Malicious IPs

Free feed of C2, scanner and malware-delivery IPs from Twitter/X researchers


Malicious IPs

C2, scanner and malware-delivery IPs from Twitter/X

Related Threat Intelligence feeds: URLs · Domains · SHA-256 · MD5 · All IOC types

IPs by window

Today

-

malicious IPs

Week

-

malicious IPs

Month

-

malicious IPs

Year

-

malicious IPs

Currently tracking 2,242 malicious IPs reported in the last 30 days. Data generated 2026-11-11 13:45 UTC.

What this list contains

  • Source: ~95 Twitter/X researchers, every 15 min.
  • C2 servers, malware hosts and scanners.
  • IPv4 only. Onion hosts appear as URLs, not IPs.
  • Many IPs sit on shared hosting: use as a signal, not a verdict.

Recent samples

Latest IPs from the past 7 days. Live from api.tweetfeed.live/v1/week/ip.

Loading samples

Top tags for malicious IPs

Filter the IP feed by malware family or category. Each tag has its own landing page with recent samples and context.

See all tags on the Dashboard or browse the full IOC feed.

Formats and how to use

The malicious IPs are available in four formats:

FormatWhereBest for
JSON APIapi.tweetfeed.live/v1/<window>/ipSOAR / SIEM enrichment, scripts
CSVtoday / week / month / year .csvbulk import, spreadsheets, blocklists
RSSrss.xmlwatch new IOCs in a reader
MCPmcp.tweetfeed.livelive lookups from AI agents / Claude
  • Load into your firewall or IDS/IPS as a deny rule.
  • Ready-made ips.txt list.
  • Shared hosting means false positives: scope blocks narrowly.

Frequently asked questions

What is a malicious IP feed?

A live list of IPv4 addresses used for C2, malware delivery and scanning. Ours comes from ~95 researchers on Twitter/X.

Where can I download this malicious IP list?

On the Feeds page: CSV, JSON and RSS. No key or sign-up.

Should I block these IPs at the firewall?

Carefully: shared hosting and CDNs reuse IPs, so blocks can hit legitimate sites. Alert first, then block high-confidence matches.

Are these IPs verified malicious?

No. It is OSINT, and IPs give more false positives than URLs or hashes. Check Shodan or AbuseIPDB before blocking.

Is the malicious IPs list free?

Yes. CC0 1.0, no key or sign-up, commercial use allowed.

License

IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.