###############################################################################
#                                                                             #
#                         MALICIOUS IP ADDRESSES FEED                         #
#               C2 / Malware Infrastructure (threat-intel-feed)               #
#                                                                             #
#  Purpose: IOC - Malicious IPv4 collection (score >= 50)                     #
#  Format:  one IPv4 per line, not defanged; '#' = comment                    #
#  Usage:   Firewall EDL (Palo Alto / FortiGate), SIEM                        #
#  Updated: 2026-10-26 23:24 UTC   Count: 76   Expiry: 30 days                #
#                                                                             #
###############################################################################


# Auto-Fetch-ThreatIntel: Spamhaus-DROP + ThreatFox
# C2 & malware infrastructure / TLP:CLEAR - Threat Level: High
# 2026-10-26

103.186.85.180
103.186.85.181
104.105.4.229
104.218.50.244
104.238.149.90
104.249.10.158
106.75.148.37
110.41.77.122
111.229.199.24
124.222.147.241
13.60.4.205
135.181.105.214
146.190.252.67
16.5.0.150
161.35.62.230
167.233.150.198
179.199.199.60
192.238.244.116
204.12.218.236
204.168.137.221
207.174.31.71
207.57.123.251
212.192.214.7
31.56.19.166
31.56.19.71
37.27.4.20
37.27.4.38
37.27.9.42
38.240.56.216
38.255.34.171
39.100.64.125
39.96.78.162
43.203.112.69
45.144.172.49
45.59.126.125
47.239.212.183
5.75.217.106
68.183.90.240
77.42.9.174
77.90.63.58
8.134.160.8
81.71.128.221
85.137.244.138
94.154.32.128
94.154.32.69
94.154.43.195


# Auto-Fetch-ThreatIntel: C2IntelFeeds + Spamhaus-DROP + ThreatFox
# C2 & malware infrastructure / TLP:CLEAR - Threat Level: High
# 2026-10-25

116.62.81.149
130.94.75.105
161.248.179.115
217.60.103.135
31.56.209.86
64.89.161.138
85.11.167.7
89.32.41.146
94.154.43.68


# Auto-Fetch-ThreatIntel: C2IntelFeeds + IPsum-L5 + ThreatFox
# C2 & malware infrastructure / TLP:CLEAR - Threat Level: Medium
# 2026-10-24

113.52.135.27
114.215.184.158
118.25.147.157
149.104.31.151
156.254.20.46
160.119.66.206
167.148.201.108
170.231.239.144
175.178.126.48
192.255.248.153
196.251.107.186
38.190.224.38
43.142.137.169
49.235.158.141
8.156.80.127
89.32.41.111
89.32.41.43
91.92.242.19
92.249.61.190


# Arista VCO exploitation CVE-2026-114625 IOC's
# Arista VCO exploitation / TLP:CLEAR - Threat Level: Critical
# 2026-10-22

38.54.50.151
74.82.197.86