Attacker Intelligence
IPs observed targeting KEVIntel sensors, mapped to exploited CVEs.
443
Unique Attacker IPs
2,640
Exploitation Events
53
Countries
54
KEVs Targeted
Top Attacker IPs
Source IPs ranked by observed exploitation attempts in the selected window.
2026-07-12 03:17 UTC – 2026-07-19 03:17 UTC
| Rank | Attacker | Attempts | CVEs | First Seen | Last Seen | Country | Network |
|---|---|---|---|---|---|---|---|
| 1 | Attacker #1 🇷🇴 | 300 | 1 | 2026-07-14 09:49 UTC | 2026-07-16 06:28 UTC | Bucharest, Bucharest, Romania | AS9009 · M247 Europe SRL |
| 2 | Attacker #2 🇯🇵 | 191 | 1 | 2026-07-13 12:06 UTC | 2026-07-13 14:59 UTC | Tokyo, Tokyo, Japan | AS199524 · G-Core Labs S.A. |
| 3 | Attacker #3 🇳🇱 | 58 | 35 | 2026-07-19 02:06 UTC | 2026-07-19 02:17 UTC | The Netherlands | AS43350 · NForce Entertainment B.V. |
| 4 | Attacker #4 🇫🇮 | 47 | 1 | 2026-07-16 09:25 UTC | 2026-07-16 11:43 UTC | Helsinki, Uusimaa, Finland | AS213702 · QWINS LTD |
| 5 | Attacker #5 🇭🇰 | 40 | 1 | 2026-07-17 09:24 UTC | 2026-07-17 10:09 UTC | Hong Kong | AS967 · VMISS Inc. |
| 6 | Attacker #6 🇰🇿 | 36 | 2 | 2026-07-12 10:06 UTC | 2026-07-18 21:40 UTC | Kazakhstan | AS197556 · Kar-Tel LLC |
| 7 | Attacker #7 🇫🇷 | 32 | 3 | 2026-07-14 22:30 UTC | 2026-07-15 02:01 UTC | France | AS211590 · Bucklog SARL |
| 8 | Attacker #8 🇳🇱 | 32 | 1 | 2026-07-12 05:55 UTC | 2026-07-19 02:11 UTC | Amsterdam, North Holland, The Netherlands | AS219502 · Storm Industries LLC |
| 9 | Attacker #9 🇫🇷 | 31 | 4 | 2026-07-12 04:45 UTC | 2026-07-16 05:03 UTC | France | AS211590 · Bucklog SARL |
| 10 | Attacker #10 🇰🇷 | 31 | 1 | 2026-07-12 07:47 UTC | 2026-07-18 21:35 UTC | Iksan, Jeollabuk-do, South Korea | AS4766 · Korea Telecom |
| 11 | Attacker #11 🇮🇩 | 30 | 2 | 2026-07-12 08:07 UTC | 2026-07-18 22:35 UTC | Tangerang, Banten, Indonesia | AS17727 · PT. NAP Info Lintas Nusa |
| 12 | Attacker #12 🇫🇷 | 30 | 4 | 2026-07-16 01:34 UTC | 2026-07-16 12:16 UTC | France | AS211590 · Bucklog SARL |
| 13 | Attacker #13 🇯🇵 | 30 | 2 | 2026-07-12 05:50 UTC | 2026-07-17 04:57 UTC | Tokyo, Tokyo, Japan | AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED |
| 14 | Attacker #14 🇩🇪 | 29 | 2 | 2026-07-12 10:25 UTC | 2026-07-19 00:03 UTC | Falkenstein, Saxony, Germany | AS24940 · Hetzner Online GmbH |
| 15 | Attacker #15 🇸🇬 | 27 | 2 | 2026-07-13 08:06 UTC | 2026-07-18 18:45 UTC | Singapore, Singapore | AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED |
