Attacker Intelligence
IPs observed targeting KEVIntel sensors, mapped to exploited CVEs.
446
Unique Attacker IPs
2,705
Exploitation Events
54
Countries
54
KEVs Targeted
Top Attacker IPs
Source IPs ranked by observed exploitation attempts in the selected window.
2026-07-12 09:41 UTC – 2026-07-19 09:41 UTC
| Rank | Attacker | Attempts | CVEs | First Seen | Last Seen | Country | Network |
|---|---|---|---|---|---|---|---|
| 1 | Attacker #1 🇷🇴 | 300 | 1 | 2026-07-14 09:49 UTC | 2026-07-16 06:28 UTC | Bucharest, Bucharest, Romania | AS9009 · M247 Europe SRL |
| 2 | Attacker #2 🇯🇵 | 191 | 1 | 2026-07-13 12:06 UTC | 2026-07-13 14:59 UTC | Tokyo, Tokyo, Japan | AS199524 · G-Core Labs S.A. |
| 3 | Attacker #3 🇨🇦 | 83 | 1 | 2026-07-19 06:19 UTC | 2026-07-19 06:26 UTC | Canada | AS32613 · Leaseweb Canada Inc. |
| 4 | Attacker #4 🇳🇱 | 58 | 35 | 2026-07-19 02:06 UTC | 2026-07-19 02:17 UTC | The Netherlands | AS43350 · NForce Entertainment B.V. |
| 5 | Attacker #5 🇫🇮 | 47 | 1 | 2026-07-16 09:25 UTC | 2026-07-16 11:43 UTC | Helsinki, Uusimaa, Finland | AS213702 · QWINS LTD |
| 6 | Attacker #6 🇰🇿 | 42 | 2 | 2026-07-12 10:06 UTC | 2026-07-19 08:48 UTC | Kazakhstan | AS197556 · Kar-Tel LLC |
| 7 | Attacker #7 🇭🇰 | 40 | 1 | 2026-07-17 09:24 UTC | 2026-07-17 10:09 UTC | Hong Kong | AS967 · VMISS Inc. |
| 8 | Attacker #8 🇳🇱 | 32 | 1 | 2026-07-12 14:01 UTC | 2026-07-19 07:10 UTC | Amsterdam, North Holland, The Netherlands | AS219502 · Storm Industries LLC |
| 9 | Attacker #9 🇫🇷 | 32 | 3 | 2026-07-14 22:30 UTC | 2026-07-15 02:01 UTC | France | AS211590 · Bucklog SARL |
| 10 | Attacker #10 🇩🇪 | 30 | 2 | 2026-07-12 10:25 UTC | 2026-07-19 08:16 UTC | Falkenstein, Saxony, Germany | AS24940 · Hetzner Online GmbH |
| 11 | Attacker #11 🇫🇷 | 30 | 4 | 2026-07-16 01:34 UTC | 2026-07-16 12:16 UTC | France | AS211590 · Bucklog SARL |
| 12 | Attacker #12 🇮🇩 | 29 | 2 | 2026-07-12 11:01 UTC | 2026-07-18 22:35 UTC | Tangerang, Banten, Indonesia | AS17727 · PT. NAP Info Lintas Nusa |
| 13 | Attacker #13 🇰🇷 | 29 | 1 | 2026-07-12 18:39 UTC | 2026-07-18 21:35 UTC | Iksan, Jeollabuk-do, South Korea | AS4766 · Korea Telecom |
| 14 | Attacker #14 🇨🇳 | 28 | 2 | 2026-07-12 23:44 UTC | 2026-07-19 06:54 UTC | China | AS4837 · CHINA UNICOM China169 Backbone |
| 15 | Attacker #15 🇸🇬 | 27 | 2 | 2026-07-13 08:06 UTC | 2026-07-18 18:45 UTC | Singapore, Singapore | AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED |
