Emerging Threats compromised hosts

What it is

The compromised-hosts list behind the Emerging Threats open ruleset: single addresses seen attacking, a few hundred at a time, refreshed daily by the publisher. It sits apart from the netblock-level blocklists because it names hosts rather than operators and churns daily, and it weighs 50 rather than 80.

What it answers

In the IP response this source feeds is_attack_source, attack_source. Every answer names the datasets it read in its sources block with the date each was synced, so the figure on this page and the one in an answer are the same figure.

curl https://spaw.co/api/v1/ip \
  -H "Authorization: Bearer $SPAW_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ip": "203.0.113.9"}'

How to read this page

A source names a network or an operator, never a person. An address inside one of these ranges tells you what the connection is — a cloud instance, a VPN exit, a gateway, a listed host — and nothing about who is behind it.

More sources in attack-source lists

• CINS Army
• blocklist.de
• Every source
• Every field, documented
• Look up an address

counts and dates read from the installed feed · checked 2026-09-13