THREATBYTESTM
All systems operational

IP blacklist

Address query DEMO78 of 78 shown
Role
Confidence
Status
Sort by
Listed IP addresses with role, confidence, status, country, network, malware families, the specimen each was identified in, and last-seen date. Use the button on each address for evidence.
IP addressRoleConfidenceStatusCountryNetworkFamiliesIdentified inLast seen
Payload hostHighActiveRussiaAS64499EXAMPLE-DC-RUCobalt StrikeTB-A998A6F6A998A6F6+31 more specimens
Payload hostHighActiveRussiaAS64499EXAMPLE-DC-RUAgentTeslaTB-3C69C44F01558D99+10 more specimens
Proxy or relayMediumActiveBulgariaAS64502EXAMPLE-SERVERS-BGMiraiTB-3C69C44F01558D99+8 more specimens
Suspected operatorMediumActiveHong KongAS64503EXAMPLE-IDC-HKXMRigTB-0533714A0533714A+6 more specimens
Proxy or relayMediumActiveVietnamAS64508EXAMPLE-MOBILE-VNQakBotTB-B0CB65D9B0CB65D9+4 more specimens
Proxy or relayMediumActiveUkraineAS64504EXAMPLE-TELECOM-UAXMRigTB-1037630C1037630C+2 more specimens
Proxy or relayLowActiveNetherlandsAS64496EXAMPLE-VPS-NLXMRigTB-C93EB2F2C93EB2F2
Command and controlHighActiveRomaniaAS64501EXAMPLE-NET-ROQakBot, RedLine StealerTB-60AEF76260AEF762+36 more specimens
Proxy or relayMediumActivePanamaAS64506EXAMPLE-OFFSHORE-PASmokeLoaderTB-3C69C44F01558D99+15 more specimens
Command and controlHighActiveRomaniaAS64501EXAMPLE-NET-ROSmokeLoaderTB-47EEDEFE47EEDEFE+39 more specimens
Payload hostHighActiveUnited StatesAS64498EXAMPLE-HOSTING-USFormbook, RedLine StealerTB-D634646AD634646A+30 more specimens
Command and controlLowActiveUnited StatesAS64498EXAMPLE-HOSTING-USSmokeLoaderTB-8F329BD38F329BD3+1 more specimen
Proxy or relayLowInactiveFranceAS64509EXAMPLE-CLOUD-FRCobalt StrikeTB-8F329BD38F329BD3
Suspected operatorMediumInactiveUnited StatesAS64498EXAMPLE-HOSTING-USFormbookTB-47EEDEFE47EEDEFE+39 more specimens
Command and controlHighInactiveUkraineAS64504EXAMPLE-TELECOM-UAQakBotTB-3C69C44F01558D99+10 more specimens
Command and controlHighSinkholedGermanyAS64497EXAMPLE-CLOUD-DEAgentTeslaTB-A998A6F6A998A6F6+12 more specimens
Command and controlMediumInactivePanamaAS64506EXAMPLE-OFFSHORE-PAAgentTesla, RedLine StealerTB-3C69C44F01558D99+4 more specimens
Proxy or relayMediumInactiveNetherlandsAS64496EXAMPLE-VPS-NLQakBotTB-60AEF76260AEF762+37 more specimens
Command and controlHighInactiveUnited StatesAS64498EXAMPLE-HOSTING-USCobalt StrikeTB-8F329BD38F329BD3+22 more specimens
Command and controlHighSinkholedHong KongAS64503EXAMPLE-IDC-HKAsyncRATTB-47EEDEFE47EEDEFE+19 more specimens
Command and controlHighInactiveBulgariaAS64502EXAMPLE-SERVERS-BGRedLine StealerTB-B0CB65D9B0CB65D9+10 more specimens
Payload hostLowInactiveUnited StatesAS64498EXAMPLE-HOSTING-USRedLine Stealer, AsyncRATTB-47EEDEFE47EEDEFE
Command and controlHighSinkholedNetherlandsAS64496EXAMPLE-VPS-NLAsyncRAT, AgentTeslaTB-3C69C44F01558D99+25 more specimens
Data exfiltrationMediumInactiveSeychellesAS64500EXAMPLE-BULLETPROOFAgentTeslaTB-47EEDEFE47EEDEFE+6 more specimens
Proxy or relayMediumInactiveGermanyAS64497EXAMPLE-CLOUD-DEEmotet, RedLine StealerTB-1037630C1037630C+3 more specimens

How to use this list

IP / 001 · Roles
Command and control
Server the malware contacts for instructions.
Payload host
Address that serves additional malware during infection.
Data exfiltration
Destination for stolen data.
Proxy or relay
Hop used to hide the real infrastructure, often a rented or hijacked server.
Suspected operator
Appears in the attacker's own artefacts rather than victim traffic; may be a home or office connection, a VPN exit, or a hijacked device.
IP / 002 · Not proof of identity

A listing means an address appeared in malware we analysed. Attackers routinely use hijacked computers, rented servers, and VPNs, so the owner of an address is often a victim too. Suspected operator listings are never marked high confidence.

Addresses are shown with network and approximate country only; we never publish names, street addresses, or other personal details.

IP / 003 · Blocking and disputes

Copy IPs and Download CSV export whatever is currently filtered. Review before blocking: shared hosting and cloud addresses can serve legitimate sites too.

Listed in error? Use the Report a false positive link on any address or contact us, and we will review and remove confirmed mistakes.