Live threat map
Malicious IPs worldwide, updated every minute.
Live · updated 2026-10-12 11:25 UTC
469kIndicators tracked67,035 IPs on the map
27,893New in the last 24hfirst seen by any feed
1,895Active malware familiesseen in the last 7 days
760Ransomware victims80 groups · last 30 days
184Countrieswith listed infrastructure
Loading map…
Each dot is a cluster of currently listed IPs, sized by count; a pulsing ring means something new was listed there in the last 24 hours. Click a dot for details; zoom in for finer detail. Locations are approximate (IP geolocation). Drag to scroll around the world. International boundaries are shown as claimed by India.
Where the infrastructure is
Listed IPs by hosting country, split by role.
- C2botnet command-and-control
- Malwaremalware delivery & hosting
- Phishingphishing sites
- Attackerscanning & brute-force
Networks hosting the most
Autonomous systems with the most listed IPs.
| Network | Country | IPs | Mostly |
|---|---|---|---|
| AS4837 CHINA UNICOM China169 Backbone | 🇨🇳 CN | 5,077 | Malware |
| AS396982 Google LLC | 🇺🇸 US | 3,790 | Attacker |
| AS45102 Alibaba (US) Technology Co., Ltd. | 🇺🇸 US | 2,377 | Attacker |
| AS25369 Hydra Communications Ltd | 🇬🇧 GB | 2,312 | Attacker |
| AS8075 Microsoft Corporation | 🇺🇸 US | 2,197 | Attacker |
| AS14061 DigitalOcean, LLC | 🇺🇸 US | 2,178 | Attacker |
| AS57026 JSC "ER-Telecom Holding" | 🇷🇺 RU | 2,050 | Attacker |
| AS396190 Leaseweb USA, Inc. | 🇺🇸 US | 2,049 | Attacker |
| AS4134 Chinanet | 🇨🇳 CN | 2,009 | Attacker |
| AS16276 OVH SAS | 🇨🇦 CA | 1,168 | Attacker |
| AS4766 Korea Telecom | 🇰🇷 KR | 949 | Attacker |
| AS213412 ONYPHE SAS | 🇫🇷 FR | 914 | Attacker |
Trending today
Listed by the most independent feeds in the last 24 hours. See all trending →
| Indicator | Role | Family / threat | Feeds today |
|---|---|---|---|
| IP 165.154.1[.]144 | Attacker | Attacking host | 4 |
| IP 43.167.198[.]92 | Attacker | Malicious IP | 4 |
| IP 151.59.7[.]174 | Attacker | Attacking host | 3 |
| IP 191.251.11[.]18 | Attacker | Attacking host | 3 |
| IP 45.9.2[.]178 | Attacker | Attacking host | 3 |
| IP 201.24.116[.]175 | Attacker | Attacking host | 3 |
| IP 134.185.90[.]18 | Attacker | Attacking host | 3 |
| IP 134.185.94[.]184 | Attacker | Attacking host | 3 |
Explore the data
90kIP addresses in the live IOC feed274kDomains in the live IOC feed39kURLs in the live IOC feed53kFile hashes in the live IOC feed1,895Malware families active this week80Ransomware groups active this month760Ransomware victims in 30 days184Country profilesWeeklyThreat digest: the week in malware and ransomware
Coverage
469,371 indicators tracked: 90k IPs, 274k domains, 39k URLs, 53k file hashes. Snapshot built 2026-10-12 11:25 UTC.