Attacker Intelligence
IPs observed targeting KEVIntel sensors, mapped to exploited CVEs.
1,479
Unique Attacker IPs
17,208
Exploitation Events
86
Countries
58
KEVs Targeted
Top Attacker IPs
Source IPs ranked by observed exploitation attempts in the selected window.
2026-06-19 09:41 UTC – 2026-07-19 09:41 UTC
| Rank | Attacker | Attempts | CVEs | First Seen | Last Seen | Country | Network |
|---|---|---|---|---|---|---|---|
| 1 | Attacker #1 🇩🇪 | 2,048 | 32 | 2026-07-03 02:13 UTC | 2026-07-03 08:25 UTC | Frankfurt am Main, Hesse, Germany | AS16276 · OVH SAS |
| 2 | Attacker #2 🇺🇸 | 1,514 | 5 | 2026-06-21 16:28 UTC | 2026-07-03 13:35 UTC | North Bergen, New Jersey, United States | AS14061 · DigitalOcean, LLC |
| 3 | Attacker #3 🇺🇸 | 909 | 2 | 2026-07-01 01:33 UTC | 2026-07-03 08:24 UTC | Ashburn, Virginia, United States | AS14618 · Amazon.com, Inc. |
| 4 | Attacker #4 🇺🇸 | 406 | 3 | 2026-06-20 16:16 UTC | 2026-07-03 08:24 UTC | North Bergen, New Jersey, United States | AS14061 · DigitalOcean, LLC |
| 5 | Attacker #5 🇭🇰 | 309 | 3 | 2026-06-20 08:14 UTC | 2026-07-03 08:24 UTC | Hong Kong | AS134972 · IKUUU NETWORK LTD |
| 6 | Attacker #6 🇷🇴 | 300 | 1 | 2026-07-14 09:49 UTC | 2026-07-16 06:28 UTC | Bucharest, Bucharest, Romania | AS9009 · M247 Europe SRL |
| 7 | Attacker #7 🇺🇦 | 261 | 1 | 2026-07-04 11:58 UTC | 2026-07-04 12:53 UTC | Kyiv, Kyiv City, Ukraine | AS212238 · Datacamp Limited |
| 8 | Attacker #8 🇰🇷 | 238 | 1 | 2026-07-03 07:24 UTC | 2026-07-03 08:24 UTC | Incheon, Incheon, South Korea | AS199524 · G-Core Labs S.A. |
| 9 | Attacker #9 🇺🇸 | 212 | 28 | 2026-06-20 07:17 UTC | 2026-07-03 08:24 UTC | United States | AS199959 · Gwy It Pty Ltd |
| 10 | Attacker #10 🇯🇵 | 191 | 1 | 2026-07-13 12:06 UTC | 2026-07-13 14:59 UTC | Tokyo, Tokyo, Japan | AS199524 · G-Core Labs S.A. |
| 11 | Attacker #11 🇯🇵 | 176 | 1 | 2026-06-30 15:23 UTC | 2026-07-11 15:37 UTC | Nakano City, Tokyo, Japan | AS2516 · KDDI CORPORATION |
| 12 | Attacker #12 🇫🇷 | 162 | 1 | 2026-07-02 03:56 UTC | 2026-07-03 08:24 UTC | Lauterbourg, Grand Est, France | AS51167 · Contabo GmbH |
| 13 | Attacker #13 🇺🇸 | 160 | 1 | 2026-07-03 01:04 UTC | 2026-07-03 08:24 UTC | San Jose, California, United States | AS54600 · PEG TECH INC |
| 14 | Attacker #14 🇺🇸 | 139 | 1 | 2026-07-03 08:24 UTC | 2026-07-03 08:24 UTC | Chicago, Illinois, United States | AS212238 · Datacamp Limited |
| 15 | Attacker #15 🇺🇸 | 137 | 1 | 2026-07-03 08:24 UTC | 2026-07-03 08:24 UTC | United States | AS138415 · Yancy Limited |
| 16 | Attacker #16 🇵🇭 | 126 | 1 | 2026-06-21 21:09 UTC | 2026-07-03 08:24 UTC | Cebu City, Central Visayas, Philippines | AS9299 · Philippine Long Distance Telephone Company |
