Aggregated list of compromised IP addresses

Looking for more details? Read our detailed FAQ →

What is the "Current compromised IP" list?

This is a list of IP addresses that are flagged as compromised by our sources within the last 24 hours. In other words, these IP addresses have been maliciously active in the last 24 hours.

What is the "All-time compromised IP" list?

This is a historical list of IP addresses that have ever been compromised. The presence of an IP address in this list does not mean that it is compromised at the moment (moreover, it is most likely that it is not at the moment).

What kind of data do your lists contain?

It's simple: each list contains one IP address per line.

What sources do you aggregate data from?

We collect, clean and sort IP data daily from:

• urlhaus.abuse.ch
• hole.cert.pl
• stamparm/blackbook
• romainmarcoux/malicious-domains
• iplists.firehol.org (iblocklist_abuse_zeus.netset)
• iplists.firehol.org (firehol_level1.netset)
• blocklist.de