New IP addresses on October 31, 2026

Daily threat report · UTC day

IPDebrief first observed 31,524 new IP addresses on October 31, 2026. 23,187 were analysed, and 0.3% of those scored high risk. The largest share came from Seychelles (62.3%).

New addresses
31,524
Analysed
23,187
High risk
76 · 0.3%
Moderate risk
741
IPv6
23,188

Risk and network type

76 high risk741 moderate22,370 low
Network typeAddressesShare of analysed
Hosting / cloud1120.5%
VPN00%
Proxy00%
Tor exit00%

Top countries

CountryAddressesShareHigh risk
Seychelles (SC)14,45462.3%0
United States (US)1,1314.9%39
Netherlands (NL)9694.2%1
Brazil (BR)9344%2
Lithuania (LT)4381.9%0
Spain (ES)3961.7%0
France (FR)3161.4%0
United Kingdom (GB)2471.1%1
Colombia (CO)2451.1%2
Italy (IT)2190.9%3
Argentina (AR)1880.8%1
Vietnam (VN)1880.8%0
Germany (DE)1700.7%3
Russia (RU)1590.7%0
Mexico (MX)1520.7%1
Indonesia (ID)1400.6%0
Ukraine (UA)1360.6%3
Chile (CL)1190.5%0
India (IN)1180.5%0
Turkey (TR)1180.5%0
Ecuador (EC)1150.5%1
Bangladesh (BD)1100.5%1
Philippines (PH)1050.5%0
Portugal (PT)990.4%0
Pakistan (PK)840.4%0

Top networks

NetworkAddressesShareHigh risk
AS214483 sc-rapidseedbox-1-mnt4,55819.7%0
AS62610 Pilo IP BV5552.4%0
AS16509 Amazon Data Services Northern Virginia1860.8%15
AS14618 Amazon Data Services Northern Virginia1340.6%18
AS28573 Claro NXT Telecomunicacoes Ltda550.2%0
AS13335 Cloudflare, Inc.440.2%0
AS3215 FT-BRX380.2%0
AS15557 SFR Legal Contact300.1%0
AS3352 Administradores Telefonica de Espana260.1%0
AS5410 BYTEL-MNT260.1%0
AS8151 Gestión de direccionamiento UniNet260.1%0
AS18881 TELEFÔNICA BRASIL S.A250.1%0
AS3269 Assurance Staff Business230.1%0
AS10620 Telmex Colombia S.A.220.1%0
AS7552 IRT-VNNIC-AP210.1%0
AS45899 IRT-VNNIC-AP210.1%0
AS57269 AS8708-MNT200.1%0
AS15704 David Barbarin Aramendia180.1%0
AS12479 JAZZTEL RIPE170.1%0
AS14593 SpaceX Services Inc administrator170.1%0
AS3320 DTAG-NIC160.1%0
AS5089 AS5089-MNT160.1%0
AS9299 IRT-PLDT-PH160.1%0
AS55836 IRT-RELIANCEJIO-IN160.1%0
AS2856 BT CENTRAL PLUS - OPERATIONAL SUPPORT150.1%0

Highest-risk new addresses

How these reports work

An address is counted on the UTC day it was first observed. A report is published about six hours after that day ends, so most addresses have been analysed by then. Risk bands follow the dossier pages: high is 70 or more, moderate 40–69, low below 40. Counts are a snapshot at publication; each address's own page shows its current assessment.

See also the network directory, provider IP ranges and the IP lookup tool.

← October 30, 2026 · October 2026 report · All reports · November 1, 2026 → · Markdown