Live threat map
Malicious IPs worldwide, updated every minute.
Live · updated 2026-10-12 10:40 UTC
468kIndicators tracked66,418 IPs on the map
27,769New in the last 24hfirst seen by any feed
1,884Active malware familiesseen in the last 7 days
761Ransomware victims80 groups · last 30 days
184Countrieswith listed infrastructure
Loading map…
Each dot is a cluster of currently listed IPs, sized by count; a pulsing ring means something new was listed there in the last 24 hours. Click a dot for details; zoom in for finer detail. Locations are approximate (IP geolocation). Drag to scroll around the world. International boundaries are shown as claimed by India.
Where the infrastructure is
Listed IPs by hosting country, split by role.
- C2botnet command-and-control
- Malwaremalware delivery & hosting
- Phishingphishing sites
- Attackerscanning & brute-force
Networks hosting the most
Autonomous systems with the most listed IPs.
| Network | Country | IPs | Mostly |
|---|---|---|---|
| AS4837 CHINA UNICOM China169 Backbone | 🇨🇳 CN | 5,073 | Malware |
| AS396982 Google LLC | 🇺🇸 US | 3,779 | Attacker |
| AS45102 Alibaba (US) Technology Co., Ltd. | 🇺🇸 US | 2,364 | Attacker |
| AS25369 Hydra Communications Ltd | 🇬🇧 GB | 2,312 | Attacker |
| AS8075 Microsoft Corporation | 🇺🇸 US | 2,187 | Attacker |
| AS14061 DigitalOcean, LLC | 🇺🇸 US | 2,173 | Attacker |
| AS57026 JSC "ER-Telecom Holding" | 🇷🇺 RU | 2,050 | Attacker |
| AS396190 Leaseweb USA, Inc. | 🇺🇸 US | 2,049 | Attacker |
| AS4134 Chinanet | 🇨🇳 CN | 2,003 | Attacker |
| AS16276 OVH SAS | 🇨🇦 CA | 1,172 | Attacker |
| AS4766 Korea Telecom | 🇰🇷 KR | 943 | Attacker |
| AS213412 ONYPHE SAS | 🇫🇷 FR | 914 | Attacker |
Trending today
Listed by the most independent feeds in the last 24 hours. See all trending →
| Indicator | Role | Family / threat | Feeds today |
|---|---|---|---|
| IP 165.154.1[.]144 | Attacker | Attacking host | 4 |
| IP 43.167.198[.]92 | Attacker | Malicious IP | 4 |
| IP 45.9.2[.]178 | Attacker | Attacking host | 3 |
| IP 201.24.116[.]175 | Attacker | Attacking host | 3 |
| IP 134.185.90[.]18 | Attacker | Attacking host | 3 |
| IP 134.185.94[.]184 | Attacker | Attacking host | 3 |
| IP 140.245.122[.]65 | Attacker | Attacking host | 3 |
| IP 168.107.91[.]104 | Attacker | Attacking host | 3 |
Explore the data
89kIP addresses in the live IOC feed274kDomains in the live IOC feed39kURLs in the live IOC feed52kFile hashes in the live IOC feed1,884Malware families active this week80Ransomware groups active this month761Ransomware victims in 30 days184Country profilesWeeklyThreat digest: the week in malware and ransomware
Coverage
467,910 indicators tracked: 89k IPs, 274k domains, 39k URLs, 52k file hashes. Snapshot built 2026-10-12 10:40 UTC.