Aggregated list of compromised IP addresses

Looking for more details? Read our detailed FAQ →

What is the "Current compromised IP" list?

This is a list of IP addresses that are marked compromised in the last 24 hours in the particular sources we use. In other words, these IP addresses have been maliciously active in the last 24 hours.

What is the "All-time compromised IP" list?

This is a historical list of IP addresses that have ever been compromised. The presence of an IP address in this list does not mean that it is compromised at the moment (moreover, it is most likely that it is not at the moment).

What kind of data do your worksheets contain?

It's simple - each sheet contains one IP address per line.

What sources do you aggregate data from?

We collect, clean and sort IP data daily from:

• urlhaus.abuse.ch
• hole.cert.pl
• stamparm/blackbook
• romainmarcoux/malicious-domains
• iplists.firehol.org (iblocklist_abuse_zeus.netset)
• iplists.firehol.org (firehol_level1.netset)
• blocklist.de