🇺🇸 United States: live cyber threat activity

Malicious IPs, malware and ransomware victims in United States.

17,807Malicious IPs listed#1 of 182 countries · 26.93% of the world
2,503New in the last 24hfirst seen by any feed
3,320Reported by 2+ feedsindependent sources agree
287Ransomware victimsposted in the last 30 days

View United States on the live map →All listed IPs in United StatesRansomware victims in United States

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

  1. C2662
  2. Malware715
  3. Phishing0
  4. Attacker16,430

By state or region

  1. California4,688
  2. Washington2,203
  3. Virginia1,745
  4. Texas1,619
  5. New Jersey1,299
  6. Arizona1,175
  7. Michigan663
  8. Iowa629
  9. South Carolina569
  10. Illinois458
  11. New York446
  12. Georgia331
  13. Oregon304
  14. Florida281
  15. Delaware281

By city

  1. Tukwila2,053
  2. Santa Clara1,422
  3. Dallas975
  4. San Jose867
  5. Ashburn766
  6. North Bergen763
  7. Pleasanton718
  8. Ann Arbor627
  9. North Charleston559
  10. Minkler558
  11. Phoenix551
  12. Des Moines512
  13. Yuma512
  14. Los Angeles504
  15. San Antonio495

Networks hosting the most

NetworkIPs
AS396982 Google LLC 2,119
AS396190 Leaseweb USA, Inc. 2,049
AS8075 Microsoft Corporation 1,991
AS14061 DigitalOcean, LLC 1,211
AS394380 Leaseweb USA, Inc. 768
AS13445 Cisco Webex LLC 768
AS6939 Hurricane Electric LLC 721
AS63949 Akamai Technologies, Inc. 653
AS398324 Censys, Inc. 611
AS45102 Alibaba (US) Technology Co., Ltd. 580
AS22773 Cox Communications Inc. 550
AS14237 Beamspeed LLC 512
AS14618 Amazon.com, Inc. 491
AS213412 ONYPHE SAS 427
AS3257 GTT Communications Inc. 255

Malware families served from United States

  1. PureRAT105
  2. Cobalt Strike72
  3. AdaptixC265
  4. AsyncRAT50
  5. Evilginx31
  6. DanaBot30
  7. Havoc28
  8. Remcos28
  9. DCRat26
  10. Loki20
  11. Jackskid18
  12. Expiro16
  13. W97m16
  14. Sliver16
  15. Emotet14

Most recently reported

IPRoleFamily / threatWhereNetworkReported byLast reported (UTC)
146.190.214[.]139AttackerAttacking hostNorth Bergen, New JerseyAS14061 DigitalOcean, LLC1 feed2026-10-12 08:20
2001[:]470[:]1[:]fb5[:]a715[:]fda3[:]5257[:]ff4dAttackerAttacking hostSanta Clara, CaliforniaAS6939 Hurricane Electric LLC1 feed2026-10-12 08:20
34.70.209[.]231AttackerAttacking hostCouncil Bluffs, IowaAS396982 Google LLC1 feed2026-10-12 08:20
47.88.53[.]172AttackerAttacking hostMinkler, CaliforniaAS45102 Alibaba (US) Technology Co., Ltd.1 feed2026-10-12 08:20
51.81.164[.]194AttackerAttacking hostHillsboro, OregonAS16276 OVH SAS1 feed2026-10-12 08:20
52.14.202[.]153AttackerAttacking hostDublin, OhioAS16509 Amazon.com, Inc.1 feed2026-10-12 08:20
52.248.42[.]71AttackerOn multiple blocklistsSan Antonio, TexasAS8075 Microsoft Corporation1 feed2026-10-12 08:20
104.248.11[.]185AttackerAttacking hostClifton, New JerseyAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
104.248.123[.]100AttackerAttacking hostNorth Bergen, New JerseyAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
104.248.52[.]47AttackerAttacking hostNorth Bergen, New JerseyAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
104.248.57[.]6AttackerAttacking hostNorth Bergen, New JerseyAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
104.248.62[.]44AttackerAttacking hostNorth Bergen, New JerseyAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
134.122.117[.]122AttackerAttacking hostNorth Bergen, New JerseyAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
134.122.18[.]48AttackerAttacking hostNorth Bergen, New JerseyAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
134.122.24[.]252AttackerAttacking hostNorth Bergen, New JerseyAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
134.209.124[.]85AttackerAttacking hostNorth Bergen, New JerseyAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
134.209.125[.]18AttackerAttacking hostNorth Bergen, New JerseyAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
134.209.160[.]56AttackerAttacking hostClifton, New JerseyAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
134.209.71[.]190AttackerAttacking hostNorth Bergen, New JerseyAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
134.209.73[.]152AttackerAttacking hostNorth Bergen, New JerseyAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
137.184.122[.]187AttackerAttacking hostSanta Clara, CaliforniaAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
137.184.23[.]38AttackerAttacking hostNorth Bergen, New JerseyAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
137.184.26[.]158AttackerAttacking hostNorth Bergen, New JerseyAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
137.184.27[.]51AttackerAttacking hostNorth Bergen, New JerseyAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
137.184.28[.]171AttackerAttacking hostNorth Bergen, New JerseyAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10

See every listed IP in United States →

Ransomware victims in United States

287 posted in the last 30 days, 1,010 in 90.

Posted (UTC)VictimGroupSector
2026-10-12 04:40Placer AIthegentlemenTechnology
2026-10-12 04:39BigIDthegentlemenTechnology
2026-10-12 04:39ConfluentthegentlemenTechnology
2026-10-12 04:38KFCthegentlemenRetail & E-Commerce
2026-10-12 03:23Eversource EnergyRedactEnergy & Utilities
2026-10-11 20:21huntcompanies.comBrainCipher—
2026-10-11 15:28Reed & Giordano PArhysidaProfessional Services
2026-10-11 14:24Company #29N0nTechnology
2026-10-11 14:24Company #28N0nProfessional Services
2026-10-11 14:23Company #26N0nHealthcare
2026-10-11 14:22Company #25N0nHealthcare
2026-10-11 12:03Friendship Christian SchoolqilinEducation
2026-10-11 06:31Charles E. Tabor AAL LLCrhysidaOther
2026-10-10 16:53DexComRedactHealthcare
2026-10-10 12:46Gress Clark Young & SchoepperrhysidaProfessional Services

All ransomware victims in United States →

Other countries