| 16 | Attacker #16 🇯🇵 | 27 | 2 | 2026-07-12 18:21 UTC | 2026-07-17 04:57 UTC | Tokyo, Tokyo, Japan | AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED |
| 17 | Attacker #17 🇨🇳 | 24 | 1 | 2026-07-14 03:51 UTC | 2026-07-14 03:57 UTC | China | AS24445 · Henan Mobile Communications Co.,Ltd |
| 18 | Attacker #18 🇭🇰 | 24 | 1 | 2026-07-14 00:54 UTC | 2026-07-14 01:27 UTC | Hong Kong, Hong Kong | AS38136 · Akari Networks |
| 19 | Attacker #19 🇮🇩 | 20 | 1 | 2026-07-13 02:15 UTC | 2026-07-13 02:39 UTC | Indonesia | AS150493 · PT Gunung Sedayu Sentosa |
| 20 | Attacker #20 🇸🇬 | 19 | 2 | 2026-07-12 20:36 UTC | 2026-07-17 16:47 UTC | Singapore, Singapore | AS150436 · Byteplus Pte. Ltd. |
| 21 | Attacker #21 🇸🇬 | 19 | 2 | 2026-07-12 14:38 UTC | 2026-07-19 04:29 UTC | Singapore, Singapore | AS14061 · DigitalOcean, LLC |
| 22 | Attacker #22 🇭🇰 | 18 | 4 | 2026-07-17 16:26 UTC | 2026-07-18 07:19 UTC | Hong Kong, Hong Kong | AS979 · NetLab Global |
| 23 | Attacker #23 🇦🇺 | 17 | 2 | 2026-07-12 18:52 UTC | 2026-07-13 19:10 UTC | Australia | AS133159 · Mammoth Media Pty Ltd |
| 24 | Attacker #24 🇵🇱 | 17 | 2 | 2026-07-13 19:45 UTC | 2026-07-15 17:23 UTC | Poland | AS202520 · SkyPass Solutions Sp. z.o.o. |
| 25 | Attacker #25 🇫🇷 | 16 | 3 | 2026-07-14 23:27 UTC | 2026-07-14 23:29 UTC | France | AS211590 · Bucklog SARL |
| 26 | Attacker #26 🇫🇷 | 16 | 3 | 2026-07-16 06:59 UTC | 2026-07-16 07:00 UTC | France | AS211590 · Bucklog SARL |
| 27 | Attacker #27 🇺🇸 | 16 | 3 | 2026-07-16 20:42 UTC | 2026-07-16 20:42 UTC | Ashburn, Virginia, United States | AS14618 · Amazon.com, Inc. |
| 28 | Attacker #28 🇵🇱 | 16 | 4 | 2026-07-15 22:30 UTC | 2026-07-16 20:19 UTC | Warsaw, Mazovia, Poland | AS212238 · Datacamp Limited |
| 29 | Attacker #29 🇫🇷 | 16 | 3 | 2026-07-15 03:00 UTC | 2026-07-15 03:02 UTC | France | AS211590 · Bucklog SARL |
| 30 | Attacker #30 🇫🇷 | 16 | 3 | 2026-07-15 07:23 UTC | 2026-07-15 07:24 UTC | France | AS211590 · Bucklog SARL |
| 31 | Attacker #31 🇫🇷 | 16 | 3 | 2026-07-16 12:37 UTC | 2026-07-16 12:37 UTC | France | AS211590 · Bucklog SARL |
| 32 | Attacker #32 🇺🇸 | 16 | 3 | 2026-07-16 20:53 UTC | 2026-07-16 20:54 UTC | Ashburn, Virginia, United States | AS14618 · Amazon.com, Inc. |
| 33 | Attacker #33 🇫🇷 | 16 | 3 | 2026-07-15 07:21 UTC | 2026-07-15 07:22 UTC | France | AS211590 · Bucklog SARL |
| 34 | Attacker #34 🇺🇸 | 16 | 3 | 2026-07-16 20:25 UTC | 2026-07-16 20:26 UTC | Ashburn, Virginia, United States | AS14618 · Amazon.com, Inc. |
| 35 | Attacker #35 🇫🇷 | 16 | 3 | 2026-07-15 00:03 UTC | 2026-07-15 00:03 UTC | France | AS211590 · Bucklog SARL |
