Know who's knocking before you open the door.

Instant IP threat intelligence from 73 honeypots and 22+ threat feeds.

Your public IP is 216.73.216.138. Press Lookup for an instant threat-intelligence report — geolocation, ISP, blacklist presence, Tor / proxy / hosting flags, and a threat score.

Or try one of these:
Google DNS 8.8.8.8 Known scanner 167.94.138.49 Tor exit node 185.220.101.1
Lookup an IP
Geolocation, ISP, blacklist presence and threat score for any IPv4 or IPv6 address.
Download a blocklist
Country, category and full malicious-IP feeds in plaintext, CSV and JSON.
Get an API key
Free REST API for IP enrichment and bulk lookups — OpenAPI 3.1, Swagger UI.

73 honeypots 22+ threat feeds 100,748,417 IPs analysed refreshed every 4 hours

Independently operated · Methodology public · No data resale · Supported by UK Cyber Defence Ltd

Live threat intelligence — what the platform is currently watching

The numbers below are not marketing copy. They are the live counters from a network of 73 honeypots, tarpits and deception devices, cross-referenced against major blocklists and threat-intelligence feeds.

6,506
Attackers, last 4 hours
886,889
Malicious IPs listed
224
Countries observed
2026-05-29 16:03Z
Last refresh (UTC)

Recent malicious IPs

Live · refreshing every 60s

Brand-new attackers picked up by the sensor estate in the last 60 minutes, in priority order. Country, category and threat score for each address; the page updates visibly without a reload.

IP Country Category Threat First seen Last seen
115.211.153.31 China Network Attack 100
218.1.209.8 China Network Attack 100
189.63.41.164 Brazil Network Attack 100
211.185.91.225 South Korea Network Attack 100
47.152.102.201 United States Network Attack 100
190.120.254.252 Venezuela malicious 100
54.177.185.57 United States Network Attack 100
98.237.112.151 United States SSH/Telnet Brute Force 100
49.249.205.38 India Network Attack 100
153.67.7.197 Argentina Network Attack 100
115.55.46.41 China Network Attack 100
54.241.237.247 United States Network Attack 100
131.196.82.153 Argentina Network Attack 100
34.216.97.25 United States Network Attack 100
86.134.214.115 United Kingdom Network Attack 100
54.183.211.111 United States Network Attack 100
18.216.72.146 United States Network Attack 100
168.228.239.125 Brazil Network Attack 100
167.62.138.90 Uruguay Network Attack 100
98.231.129.148 United States malicious 100
When attackers are most active right now
AI Agent Traffic (Last 24 Hours) methodology v1.0
0.0%
share of observed sources classed probable or confirmed agentic in the last 24 hours
Probable: 0
Confirmed: 0
of 0 total
90-day daily trend of unique sources classed probable or confirmed. Methodology
Where attacks are coming from right now
What attackers are trying to do this week
The countries hosting the most malicious activity today
Country Blacklisted IPs
Brazil (BR) 184,223
United States (US) 143,908
China (CN) 110,390
Hong Kong (HK) 88,969
Türkiye (TR) 21,053
India (IN) 12,918
Russia (RU) 12,271
Germany (DE) 11,215
United Kingdom (GB) 9,451
Seychelles (SC) 9,043
Integrates with
Wazuh Graylog Microsoft Sentinel Splunk TheHive / MISP Cloudflare WAF
Brute-force activity — this week vs. last week
61,868 unique attackers
in the last 7 days (vs. 45,008 the week before)
+37.5%
week-over-week change
ASN & ISP league table — top 20 networks hosting malicious activity

Networks ranked by the number of currently-flagged IPs they host. Click an ASN for the full profile.

# ASN Network / ISP Malicious IPs Risk score
1 AS400619 AROSSCLOUD INC. 46,192 99 critical
2 AS45753 NETSEC-HK Netsec Limited, HK 44,232 100 critical
3 AS133199 SONDERCLOUDLIMITED-AS-AP SonderCloud Limited, HK 43,775 100 critical
4 AS55933 CLOUDIE-AS-AP Cloudie Limited, HK 42,221 100 critical
5 AS4837 CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN 40,274 71 critical
6 AS4134 No.31,Jin-rong Street 28,392 31 medium
7 AS16509 Amazon.com, Inc. 11,518 59 high
8 AS53158 Net Turbo Telecom, BR 11,258 100 critical
9 AS52630 MOTTANET TI - SERVICOS DE TECNOLOGIA DA INFO, BR 11,254 100 critical
10 AS28634 Life Tecnologia Ltda., BR 10,920 67 high
11 AS53107 EVEO S.A., BR 10,501 81 critical
12 AS45102 ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN 9,203 62 high
13 AS396982 GOOGLE-CLOUD-PLATFORM, US 8,819 55 high
14 AS28299 LWSA SA 8,190 100 critical
15 AS263536 MICROSET MAQUINAS E SERVICOS LTDA, BR 8,098 100 critical
16 AS262740 VELOO NET LTDA, BR 7,295 67 high
17 AS262988 Pombonet Telecomunicacoes e Informatica, BR 6,418 100 critical
18 AS14061 DigitalOcean, LLC 5,378 37 medium
19 AS135386 LTG-AS-AP LinkChina Telecom Global Limited., HK 5,247 100 critical
20 AS61851 Garra Telecom Ltda, BR 5,116 99 critical
Weekly digest — by email

A short Monday-morning email summarising the headline movements: brute-force trend, the ASN league table, the noisiest categories, and the IPs propagating fastest across the sensor estate. Opt in, unsubscribe with one click.

Embeddable badge

Drop this badge into your blog or status page — it always shows the live count:

Powered by ipinsights.io — 84,626 IPs blocked this week