Attacker IPs · last 12 h–Blocklist.de
LIVE · WORLDWIDE ATTACK ACTIVITY
Cypher Attack News
–attacker IPs · last hour
–new reports / min
–origin countries · 12 h
How to read this map. Dots and country shading come from real reports of attacker IPs (origin = IP geolocation, approximate). Arc destinations are illustrative: free threat feeds do not publish who was attacked, so arcs fly to the destination you pick, or to a rotating mix of reference countries. New reports reach this page with about 30 s delay; the timing within a batch is spread out for display. Reported IPs can be spoofed, hijacked or proxies — this is not attribution.
Scan events today–SANS ISC / DShield
New exploited CVEs · 30 days–CISA KEV catalog
Data sources online–All systems
News
Headlines from public security feeds and ransomware leak-site claims
Security Headlines
SANS ISC · BleepingComputer · The Hacker News · Krebs · CISA — headlines link to the publisher
Ransomware Claims
Latest victims claimed on leak sites · ransomware.live
Claims are made by the criminal groups themselves and are unverified. Victim names are intentionally not shown.
Top Lists
Ranked by reports in the last 12 hours
Top Attack Types
By attacked service
Each IP is counted once, under the first matching service.
Top Attack Origins
Countries of attacker IPs · click to zoom
Top Targeted Ports
Today (UTC) · SANS ISC
Top Targeted Countries
Ransomware claims · ransomware.live
Real victim countries, but only for ransomware claims.
Analysis
Trends and infrastructure behind the attacks
Activity Over Time
Attacker IPs by time of last report
Older hours look lower because IPs reported repeatedly are counted in the newest window.
Top Attacker Networks
Autonomous systems hosting attackers
Top Attacking /24 Blocks
Last 3 days · DShield block list
Most Active Source IPs
Today (UTC) · SANS ISC
Longest-running scanners
Threat Intel
Vulnerabilities, botnets, phishing and independent blocklists
Actively Exploited Vulnerabilities
CISA Known Exploited Vulnerabilities
Most Exploited Vendors
CVEs added in the last 12 months · CISA KEV
Botnet C2 Servers
abuse.ch Feodo Tracker
Internet Scan Activity
SANS Internet Storm Center · today (UTC)
Threat Feeds at a Glance
Independent sources used to cross-check reports
Phishing Infrastructure
Active phishing URLs · OpenPhish community feed
Domains are shown defanged. Cloud and hosting platforms are abused, not necessarily malicious themselves.
Data Sources & System Status
Availability and freshness of every connected source
| Source | Content | Status | Last success | Interval | Items |
|---|