Live threat map
Malicious IPs worldwide, updated every minute.
Live · updated 2026-10-12 09:36 UTC
469kIndicators tracked66,764 IPs on the map
27,511New in the last 24hfirst seen by any feed
1,874Active malware familiesseen in the last 7 days
773Ransomware victims81 groups · last 30 days
184Countrieswith listed infrastructure
Loading map…
Each dot is a cluster of currently listed IPs, sized by count; a pulsing ring means something new was listed there in the last 24 hours. Click a dot for details; zoom in for finer detail. Locations are approximate (IP geolocation). Drag to scroll around the world. International boundaries are shown as claimed by India.
Where the infrastructure is
Listed IPs by hosting country, split by role.
- C2botnet command-and-control
- Malwaremalware delivery & hosting
- Phishingphishing sites
- Attackerscanning & brute-force
Networks hosting the most
Autonomous systems with the most listed IPs.
| Network | Country | IPs | Mostly |
|---|---|---|---|
| AS4837 CHINA UNICOM China169 Backbone | 🇨🇳 CN | 5,025 | Malware |
| AS396982 Google LLC | 🇺🇸 US | 3,819 | Attacker |
| AS25369 Hydra Communications Ltd | 🇬🇧 GB | 2,329 | Attacker |
| AS45102 Alibaba (US) Technology Co., Ltd. | 🇺🇸 US | 2,237 | Attacker |
| AS14061 DigitalOcean, LLC | 🇺🇸 US | 2,202 | Attacker |
| AS8075 Microsoft Corporation | 🇺🇸 US | 2,200 | Attacker |
| AS57026 JSC "ER-Telecom Holding" | 🇷🇺 RU | 2,051 | Attacker |
| AS396190 Leaseweb USA, Inc. | 🇺🇸 US | 2,049 | Attacker |
| AS4134 Chinanet | 🇨🇳 CN | 1,950 | Attacker |
| AS16276 OVH SAS | 🇨🇦 CA | 1,182 | Attacker |
| AS4766 Korea Telecom | 🇰🇷 KR | 934 | Attacker |
| AS213412 ONYPHE SAS | 🇫🇷 FR | 907 | Attacker |
Trending today
Listed by the most independent feeds in the last 24 hours. See all trending →
| Indicator | Role | Family / threat | Feeds today |
|---|---|---|---|
| IP 165.154.1[.]144 | Attacker | Attacking host | 4 |
| IP 43.167.198[.]92 | Attacker | Malicious IP | 4 |
| IP 192.108.48[.]150 | Attacker | Attacking host | 3 |
| IP 45.9.2[.]178 | Attacker | Attacking host | 3 |
| IP 201.24.116[.]175 | Attacker | Attacking host | 3 |
| IP 207.175.138[.]62 | Attacker | Attacking host | 3 |
| IP 45.58.52[.]47 | Attacker | Attacking host | 3 |
| IP 134.185.90[.]18 | Attacker | Attacking host | 3 |
Explore the data
91kIP addresses in the live IOC feed274kDomains in the live IOC feed39kURLs in the live IOC feed52kFile hashes in the live IOC feed1,874Malware families active this week81Ransomware groups active this month773Ransomware victims in 30 days184Country profilesWeeklyThreat digest: the week in malware and ransomware
Coverage
468,747 indicators tracked: 91k IPs, 274k domains, 39k URLs, 52k file hashes. Snapshot built 2026-10-12 09:36 UTC.