| 16 | Attacker #16 🇨🇳 | 26 | 2 | 2026-07-12 06:25 UTC | 2026-07-19 01:04 UTC | China | AS4837 · CHINA UNICOM China169 Backbone |
| 17 | Attacker #17 🇭🇰 | 24 | 1 | 2026-07-14 00:54 UTC | 2026-07-14 01:27 UTC | Hong Kong, Hong Kong | AS38136 · Akari Networks |
| 18 | Attacker #18 🇨🇳 | 24 | 1 | 2026-07-14 03:51 UTC | 2026-07-14 03:57 UTC | China | AS24445 · Henan Mobile Communications Co.,Ltd |
| 19 | Attacker #19 🇮🇩 | 20 | 1 | 2026-07-13 02:15 UTC | 2026-07-13 02:39 UTC | Indonesia | AS150493 · PT Gunung Sedayu Sentosa |
| 20 | Attacker #20 🇸🇬 | 19 | 2 | 2026-07-12 20:36 UTC | 2026-07-17 16:47 UTC | Singapore, Singapore | AS150436 · Byteplus Pte. Ltd. |
| 21 | Attacker #21 🇸🇬 | 18 | 2 | 2026-07-12 14:38 UTC | 2026-07-18 09:09 UTC | Singapore, Singapore | AS14061 · DigitalOcean, LLC |
| 22 | Attacker #22 🇬🇧 | 18 | 2 | 2026-07-12 08:34 UTC | 2026-07-18 21:53 UTC | United Kingdom | AS215540 · Global Connectivity Solutions Llp |
| 23 | Attacker #23 🇭🇰 | 18 | 4 | 2026-07-17 16:26 UTC | 2026-07-18 07:19 UTC | Hong Kong, Hong Kong | AS979 · NetLab Global |
| 24 | Attacker #24 🇵🇱 | 17 | 2 | 2026-07-13 19:45 UTC | 2026-07-15 17:23 UTC | Poland | AS202520 · SkyPass Solutions Sp. z.o.o. |
| 25 | Attacker #25 🇦🇺 | 17 | 2 | 2026-07-12 18:52 UTC | 2026-07-13 19:10 UTC | Australia | AS133159 · Mammoth Media Pty Ltd |
| 26 | Attacker #26 🇺🇸 | 16 | 3 | 2026-07-16 20:42 UTC | 2026-07-16 20:42 UTC | Ashburn, Virginia, United States | AS14618 · Amazon.com, Inc. |
| 27 | Attacker #27 🇫🇷 | 16 | 3 | 2026-07-15 07:23 UTC | 2026-07-15 07:24 UTC | France | AS211590 · Bucklog SARL |
| 28 | Attacker #28 🇻🇳 | 16 | 2 | 2026-07-14 04:06 UTC | 2026-07-19 01:02 UTC | Vietnam | AS151858 · INTERDIGI JOINT STOCK COMPANY |
| 29 | Attacker #29 🇫🇷 | 16 | 3 | 2026-07-15 00:03 UTC | 2026-07-15 00:03 UTC | France | AS211590 · Bucklog SARL |
| 30 | Attacker #30 🇺🇸 | 16 | 3 | 2026-07-16 20:25 UTC | 2026-07-16 20:26 UTC | Ashburn, Virginia, United States | AS14618 · Amazon.com, Inc. |
| 31 | Attacker #31 🇫🇷 | 16 | 3 | 2026-07-14 23:27 UTC | 2026-07-14 23:29 UTC | France | AS211590 · Bucklog SARL |
| 32 | Attacker #32 🇫🇷 | 16 | 3 | 2026-07-15 03:00 UTC | 2026-07-15 03:02 UTC | France | AS211590 · Bucklog SARL |
| 33 | Attacker #33 🇫🇷 | 16 | 3 | 2026-07-16 06:59 UTC | 2026-07-16 07:00 UTC | France | AS211590 · Bucklog SARL |
| 34 | Attacker #34 🇫🇷 | 16 | 3 | 2026-07-15 07:21 UTC | 2026-07-15 07:22 UTC | France | AS211590 · Bucklog SARL |
| 35 | Attacker #35 🇫🇷 | 16 | 3 | 2026-07-16 12:37 UTC | 2026-07-16 12:37 UTC | France | AS211590 · Bucklog SARL |
