Aggregated list of compromised IP addresses

Daily updated feed of suspicious, malicious, and phishing IPs

Dataset type Last updated (UTC) IPs CSV
Current compromised IPs October 28, 2026 65,838 Download
All-time compromised IPs
Historical list of IP addresses ever seen as compromised. 		October 28, 2026 2,112,627 Download

Both lists are free and published under the Creative Commons Attribution 4.0 (CC BY 4.0) license: use, share and redistribute them freely, including commercially, as long as you credit NetAPI and link to this page.

More about file formats and API usage? See our FAQ or the compromised lists API →

Listed by mistake?

The feed is built from public abuse sources, and a source can keep an address after the problem is gone. If your IP address is listed by mistake, email [email protected] with the address, who you are and why the listing is wrong: we compare it with the original sources and remove the address when the listing no longer holds, usually within two business days. For a domain name use the removal request form.

What is the "Current compromised IPs" list?

IPs flagged by our sources as compromised within the last 24 hours — in other words, addresses observed in malicious activity during that window.

What is the "All-time compromised IPs" list?

A historical archive of IPs that have ever appeared in our compromised feed. An IP on this list does not mean it is still compromised today; most entries reflect past incidents only.

What format are the files in?

Plain text: one IP address per line. Downloads are free and do not require an API token.

Where does the data come from?

We collect, normalize, and deduplicate IP indicators daily from these public feeds (IP addresses and networks only; the domain names they contain go to the compromised domain list):

  • blocklist.de
  • iplists.firehol.org (blocklist_de.ipset)
  • iplists.firehol.org (iblocklist_abuse_zeus.netset)
  • iplists.firehol.org (firehol_level1.netset)

Looking for compromised domains or TLD abuse statistics instead?

Feed activity

New compromised IP addresses per day and the size of the current list over time.

New IP addresses per day (last 14 days)

IP addresses seen in our sources for the first time on that day.

Current list size (last 28 days)

IP addresses flagged within the last 24 hours. Y-axis is scaled to the data range (not from zero).