORM, US 13,433 63 high
9 AS45102 ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN 9,241 55 high
10 AS14618 Amazon.com, Inc. 6,418 66 high
11 AS13335 CLOUDFLARENET, US 5,627 88 critical
12 AS135386 LTG-AS-AP LinkChina Telecom Global Limited., HK 5,247 100 critical
13 AS8075 MICROSOFT-CORP-MSN-AS-BLOCK, US 5,214 49 medium
14 AS215238 UNASSIGNED 4,988 100 critical
15 AS62240 Clouvider Limited 3,433 62 high
16 AS37963 Hangzhou Alibaba Advertising Co.,Ltd. 3,311 44 medium
17 AS203771 Servervia Bilisim Yazilim Ve Telekomunikasyon Hizmetleri Limited Sirketi 3,292 100 critical
18 AS206092 SECFIREWALLAS, GB 2,990 30 medium
19 AS9829 National Internet Backbone 2,886 41 medium
20 AS14061 DigitalOcean, LLC 2,795 15 low
Weekly digest — by email

A short Monday-morning email summarising the headline movements: brute-force trend, the ASN league table, the noisiest categories, and the IPs propagating fastest across the sensor estate. Opt in, unsubscribe with one click.

Embeddable badge

Drop this badge into your blog or status page — it always shows the live count:

Powered by ipinsights.io — 76,933 IPs blocked this week