IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
Threat Data IP Threat Map Data Sources
Threat Data

Threat Data Overview

Every other page here answers a question about one thing — an address, a country, a network. This page describes the corpus itself: the question a reader has before they know which address to ask about.

  • Data last refreshed: 2026-11-09 23:19
Addresses tracked153,494
Countries196
Autonomous systems8,428
Data sources44

Global Distribution

United Arab Emirates — 214 Afghanistan — 66 Albania — 120 Armenia — 114 Angola — 26 Argentina — 2,025 Austria — 209 Australia — 1,046 Azerbaijan — 102 Bosnia and Herzegovina — 25 Bangladesh — 2,049 Belgium — 3,804 Burkina Faso — 34 Bulgaria — 447 Burundi — 4 Benin — 75 Brunei — 6 Bolivia — 100 Brazil — 4,182 Bahamas — 5 BT — 2 Botswana — 43 Belarus — 39 Belize — 4 Canada — 2,392 Democratic Republic of the Congo — 14 CF — No entries Republic of the Congo — 13 Switzerland — 358 Ivory Coast — 34 Chile — 611 Cameroon — 17 China — 15,306 Colombia — 780 Costa Rica — 55 CU — 1 Cyprus — 44 Czechia — 137 Germany — 7,558 DJ — No entries Denmark — 99 Dominican Republic — 72 Algeria — 64 Ecuador — 249 Estonia — 59 Egypt — 253 EH — No entriesEritrea — No entries Spain — 829 Ethiopia — 74 Finland — 688 Fiji — 1 FK — No entries France — 3,304 GA — 8 United Kingdom — 7,936 Georgia — 142 Ghana — 81 GL — No entries Gambia — 9 Guinea — No entries Equatorial Guinea — 2 Greece — 58 Guatemala — 32 GW — No entries Guyana — 5 Honduras — 85 Croatia — 35 Haiti — 2 Hungary — 146 Indonesia — 2,350 Ireland — 378 Israel — 312 India — 3,205 Iraq — 280 Iran — 814 Iceland — 57 Italy — 1,090 Jamaica — 32 Jordan — 36 Japan — 2,184 Kenya — 348 Kyrgyzstan — 28 Cambodia — 119 KP — No entries South Korea — 2,897 Kuwait — 39 Kazakhstan — 253 Laos — 16 Lebanon — 23 Sri Lanka — 41 Liberia — 23 LS — 10 Lithuania — 263 Luxembourg — 112 Latvia — 131 Libya — 21 Morocco — 187 Moldova — 179 Montenegro — 4 Madagascar — 9 North Macedonia — 29 Mali — 4 Myanmar — 97 Mongolia — 80 Mauritania — 7 Malawi — 14 Mexico — 878 Malaysia — 1,252 Mozambique — 39 Namibia — 3 NC — 3 Niger — 4 Nigeria — 159 Nicaragua — 15 The Netherlands — 5,172 Norway — 130 Nepal — 79 New Zealand — 54 Oman — 50 Panama — 43 Peru — 171 Papua New Guinea — No entries Philippines — 306 Pakistan — 2,404 Poland — 773 Puerto Rico — 37 Palestinian Territory — 56 Portugal — 139 Paraguay — 125 Qatar — 150 Romania — 328 Serbia — 98 Russia — 5,386 Rwanda — 5 Saudi Arabia — 236 SB — No entries Sudan — 6 Sweden — 910 Slovenia — 164 Slovakia — 52 Sierra Leone — 1 Senegal — 33 Somalia — 6 SR — No entries South Sudan — 1 El Salvador — 26 Syria — 26 Eswatini — 2 Chad — 1 TF — No entries Togo — 38 Thailand — 553 Tajikistan — 19 Timor Leste — No entries Turkmenistan — 5 Tunisia — 133 Turkey — 999 Trinidad and Tobago — 27 Taiwan — 1,624 Tanzania — 36 Ukraine — 2,559 Uganda — 55 United States — 43,714 Uruguay — 25 Uzbekistan — 659 Venezuela — 438 Vietnam — 1,408 VU — 4 Kosovo — 29 Yemen — 5 South Africa — 675 Zambia — 23 Zimbabwe — 21
Addresses tracked: 0 1–49 50–249 250–999 1.000–4.999 5.000+

Shade is a count of addresses, not a level of risk. The bands are log-spaced because the distribution is; equal-width bands would leave every country but two in the same tone. Click a country for its breakdown.

