Malicious IP statistics: what 1.58 million confirmed attackers have in common

Most confirmed malicious IP addresses look ordinary. In FFraud's open list of 1,580,496 confirmed attackers (build of October 23, 2026, 07:30 UTC), 88.0 percent carry no proxy, VPN, Tor or data center label. Three in four listed IPv4 addresses share their /24 network with another listed address. Addresses whose worst category is command and control, botnet or malware make up just over half of the list, and nearly every Tor exit is on it.

#What did we count, and how?

The question is simple: what do addresses confirmed as attackers have in common? The data set is FFraud's public file of confirmed abusive IPs, released under the MIT license and rebuilt every 30 minutes. Every number on this page comes from one build, generated on October 23, 2026, at 07:30:03 UTC.

1. Each row is one IP address with five columns: the address, a score from 0 to 100, the number of confirmations, a category and a network type.
2. An address enters the file only after at least two independent confirmations and a score of 50 or more (how we score).
3. The category is the worst behavior seen from the address, and the type is filled only when the network is known.
4. We counted every row, with no further filters, and checked the counts with the shell commands at the end of this page.

#What are the addresses caught doing?

The largest group is the 649,082 addresses whose worst category is command and control, or 41.1 percent. General abuse follows with 26.0 percent, then spam with 15.9 percent and botnet activity with 8.8 percent. These counts describe FFraud's file and its labels, with no claim about how many command servers exist on the internet.

Brute force, malware, web attacks and scanning are smaller here because each address is counted once, under its worst behavior. An address that scans and also runs command and control counts as command and control.

#What networks do they use?

Only 12 percent of the list carries a proxy, VPN, Tor or data center label, and the rest carry no network label at all. Attacks from home connections are common: the FBI counted over 19 million compromised IP addresses in one residential proxy botnet, 911 S5.

The list is 98.4 percent IPv4, with 24,934 IPv6 addresses. Of the 1,227 Tor exits on the Tor Project's own list that morning, 1,221, or 99.5 percent, are in the file. A companion file names 561 small and medium networks where at least 90.1 percent of the addresses observed were abusive (open data).

#How sure is each listing?

The average address was confirmed 8.1 times, and the most confirmed one 53 times. Only 13.8 percent sit at the minimum of two. Scores average 79.3 and every score is 50 or more, by the file's own rule.

#What surprised us?

• Scores cluster on a few values. 772,195 addresses score exactly 90, 464,796 score 70 and 206,029 score 65, because the category sets most of the number.
• Most attackers carry no anonymizer label. 88.0 percent are neither proxy, VPN, Tor nor data center.
• Bad neighbors cluster. 75.2 percent of listed IPv4 addresses share their /24, a block of 256 addresses (RFC 4632), with another listed one. In 518 of those blocks, at least half the addresses are listed.
• The list is current. In a random sample of 100 listed hosting, proxy and VPN addresses, 86 had been seen within the past day (FFraud API, October 23, 2026).

#What does it mean for defending a site?

• Block the known attackers in bulk. The file is built for that, and a daily download keeps it fresh enough for most firewalls.
• Do not stop at VPN and proxy blocking. Close to nine in ten listed addresses carry no such label, so a rule that only blocks anonymizers misses most of them.
• Score the neighborhood. A quiet address in a heavily listed /24 deserves a closer look before it gets a login or a payment.
• Decide on Tor once. Nearly every exit is listed, so a site that wants Tor users should let them in on purpose, with a challenge.
• Keep other defenses. OWASP warns that IP blocking should not be the sole or primary defense; pair it with rate limits and multi-factor login.

#How do you reproduce these numbers?

Every count above comes from the public file and a few lines of code. Results change with each build, so note the build time from metadata.json next to your numbers.

URL=https://raw.githubusercontent.com/FFraud-com/ip-fraud-database/main/threat-ips/confirmed-abusive.csv
curl -s "$URL" | grep -v '^#' | tail -n +2 | wc -l                                   # rows
curl -s "$URL" | grep -v '^#' | tail -n +2 | cut -d, -f4 | sort | uniq -c | sort -rn   # categories
curl -s "$URL" | grep -v '^#' | tail -n +2 | cut -d, -f5 | sort | uniq -c | sort -rn   # network types

#Questions people ask

The data is free to download as the malicious IP database.