Live threat map
Malicious IPs worldwide, updated every minute.
Live · updated 2026-10-12 15:11 UTC
474kIndicators tracked69,784 IPs on the map
29,468New in the last 24hfirst seen by any feed
1,921Active malware familiesseen in the last 7 days
758Ransomware victims80 groups · last 30 days
184Countrieswith listed infrastructure
Loading map…
Each dot is a cluster of currently listed IPs, sized by count; a pulsing ring means something new was listed there in the last 24 hours. Click a dot for details; zoom in for finer detail. Locations are approximate (IP geolocation). Drag to scroll around the world. International boundaries are shown as claimed by India.
Where the infrastructure is
Listed IPs by hosting country, split by role.
- C2botnet command-and-control
- Malwaremalware delivery & hosting
- Phishingphishing sites
- Attackerscanning & brute-force
Networks hosting the most
Autonomous systems with the most listed IPs.
| Network | Country | IPs | Mostly |
|---|---|---|---|
| AS4837 CHINA UNICOM China169 Backbone | 🇨🇳 CN | 5,113 | Malware |
| AS396982 Google LLC | 🇺🇸 US | 3,888 | Attacker |
| AS45102 Alibaba (US) Technology Co., Ltd. | 🇺🇸 US | 2,501 | Attacker |
| AS16276 OVH SAS | 🇬🇧 GB | 2,345 | Attacker |
| AS25369 Hydra Communications Ltd | 🇬🇧 GB | 2,293 | Attacker |
| AS8075 Microsoft Corporation | 🇺🇸 US | 2,275 | Attacker |
| AS14061 DigitalOcean, LLC | 🇺🇸 US | 2,273 | Attacker |
| AS57026 JSC "ER-Telecom Holding" | 🇷🇺 RU | 2,050 | Attacker |
| AS396190 Leaseweb USA, Inc. | 🇺🇸 US | 2,049 | Attacker |
| AS4134 Chinanet | 🇨🇳 CN | 2,044 | Attacker |
| AS4766 Korea Telecom | 🇰🇷 KR | 989 | Attacker |
| AS213412 ONYPHE SAS | 🇫🇷 FR | 897 | Attacker |
Trending today
Listed by the most independent feeds in the last 24 hours. See all trending →
| Indicator | Role | Family / threat | Feeds today |
|---|---|---|---|
| IP 165.154.1[.]144 | Attacker | Attacking host | 3 |
| IP 151.59.7[.]174 | Attacker | Attacking host | 3 |
| IP 45.9.2[.]178 | Attacker | Attacking host | 3 |
| IP 201.24.116[.]175 | Attacker | Attacking host | 3 |
| IP 212.118.18[.]112 | Attacker | Attacking host | 3 |
| IP 129.121.115[.]10 | Attacker | Attacking host | 3 |
| IP 207.175.138[.]62 | Attacker | Attacking host | 3 |
| IP 67.205.155[.]78 | Attacker | Attacking host | 3 |
Explore the data
93kIP addresses in the live IOC feed274kDomains in the live IOC feed40kURLs in the live IOC feed54kFile hashes in the live IOC feed1,921Malware families active this week80Ransomware groups active this month758Ransomware victims in 30 days184Country profilesWeeklyThreat digest: the week in malware and ransomware
Coverage
473,694 indicators tracked: 93k IPs, 274k domains, 40k URLs, 54k file hashes. Snapshot built 2026-10-12 15:11 UTC.