| 17 | Attacker #17 🇺🇸 | 119 | 28 | 2026-06-29 02:53 UTC | 2026-07-03 08:24 UTC | New York, New York, United States | AS64286 · LogicWeb Inc. |
| 18 | Attacker #18 🇳🇱 | 114 | 1 | 2026-06-29 17:18 UTC | 2026-07-19 07:10 UTC | Amsterdam, North Holland, The Netherlands | AS219502 · Storm Industries LLC |
| 19 | Attacker #19 🇺🇸 | 110 | 1 | 2026-06-26 12:58 UTC | 2026-07-03 08:24 UTC | United States | AS136209 · CyberForest LLC. |
| 20 | Attacker #20 🇰🇿 | 106 | 2 | 2026-06-19 11:17 UTC | 2026-07-19 08:48 UTC | Kazakhstan | AS197556 · Kar-Tel LLC |
| 21 | Attacker #21 🇳🇱 | 99 | 1 | 2026-06-27 12:55 UTC | 2026-07-03 08:24 UTC | Naaldwijk, South Holland, The Netherlands | AS49981 · WorldStream B.V. |
| 22 | Attacker #22 🇸🇮 | 96 | 1 | 2026-06-29 14:24 UTC | 2026-07-03 08:24 UTC | Ljubljana, Ljubljana, Slovenia | AS203020 · HostRoyale Technologies Pvt Ltd |
| 23 | Attacker #23 🇩🇪 | 92 | 3 | 2026-06-25 17:17 UTC | 2026-07-19 08:16 UTC | Falkenstein, Saxony, Germany | AS24940 · Hetzner Online GmbH |
| 24 | Attacker #24 🇺🇸 | 91 | 1 | 2026-06-29 13:36 UTC | 2026-07-03 08:24 UTC | Cedar Knolls, New Jersey, United States | AS63949 · Akamai Connected Cloud |
| 25 | Attacker #25 🇮🇩 | 87 | 1 | 2026-07-03 08:24 UTC | 2026-07-03 08:24 UTC | South Tangerang, Banten, Indonesia | AS23700 · Linknet-Fastnet ASN |
| 26 | Attacker #26 🇮🇩 | 86 | 1 | 2026-07-03 08:24 UTC | 2026-07-03 08:24 UTC | Jakarta, Jakarta, Indonesia | AS21859 · Zenlayer Inc |
| 27 | Attacker #27 🇻🇳 | 86 | 27 | 2026-06-29 01:36 UTC | 2026-07-03 08:24 UTC | Hanoi, Hanoi, Vietnam | AS45899 · VNPT Corp |
| 28 | Attacker #28 🇨🇦 | 83 | 1 | 2026-07-19 06:19 UTC | 2026-07-19 06:26 UTC | Canada | AS32613 · Leaseweb Canada Inc. |
| 29 | Attacker #29 🇰🇷 | 81 | 1 | 2026-06-19 21:13 UTC | 2026-07-18 21:35 UTC | Iksan, Jeollabuk-do, South Korea | AS4766 · Korea Telecom |
| 30 | Attacker #30 🇨🇾 | 78 | 1 | 2026-07-03 08:24 UTC | 2026-07-03 08:24 UTC | Cyprus | AS197648 · Cloudlayer8 Limited |
| 31 | Attacker #31 🇫🇷 | 76 | 1 | 2026-07-03 08:24 UTC | 2026-07-03 08:24 UTC | Aubervilliers, Île-de-France, France | AS3215 · Orange |
| 32 | Attacker #32 🇩🇪 | 75 | 1 | 2026-06-30 08:09 UTC | 2026-07-03 08:24 UTC | Frankfurt am Main, Hesse, Germany | AS14061 · DigitalOcean, LLC |
| 33 | Attacker #33 🇺🇸 | 74 | 1 | 2026-06-21 09:01 UTC | 2026-07-03 08:24 UTC | North Bergen, New Jersey, United States | AS14061 · DigitalOcean, LLC |
| 34 | Attacker #34 🇺🇸 | 72 | 1 | 2026-07-03 07:40 UTC | 2026-07-03 08:25 UTC | Los Angeles, California, United States | AS46475 · Limestone Networks, Inc. |