Distribution by Continent

Asia 49,283 32.1%
North America 47,455 30.9%
Europe 44,156 28.8%
South America 8,713 5.7%
Africa 2,770 1.8%
Oceania 1,113 0.7%
Antarctica 1 0.0%

Countries With the Most Addresses

Countries
United States (US) 43,714 28.5%
China (CN) 15,306 10.0%
United Kingdom (GB) 7,936 5.2%
Germany (DE) 7,558 4.9%
Singapore (SG) 5,571 3.6%
Russia (RU) 5,386 3.5%
Brazil (BR) 4,182 2.7%
Belgium (BE) 3,804 2.5%
France (FR) 3,304 2.2%
India (IN) 3,205 2.1%
Hong Kong (HK) 3,048 2.0%
South Korea (KR) 2,897 1.9%
Ukraine (UA) 2,559 1.7%
Pakistan (PK) 2,404 1.6%
Canada (CA) 2,392 1.6%
Indonesia (ID) 2,350 1.5%
Japan (JP) 2,184 1.4%
Bangladesh (BD) 2,049 1.3%
Argentina (AR) 2,025 1.3%

Threat Categories

Attack Source 89,123 58.1%
Malicious Activity 43,391 28.3%
SSH Brute Force 11,756 7.7%
Tor Exit Node 2,126 1.4%
Open Proxy 1,549 1.0%
Malware C2 1,355 0.9%
Bot Activity 1,104 0.7%
Aggregated List (Low Confidence) 891 0.6%
Repeat Offender 889 0.6%
Aggregated List (Medium Confidence) 676 0.4%
Compromised Host 511 0.3%
Web Server Attack 58 0.0%
Hijacked Network 27 0.0%
Aggregated List (High Confidence) 23 0.0%
Mail Abuse 15 0.0%

Confidence Score Distribution

Critical 67,699 44.1%
Suspicious 83,301 54.3%
Low Risk 2,494 1.6%

Source lists alone cannot exceed 90: reaching 100 requires a second kind of evidence — a community report or a live DNSBL listing. That ceiling is deliberate; appearing on lists is not the same as certainty.

Networks With the Most Addresses

Networks
ASN ISP / Organization Addresses tracked %
AS396982 Google LLC 17,299 11.3
AS14061 DigitalOcean, LLC 8,830 5.8
AS4134 No.31,Jin-rong Street 5,018 3.3
AS4837 CHINA UNICOM China169 Backbone 4,191 2.7
AS8075 Microsoft Corporation 3,923 2.6
AS45102 Alibaba (US) Technology Co., Ltd. 3,629 2.4
AS16276 OVH SAS 3,227 2.1
AS25369 Hydra Communications Ltd 3,028 2.0
AS57026 JSC "ER-Telecom Holding" 2,051 1.3
AS396190 Leaseweb USA, Inc. 2,050 1.3
AS4766 Korea Telecom 1,875 1.2
AS132203 Shenzhen Tencent Computer Systems Company Limited 1,677 1.1

Operator-Level Listings

454 ASN

Where the 454 autonomous systems on Spamhaus ASN-DROP are registered. This is where the network is registered, not where its traffic comes from.

Ukraine (UA) 59 19.0%
India (IN) 51 16.4%
United States (US) 46 14.8%
Russia (RU) 43 13.8%
Moldova (MD) 40 12.9%
Hong Kong (HK) 31 10.0%
United Kingdom (GB) 25 8.0%
Seychelles (SC) 16 5.1%

Method and Limits

Counts are of single addresses; blocks listed as ranges are not counted as one entry each here. Country comes from the address's geolocation, and a country ranking high is not an accusation against it — large cloud providers and wide allocations naturally produce more entries. The continent mapping is derived from the same database that produces the location on the profile pages.

Entries in pool352,693
Network ranges76,613
IPv61,545
Active sources44