IP Intelligence Authority Platform
New IP addresses in October 2026
Monthly threat report · UTC
1,427,915 new IP addresses were first observed in October 2026 across 25 daily reports; 0.8% of analysed addresses scored high risk.
- New addresses
- 1,427,915
- Analysed
- 441,867
- High risk
- 3,655 · 0.8%
- Moderate risk
- 10,983
- IPv6
- 1,195,082
Daily reports
| Day | New | Analysed | High risk |
|---|---|---|---|
| October 31, 2026 | 31,524 | 23,187 | 76 (0.3%) |
| October 30, 2026 | 30,140 | 20,398 | 101 (0.5%) |
| October 29, 2026 | 33,019 | 20,200 | 84 (0.4%) |
| October 28, 2026 | 31,713 | 19,972 | 59 (0.3%) |
| October 27, 2026 | 5,142 | 1,153 | 95 (8.2%) |
| October 26, 2026 | 8,445 | 894 | 85 (9.5%) |
| October 25, 2026 | 3,043 | 1,119 | 127 (11.3%) |
| October 24, 2026 | 4,392 | 1,561 | 196 (12.6%) |
| October 23, 2026 | 4,458 | 1,628 | 201 (12.3%) |
| October 22, 2026 | 4,637 | 1,040 | 165 (15.9%) |
| October 21, 2026 | 4,719 | 1,000 | 165 (16.5%) |
| October 20, 2026 | 4,967 | 2,065 | 214 (10.4%) |
| October 19, 2026 | 3,500 | 1,233 | 140 (11.4%) |
| October 18, 2026 | 3,414 | 1,283 | 152 (11.8%) |
| October 17, 2026 | 2,897 | 1,136 | 129 (11.4%) |
| October 16, 2026 | 3,166 | 1,133 | 136 (12%) |
| October 15, 2026 | 2,955 | 985 | 121 (12.3%) |
| October 14, 2026 | 2,599 | 561 | 61 (10.9%) |
| October 13, 2026 | 2,402 | 432 | 66 (15.3%) |
| October 12, 2026 | 4,168 | 647 | 111 (17.2%) |
| October 11, 2026 | 172,996 | 37,404 | 35 (0.1%) |
| October 10, 2026 | 186,452 | 45,502 | 37 (0.1%) |
| October 9, 2026 | 230,946 | 73,042 | 134 (0.2%) |
| October 8, 2026 | 330,848 | 80,506 | 366 (0.5%) |
| October 7, 2026 | 315,373 | 103,786 | 599 (0.6%) |
Top countries this month
| Country | Addresses | Share | High risk |
|---|---|---|---|
| Seychelles (SC) | 258,830 | 58.6% | 2 |
| United States (US) | 33,532 | 7.6% | 1,734 |
| Netherlands (NL) | 17,470 | 4% | 73 |
| Lithuania (LT) | 8,415 | 1.9% | 0 |
| Brazil (BR) | 8,238 | 1.9% | 36 |
| United Kingdom (GB) | 3,914 | 0.9% | 141 |
| Singapore (SG) | 2,242 | 0.5% | 19 |
| France (FR) | 2,230 | 0.5% | 36 |
| Spain (ES) | 2,112 | 0.5% | 15 |
| India (IN) | 2,053 | 0.5% | 46 |
| Argentina (AR) | 1,628 | 0.4% | 28 |
| Germany (DE) | 1,549 | 0.4% | 75 |
| Colombia (CO) | 1,448 | 0.3% | 33 |
| Bangladesh (BD) | 1,442 | 0.3% | 52 |
| Mexico (MX) | 1,418 | 0.3% | 16 |
| Turkey (TR) | 1,325 | 0.3% | 11 |
| Pakistan (PK) | 1,295 | 0.3% | 46 |
| South Africa (ZA) | 1,252 | 0.3% | 6 |
| Philippines (PH) | 1,251 | 0.3% | 19 |
| Vietnam (VN) | 1,232 | 0.3% | 0 |
| Canada (CA) | 1,188 | 0.3% | 52 |
| Indonesia (ID) | 1,104 | 0.2% | 28 |
| Italy (IT) | 834 | 0.2% | 13 |
| Iraq (IQ) | 731 | 0.2% | 40 |
| Venezuela (VE) | 706 | 0.2% | 16 |
Top networks this month
| Network | Addresses | Share | High risk |
|---|---|---|---|
| AS214483 sc-rapidseedbox-1-mnt | 60,333 | 13.7% | 0 |
| AS62610 Pilo IP BV | 7,834 | 1.8% | 0 |
| AS16509 Amazon Data Services Northern Virginia | 4,137 | 0.9% | 514 |
| AS14618 Amazon Data Services Northern Virginia | 2,337 | 0.5% | 584 |
| AS45102 Alibaba Cloud - JP | 1,917 | 0.4% | 0 |
| AS8075 Divya Quamara | 1,388 | 0.3% | 85 |
| AS13335 Cloudflare, Inc. | 1,281 | 0.3% | 2 |
| AS7922 Comcast Cable Communications, Inc. | 1,145 | 0.3% | 0 |
| AS20940 Akamai Technologies, Inc. | 1,044 | 0.2% | 0 |
| AS21928 T-Mobile USA, Inc. | 420 | 0.1% | 0 |
| AS14593 SpaceX Services Inc administrator | 390 | 0.1% | 0 |
| AS15169 Google LLC | 385 | 0.1% | 2 |
| AS701 Verizon Business | 356 | 0.1% | 0 |
| AS2856 BT CENTRAL PLUS - OPERATIONAL SUPPORT | 284 | 0.1% | 2 |
| AS5089 AS5089-MNT | 260 | 0.1% | 0 |
| AS174 IRT-DATAUTAMA-ID | 259 | 0.1% | 1 |
| AS28573 Claro NXT Telecomunicacoes Ltda | 258 | 0.1% | 0 |
| AS16625 Akamai Technologies, Inc. | 250 | 0.1% | 73 |
| AS212238 Private Customer | 246 | 0.1% | 3 |
| AS714 Apple Inc. | 236 | 0.1% | 9 |
| AS9121 AS9121-MNT | 232 | 0.1% | 0 |
| AS45899 IRT-VNNIC-AP | 193 | 0% | 0 |
| AS396982 Google LLC | 193 | 0% | 3 |
| AS9541 Amjad Qasmi | 190 | 0% | 2 |
| AS1299 Arelion Sweden AB | 172 | 0% | 0 |
Monthly country and network totals are combined from each day's top-25 rankings, so smaller contributors may be undercounted.
How these reports work
An address is counted on the UTC day it was first observed. A report is published about six hours after that day ends, so most addresses have been analysed by then. Risk bands follow the dossier pages: high is 70 or more, moderate 40–69, low below 40. Counts are a snapshot at publication; each address's own page shows its current assessment.
See also the network directory, provider IP ranges and the IP lookup tool.