IP Intelligence Authority Platform
New IP addresses on October 9, 2026
Daily threat report · UTC day
IPDebrief first observed 230,946 new IP addresses on October 9, 2026. 73,042 were analysed, and 0.2% of those scored high risk. The largest share came from Seychelles (71.6%).
- New addresses
- 230,946
- Analysed
- 73,042
- High risk
- 134 · 0.2%
- Moderate risk
- 1,149
- IPv6
- 207,900
Risk and network type
134 high risk1,149 moderate71,759 low
| Network type | Addresses | Share of analysed |
|---|---|---|
| Hosting / cloud | 558 | 0.8% |
| VPN | 0 | 0% |
| Proxy | 0 | 0% |
| Tor exit | 0 | 0% |
Top countries
| Country | Addresses | Share | High risk |
|---|---|---|---|
| Seychelles (SC) | 52,306 | 71.6% | 2 |
| Netherlands (NL) | 3,508 | 4.8% | 3 |
| United States (US) | 2,846 | 3.9% | 25 |
| Lithuania (LT) | 1,711 | 2.3% | 0 |
| Singapore (SG) | 976 | 1.3% | 0 |
| Brazil (BR) | 962 | 1.3% | 4 |
| India (IN) | 321 | 0.4% | 0 |
| United Kingdom (GB) | 257 | 0.4% | 7 |
| France (FR) | 198 | 0.3% | 2 |
| Philippines (PH) | 190 | 0.3% | 0 |
| Spain (ES) | 181 | 0.2% | 2 |
| Bangladesh (BD) | 177 | 0.2% | 5 |
| Argentina (AR) | 175 | 0.2% | 1 |
| South Africa (ZA) | 160 | 0.2% | 1 |
| Indonesia (ID) | 154 | 0.2% | 0 |
| Mexico (MX) | 151 | 0.2% | 1 |
| Germany (DE) | 145 | 0.2% | 2 |
| Colombia (CO) | 137 | 0.2% | 1 |
| Italy (IT) | 135 | 0.2% | 0 |
| Turkey (TR) | 134 | 0.2% | 0 |
| Canada (CA) | 133 | 0.2% | 0 |
| Iraq (IQ) | 128 | 0.2% | 4 |
| Pakistan (PK) | 128 | 0.2% | 3 |
| Chile (CL) | 127 | 0.2% | 1 |
| Saudi Arabia (SA) | 123 | 0.2% | 0 |
Top networks
Highest-risk new addresses
- 102.217.243.1
- 103.148.53.42
- 180.149.232.60
- 201.7.31.189
- 213.230.86.56
- 84.54.73.134
- 84.54.73.193
- 103.124.110.84
- 103.166.152.24
- 103.21.166.178
- 103.234.202.7
- 103.240.242.190
- 103.82.123.39
- 104.220.22.0
- 109.245.160.140
- 110.76.128.233
- 119.63.138.228
- 130.193.217.108
- 130.193.254.198
- 132.251.242.79
- 14.192.156.76
- 145.40.156.137
- 147.136.252.155
- 147.78.160.133
- 16.59.254.35
How these reports work
An address is counted on the UTC day it was first observed. A report is published about six hours after that day ends, so most addresses have been analysed by then. Risk bands follow the dossier pages: high is 70 or more, moderate 40–69, low below 40. Counts are a snapshot at publication; each address's own page shows its current assessment.
See also the network directory, provider IP ranges and the IP lookup tool.
← October 8, 2026 · October 2026 report · All reports · October 10, 2026 → · Markdown