| 35 | Attacker #35 🇪🇬 | 71 | 1 | 2026-06-25 17:52 UTC | 2026-07-03 08:24 UTC | Cairo, Cairo Governorate, Egypt | AS8452 · IDDQD-AS |
| 36 | Attacker #36 🇧🇬 | 71 | 2 | 2026-07-03 08:24 UTC | 2026-07-03 08:24 UTC | Bulgaria | AS209160 · Miti 2000 EOOD |
| 37 | Attacker #37 🇮🇳 | 70 | 25 | 2026-06-27 09:35 UTC | 2026-07-03 08:24 UTC | Ahmedabad, Gujarat, India | AS55836 · Reliance Jio Infocomm Limited |
| 38 | Attacker #38 🇯🇵 | 69 | 2 | 2026-06-24 21:22 UTC | 2026-07-17 04:57 UTC | Tokyo, Tokyo, Japan | AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED |
| 39 | Attacker #39 🇸🇬 | 67 | 1 | 2026-07-02 01:45 UTC | 2026-07-03 08:24 UTC | Singapore, Singapore | AS212238 · Datacamp Limited |
| 40 | Attacker #40 🇮🇩 | 63 | 2 | 2026-06-19 21:22 UTC | 2026-07-18 22:35 UTC | Tangerang, Banten, Indonesia | AS17727 · PT. NAP Info Lintas Nusa |
| 41 | Attacker #41 🇳🇱 | 61 | 2 | 2026-06-23 06:55 UTC | 2026-07-05 17:33 UTC | Eygelshoven, Limburg, The Netherlands | AS51396 · Pfcloud UG (haftungsbeschrankt) |
| 42 | Attacker #42 🇸🇬 | 60 | 2 | 2026-06-19 15:47 UTC | 2026-07-17 16:47 UTC | Singapore, Singapore | AS150436 · Byteplus Pte. Ltd. |
| 43 | Attacker #43 🇫🇷 | 58 | 3 | 2026-06-27 03:53 UTC | 2026-07-15 02:01 UTC | France | AS211590 · Bucklog SARL |
| 44 | Attacker #44 🇲🇩 | 58 | 1 | 2026-07-03 08:24 UTC | 2026-07-03 08:24 UTC | Chisinau, Chișinău Municipality, Moldova | AS39798 · MivoCloud SRL |
| 45 | Attacker #45 🇫🇷 | 58 | 2 | 2026-06-30 14:41 UTC | 2026-07-09 01:42 UTC | Paris, Île-de-France, France | AS12876 · Scaleway SAS |
| 46 | Attacker #46 🇫🇷 | 58 | 4 | 2026-06-30 14:29 UTC | 2026-07-16 12:37 UTC | France | AS211590 · Bucklog SARL |
| 47 | Attacker #47 🇳🇱 | 58 | 35 | 2026-07-19 02:06 UTC | 2026-07-19 02:17 UTC | The Netherlands | AS43350 · NForce Entertainment B.V. |
| 48 | Attacker #48 🇭🇰 | 53 | 1 | 2026-06-29 06:51 UTC | 2026-07-03 08:24 UTC | Ha Kwai Chung, Kwai Tsing District, Hong Kong | AS138997 · Eons Data Communications Limited |
| 49 | Attacker #49 🇸🇬 | 53 | 2 | 2026-06-20 02:37 UTC | 2026-07-18 18:45 UTC | Singapore, Singapore | AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED |
| 50 | Attacker #50 🇮🇩 | 52 | 1 | 2026-07-01 19:31 UTC | 2026-07-03 08:24 UTC | West Jakarta, Jakarta, Indonesia | AS63859 · PT. Eka Mas Republik |
Unlock attacker IP detail
Pro and Enterprise plans show individual attacker IPs, CVE mappings, first/last seen timestamps, and cross-sensor activity profiles.
Cross-CVE Attacker Intelligence
See which source IPs are targeting multiple exploited vulnerabilities, review per-CVE activity, and drill into Enterprise raw telemetry where available.