Live threat map
Malicious IPs worldwide, updated every minute.
Live · updated 2026-10-12 08:40 UTC
468kIndicators tracked66,132 IPs on the map
27,348New in the last 24hfirst seen by any feed
1,855Active malware familiesseen in the last 7 days
773Ransomware victims81 groups · last 30 days
184Countrieswith listed infrastructure
Loading map…
Each dot is a cluster of currently listed IPs, sized by count; a pulsing ring means something new was listed there in the last 24 hours. Click a dot for details; zoom in for finer detail. Locations are approximate (IP geolocation). Drag to scroll around the world. International boundaries are shown as claimed by India.
Where the infrastructure is
Listed IPs by hosting country, split by role.
- C2botnet command-and-control
- Malwaremalware delivery & hosting
- Phishingphishing sites
- Attackerscanning & brute-force
Networks hosting the most
Autonomous systems with the most listed IPs.
| Network | Country | IPs | Mostly |
|---|---|---|---|
| AS4837 CHINA UNICOM China169 Backbone | 🇨🇳 CN | 5,016 | Malware |
| AS396982 Google LLC | 🇺🇸 US | 3,741 | Attacker |
| AS25369 Hydra Communications Ltd | 🇬🇧 GB | 2,324 | Attacker |
| AS45102 Alibaba (US) Technology Co., Ltd. | 🇺🇸 US | 2,237 | Attacker |
| AS8075 Microsoft Corporation | 🇺🇸 US | 2,201 | Attacker |
| AS14061 DigitalOcean, LLC | 🇺🇸 US | 2,139 | Attacker |
| AS57026 JSC "ER-Telecom Holding" | 🇷🇺 RU | 2,050 | Attacker |
| AS396190 Leaseweb USA, Inc. | 🇺🇸 US | 2,049 | Attacker |
| AS4134 Chinanet | 🇨🇳 CN | 1,944 | Attacker |
| AS16276 OVH SAS | 🇨🇦 CA | 1,169 | Attacker |
| AS4766 Korea Telecom | 🇰🇷 KR | 921 | Attacker |
| AS213412 ONYPHE SAS | 🇫🇷 FR | 907 | Attacker |
Trending today
Listed by the most independent feeds in the last 24 hours. See all trending →
| Indicator | Role | Family / threat | Feeds today |
|---|---|---|---|
| IP 165.154.1[.]144 | Attacker | Attacking host | 4 |
| IP 43.167.198[.]92 | Attacker | Malicious IP | 4 |
| IP 134.185.90[.]18 | Attacker | Attacking host | 3 |
| IP 134.185.94[.]184 | Attacker | Attacking host | 3 |
| IP 140.245.122[.]65 | Attacker | Attacking host | 3 |
| IP 168.107.91[.]104 | Attacker | Attacking host | 3 |
| IP 134.185.92[.]198 | Attacker | Attacking host | 3 |
| IP 140.245.96[.]64 | Attacker | Attacking host | 3 |
Explore the data
91kIP addresses in the live IOC feed274kDomains in the live IOC feed39kURLs in the live IOC feed51kFile hashes in the live IOC feed1,855Malware families active this week81Ransomware groups active this month773Ransomware victims in 30 days184Country profilesWeeklyThreat digest: the week in malware and ransomware
Coverage
467,908 indicators tracked: 91k IPs, 274k domains, 39k URLs, 51k file hashes. Snapshot built 2026-10-12 08:40 UTC.