Daily IP threat reports
New addresses observed each UTC day
Every day IPDebrief observes thousands of IP addresses for the first time. These reports summarise each UTC day: how many new addresses appeared, how many scored high risk, how many sit on hosting, VPN, proxy or Tor infrastructure, and which countries and networks contributed most. Published reports do not change.
By month
Recent days
| Day | New | Analysed | High risk |
|---|---|---|---|
| November 6, 2026 | 37,840 | 25,909 | 96 (0.4%) |
| November 5, 2026 | 15,055 | 11,350 | 125 (1.1%) |
| November 4, 2026 | 20,180 | 16,041 | 243 (1.5%) |
| November 3, 2026 | 30,278 | 26,647 | 254 (1%) |
| November 2, 2026 | 27,818 | 25,015 | 123 (0.5%) |
| November 1, 2026 | 27,752 | 21,187 | 211 (1%) |
| October 31, 2026 | 31,524 | 23,187 | 76 (0.3%) |
| October 30, 2026 | 30,140 | 20,398 | 101 (0.5%) |
| October 29, 2026 | 33,019 | 20,200 | 84 (0.4%) |
| October 28, 2026 | 31,713 | 19,972 | 59 (0.3%) |
| October 27, 2026 | 5,142 | 1,153 | 95 (8.2%) |
| October 26, 2026 | 8,445 | 894 | 85 (9.5%) |
| October 25, 2026 | 3,043 | 1,119 | 127 (11.3%) |
| October 24, 2026 | 4,392 | 1,561 | 196 (12.6%) |
| October 23, 2026 | 4,458 | 1,628 | 201 (12.3%) |
| October 22, 2026 | 4,637 | 1,040 | 165 (15.9%) |
| October 21, 2026 | 4,719 | 1,000 | 165 (16.5%) |
| October 20, 2026 | 4,967 | 2,065 | 214 (10.4%) |
| October 19, 2026 | 3,500 | 1,233 | 140 (11.4%) |
| October 18, 2026 | 3,414 | 1,283 | 152 (11.8%) |
| October 17, 2026 | 2,897 | 1,136 | 129 (11.4%) |
| October 16, 2026 | 3,166 | 1,133 | 136 (12%) |
| October 15, 2026 | 2,955 | 985 | 121 (12.3%) |
| October 14, 2026 | 2,599 | 561 | 61 (10.9%) |
| October 13, 2026 | 2,402 | 432 | 66 (15.3%) |
| October 12, 2026 | 4,168 | 647 | 111 (17.2%) |
| October 11, 2026 | 172,996 | 37,404 | 35 (0.1%) |
| October 10, 2026 | 186,452 | 45,502 | 37 (0.1%) |
| October 9, 2026 | 230,946 | 73,042 | 134 (0.2%) |
| October 8, 2026 | 330,848 | 80,506 | 366 (0.5%) |
| October 7, 2026 | 315,373 | 103,786 | 599 (0.6%) |
How these reports work
An address is counted on the UTC day it was first observed. A report is published about six hours after that day ends, so most addresses have been analysed by then. Risk bands follow the dossier pages: high is 70 or more, moderate 40–69, low below 40. Counts are a snapshot at publication; each address's own page shows its current assessment.
See also the network directory, provider IP ranges and the IP lookup tool.