Threat feed
Botnet IPs & domains — recent threat feed
Nodes participating in botnet activity and automated attacks. Aggregated from 100+ threat intelligence sources, refreshed daily.
- Malicious IPs
- 333 406
- Malicious domains
- 0
- Last updated
- 2026-10-16
Downloads are snapshots. For continuous Botnet indicators, pull the STIX/TAXII threat feed into OpenCTI, MISP or your own pipeline.
Recently listed IPs
152.207.201.19234.81.112.65158.173.3.30100.28.124.2442001:4490:4e51:63f5:7166:fba1:6f9a:bb0647.250.43.176125.66.110.13190.22.239.15654.39.210.150104.23.190.85211.250.54.29172.71.148.6677.67.26.108135.148.160.22569.5.169.188171.243.150.217104.23.166.151139.28.190.71136.113.145.054.247.227.18316.5.0.217220.186.128.136218.206.136.2447.79.237.142103.76.82.136139.59.210.17782.199.213.47201.50.116.104172.239.64.84182.186.177.113185.15.170.5034.72.124.6062.34.24.176189.188.209.53103.140.83.19474.244.223.167209.61.63.35114.42.65.2445.67.99.56183.34.200.71173.173.165.24591.234.136.88195.178.110.60187.73.25.892.57.17.67223.236.99.16672.255.17.249103.215.237.6859.94.10.15287.103.196.161189.203.88.20669.242.116.207218.84.45.181183.129.191.100172.56.202.5649.124.149.532a0c:5a86:f611:f100:406f:3d39:9dac:6e69202.8.40.10562.248.117.2105.209.136.5