Aggregated list of compromised IP addresses

Daily updated feed of suspicious, malicious, and phishing IPs

Dataset type	Last updated (UTC)	IPs
Current compromised IPs	September 11, 2026	92,540	Download
All-time compromised IPs Historical list of IP addresses ever seen as compromised.	September 11, 2026	1,989,129	Download

Both lists are free and published under the Creative Commons Attribution 4.0 (CC BY 4.0) license: use, share and redistribute them freely, including commercially, as long as you credit NetAPI and link to this page.

More about file formats and API usage? See our FAQ or the compromised lists API →

What is the "Current compromised IPs" list?

IPs flagged by our sources as compromised within the last 24 hours — in other words, addresses observed in malicious activity during that window.

What is the "All-time compromised IPs" list?

A historical archive of IPs that have ever appeared in our compromised feed. An IP on this list does not mean it is still compromised today; most entries reflect past incidents only.

What format are the files in?

Plain text: one IP address per line. Downloads are free and do not require an API token.

Where does the data come from?

We collect, normalize, and deduplicate IP indicators daily from:

urlhaus.abuse.ch
hole.cert.pl
stamparm/blackbook
romainmarcoux/malicious-domains
iplists.firehol.org (iblocklist_abuse_zeus.netset)
iplists.firehol.org (firehol_level1.netset)
blocklist.de

Looking for compromised domains or TLD abuse statistics instead?

Feed activity

New compromised IP addresses per day and the size of the current list over time.

New IP addresses per day (last 14 days)

IP addresses seen in our sources for the first time on that day.

Current list size (last 28 days)

IP addresses flagged within the last 24 hours. Y-axis is scaled to the data range (not from zero).