| 36 | Attacker #36 🇺🇸 | 16 | 3 | 2026-07-16 21:22 UTC | 2026-07-16 21:23 UTC | Ashburn, Virginia, United States | AS14618 · Amazon.com, Inc. |
| 37 | Attacker #37 🇻🇳 | 16 | 2 | 2026-07-14 04:06 UTC | 2026-07-19 01:02 UTC | Vietnam | AS151858 · INTERDIGI JOINT STOCK COMPANY |
| 38 | Attacker #38 🇺🇿 | 15 | 2 | 2026-07-12 16:29 UTC | 2026-07-19 09:15 UTC | Uzbekistan | AS202660 · Uzbektelekom Joint Stock Company |
| 39 | Attacker #39 🇬🇧 | 15 | 2 | 2026-07-12 20:15 UTC | 2026-07-18 21:53 UTC | United Kingdom | AS215540 · Global Connectivity Solutions Llp |
| 40 | Attacker #40 🇺🇸 | 15 | 3 | 2026-07-16 21:18 UTC | 2026-07-16 21:19 UTC | Ashburn, Virginia, United States | AS14618 · Amazon.com, Inc. |
| 41 | Attacker #41 🇭🇰 | 14 | 2 | 2026-07-13 09:57 UTC | 2026-07-17 03:19 UTC | Hong Kong, Hong Kong | AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED |
| 42 | Attacker #42 🇫🇷 | 14 | 3 | 2026-07-16 05:02 UTC | 2026-07-16 05:03 UTC | France | AS211590 · Bucklog SARL |
| 43 | Attacker #43 🇮🇩 | 14 | 1 | 2026-07-16 09:16 UTC | 2026-07-18 23:32 UTC | Indonesia | AS140456 · PT Era Awan Digital |
| 44 | Attacker #44 🇧🇬 | 13 | 2 | 2026-07-16 19:27 UTC | 2026-07-18 13:30 UTC | Sofia, Sofia-Capital, Bulgaria | AS209604 · 2e Telekomunikasyon Ltd Sti |
| 45 | Attacker #45 🇫🇷 | 12 | 1 | 2026-07-16 12:44 UTC | 2026-07-16 12:44 UTC | France | AS211590 · Bucklog SARL |
| 46 | Attacker #46 🇺🇸 | 12 | 1 | 2026-07-16 21:06 UTC | 2026-07-16 21:06 UTC | Ashburn, Virginia, United States | AS14618 · Amazon.com, Inc. |
| 47 | Attacker #47 🇹🇼 | 12 | 2 | 2026-07-14 11:32 UTC | 2026-07-19 02:21 UTC | Taipei, Taipei City, Taiwan | AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED |
| 48 | Attacker #48 🇳🇱 | 12 | 2 | 2026-07-14 13:39 UTC | 2026-07-18 07:30 UTC | Dronten, Flevoland, The Netherlands | AS41745 · Baykov Ilya Sergeevich |
| 49 | Attacker #49 🇱🇺 | 12 | 2 | 2026-07-14 23:08 UTC | 2026-07-17 21:44 UTC | Bissen, Mersch, Luxembourg | AS53667 · FranTech Solutions |
| 50 | Attacker #50 🇫🇷 | 12 | 1 | 2026-07-15 07:49 UTC | 2026-07-15 07:49 UTC | France | AS211590 · Bucklog SARL |
Unlock attacker IP detail
Pro and Enterprise plans show individual attacker IPs, CVE mappings, first/last seen timestamps, and cross-sensor activity profiles.
Cross-CVE Attacker Intelligence
See which source IPs are targeting multiple exploited vulnerabilities, review per-CVE activity, and drill into Enterprise raw telemetry where available.