| 36 | Attacker #36 🇵🇱 | 16 | 4 | 2026-07-15 22:30 UTC | 2026-07-16 20:19 UTC | Warsaw, Mazovia, Poland | AS212238 · Datacamp Limited |
| 37 | Attacker #37 🇺🇸 | 16 | 3 | 2026-07-16 21:22 UTC | 2026-07-16 21:23 UTC | Ashburn, Virginia, United States | AS14618 · Amazon.com, Inc. |
| 38 | Attacker #38 🇺🇸 | 16 | 3 | 2026-07-16 20:53 UTC | 2026-07-16 20:54 UTC | Ashburn, Virginia, United States | AS14618 · Amazon.com, Inc. |
| 39 | Attacker #39 🇺🇸 | 15 | 3 | 2026-07-16 21:18 UTC | 2026-07-16 21:19 UTC | Ashburn, Virginia, United States | AS14618 · Amazon.com, Inc. |
| 40 | Attacker #40 🇭🇰 | 14 | 2 | 2026-07-13 09:57 UTC | 2026-07-17 03:19 UTC | Hong Kong, Hong Kong | AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED |
| 41 | Attacker #41 🇺🇿 | 14 | 2 | 2026-07-12 16:29 UTC | 2026-07-18 03:07 UTC | Uzbekistan | AS202660 · Uzbektelekom Joint Stock Company |
| 42 | Attacker #42 🇮🇩 | 14 | 1 | 2026-07-16 09:16 UTC | 2026-07-18 23:32 UTC | Indonesia | AS140456 · PT Era Awan Digital |
| 43 | Attacker #43 🇨🇳 | 13 | 2 | 2026-07-12 08:28 UTC | 2026-07-18 06:15 UTC | China | AS9808 · China Mobile Communications Group Co., Ltd. |
| 44 | Attacker #44 🇧🇬 | 13 | 2 | 2026-07-16 19:27 UTC | 2026-07-18 13:30 UTC | Sofia, Sofia-Capital, Bulgaria | AS209604 · 2e Telekomunikasyon Ltd Sti |
| 45 | Attacker #45 🇸🇨 | 12 | 1 | 2026-07-14 07:57 UTC | 2026-07-18 19:06 UTC | Seychelles | AS49870 · Alsycon B.V. |
| 46 | Attacker #46 🇫🇷 | 12 | 1 | 2026-07-15 02:24 UTC | 2026-07-15 02:24 UTC | France | AS211590 · Bucklog SARL |
| 47 | Attacker #47 🇳🇱 | 12 | 2 | 2026-07-14 13:39 UTC | 2026-07-18 07:30 UTC | Dronten, Flevoland, The Netherlands | AS41745 · Baykov Ilya Sergeevich |
| 48 | Attacker #48 🇦🇪 | 12 | 1 | 2026-07-13 19:37 UTC | 2026-07-17 06:38 UTC | United Arab Emirates | AS203861 · Miteflux Technologies Ltd |
| 49 | Attacker #49 🇫🇷 | 12 | 1 | 2026-07-16 12:44 UTC | 2026-07-16 12:44 UTC | France | AS211590 · Bucklog SARL |
| 50 | Attacker #50 🇨🇳 | 12 | 2 | 2026-07-12 17:10 UTC | 2026-07-18 20:57 UTC | China | AS9808 · China Mobile Communications Group Co., Ltd. |
Unlock attacker IP detail
Pro and Enterprise plans show individual attacker IPs, CVE mappings, first/last seen timestamps, and cross-sensor activity profiles.
Cross-CVE Attacker Intelligence
See which source IPs are targeting multiple exploited vulnerabilities, review per-CVE activity, and drill into Enterprise raw telemetry where available.