Aggregated list of compromised IP addresses

Daily updated feed of suspicious, malicious, and phishing IPs

Dataset type	Last updated (UTC)	IPs
Current compromised IPs	June 12, 2026	99,150	Download
All-time compromised IPs Historical list of IP addresses ever seen as compromised.	June 12, 2026	1,763,230	Download

More about file formats and API usage? See our FAQ or the compromised lists API →

What is the "Current compromised IPs" list?

IPs flagged by our sources as compromised within the last 24 hours — in other words, addresses observed in malicious activity during that window.

What is the "All-time compromised IPs" list?

A historical archive of IPs that have ever appeared in our compromised feed. An IP on this list does not mean it is still compromised today; most entries reflect past incidents only.

What format are the files in?

Plain text: one IP address per line. Downloads are free and do not require an API token.

Where does the data come from?

We collect, normalize, and deduplicate IP indicators daily from:

urlhaus.abuse.ch
hole.cert.pl
stamparm/blackbook
romainmarcoux/malicious-domains
iplists.firehol.org (iblocklist_abuse_zeus.netset)
iplists.firehol.org (firehol_level1.netset)
blocklist.de

Looking for compromised URLs or TLD abuse statistics instead?