Attacker Intelligence
IPs observed targeting KEVIntel sensors, mapped to exploited CVEs.
1,502
Unique Attacker IPs
19,554
Exploitation Events
86
Countries
59
KEVs Targeted
Top Attacker IPs
Source IPs ranked by observed exploitation attempts in the selected window.
2026-04-20 09:42 UTC – 2026-07-19 09:42 UTC
| Rank | Attacker | Attempts | CVEs | First Seen | Last Seen | Country | Network |
|---|---|---|---|---|---|---|---|
| 1 | Attacker #1 🇩🇪 | 2,048 | 32 | 2026-07-03 02:13 UTC | 2026-07-03 08:25 UTC | Frankfurt am Main, Hesse, Germany | AS16276 · OVH SAS |
| 2 | Attacker #2 🇺🇸 | 1,561 | 5 | 2026-06-16 10:41 UTC | 2026-07-03 13:35 UTC | North Bergen, New Jersey, United States | AS14061 · DigitalOcean, LLC |
| 3 | Attacker #3 🇺🇸 | 909 | 2 | 2026-07-01 01:33 UTC | 2026-07-03 08:24 UTC | Ashburn, Virginia, United States | AS14618 · Amazon.com, Inc. |
| 4 | Attacker #4 🇺🇸 | 406 | 3 | 2026-06-20 16:16 UTC | 2026-07-03 08:24 UTC | North Bergen, New Jersey, United States | AS14061 · DigitalOcean, LLC |
| 5 | Attacker #5 🇭🇰 | 316 | 3 | 2026-06-18 10:04 UTC | 2026-07-03 08:24 UTC | Hong Kong | AS134972 · IKUUU NETWORK LTD |
| 6 | Attacker #6 🇺🇸 | 307 | 28 | 2026-06-16 12:38 UTC | 2026-07-03 08:24 UTC | United States | AS199959 · Gwy It Pty Ltd |
| 7 | Attacker #7 🇷🇴 | 300 | 1 | 2026-07-14 09:49 UTC | 2026-07-16 06:28 UTC | Bucharest, Bucharest, Romania | AS9009 · M247 Europe SRL |
| 8 | Attacker #8 🇺🇸 | 287 | 1 | 2026-06-11 08:54 UTC | 2026-07-03 08:24 UTC | Chicago, Illinois, United States | AS212238 · Datacamp Limited |
| 9 | Attacker #9 🇺🇸 | 274 | 1 | 2026-06-14 20:24 UTC | 2026-07-03 08:24 UTC | United States | AS138415 · Yancy Limited |
| 10 | Attacker #10 🇺🇦 | 261 | 1 | 2026-07-04 11:58 UTC | 2026-07-04 12:53 UTC | Kyiv, Kyiv City, Ukraine | AS212238 · Datacamp Limited |
| 11 | Attacker #11 🇰🇷 | 238 | 1 | 2026-07-03 07:24 UTC | 2026-07-03 08:24 UTC | Incheon, Incheon, South Korea | AS199524 · G-Core Labs S.A. |
| 12 | Attacker #12 🇯🇵 | 191 | 1 | 2026-07-13 12:06 UTC | 2026-07-13 14:59 UTC | Tokyo, Tokyo, Japan | AS199524 · G-Core Labs S.A. |
| 13 | Attacker #13 🇮🇩 | 182 | 1 | 2026-06-14 18:44 UTC | 2026-07-03 08:24 UTC | South Tangerang, Banten, Indonesia | AS23700 · Linknet-Fastnet ASN |
| 14 | Attacker #14 🇯🇵 | 176 | 1 | 2026-06-30 15:23 UTC | 2026-07-11 15:37 UTC | Nakano City, Tokyo, Japan | AS2516 · KDDI CORPORATION |
| 15 | Attacker #15 🇮🇩 | 172 | 1 | 2026-06-16 12:29 UTC | 2026-07-03 08:24 UTC | Jakarta, Jakarta, Indonesia | AS21859 · Zenlayer Inc |
| 16 | Attacker #16 🇫🇷 | 162 | 1 | 2026-07-02 03:56 UTC | 2026-07-03 08:24 UTC | Lauterbourg, Grand Est, France | AS51167 · Contabo GmbH |
| 17 | Attacker #17 🇫🇷 | 161 | 1 | 2026-06-11 02:30 UTC | 2026-07-03 08:24 UTC | Aubervilliers, Île-de-France, France | AS3215 · Orange |
| 18 | Attacker #18 🇺🇸 | 160 | 1 | 2026-07-03 01:04 UTC | 2026-07-03 08:24 UTC | San Jose, California, United States | AS54600 · PEG TECH INC |
| 19 | Attacker #19 🇨🇾 | 160 | 1 | 2026-06-13 09:52 UTC | 2026-07-03 08:24 UTC | Cyprus | AS197648 · Cloudlayer8 Limited |
| 20 | Attacker #20 🇧🇬 | 156 | 2 | 2026-06-16 12:48 UTC | 2026-07-03 08:24 UTC | Bulgaria | AS209160 · Miti 2000 EOOD |
| 21 | Attacker #21 🇵🇭 | 126 | 1 | 2026-06-21 21:09 UTC | 2026-07-03 08:24 UTC | Cebu City, Central Visayas, Philippines | AS9299 · Philippine Long Distance Telephone Company |
| 22 | Attacker #22 🇲🇩 | 125 | 1 | 2026-06-11 08:07 UTC | 2026-07-03 08:24 UTC | Chisinau, Chișinău Municipality, Moldova | AS39798 · MivoCloud SRL |
| 23 | Attacker #23 🇺🇸 | 119 | 28 | 2026-06-29 02:53 UTC | 2026-07-03 08:24 UTC | New York, New York, United States | AS64286 · LogicWeb Inc. |
| 24 | Attacker #24 🇳🇱 | 114 | 1 | 2026-06-29 17:18 UTC | 2026-07-19 07:10 UTC | Amsterdam, North Holland, The Netherlands | AS219502 · Storm Industries LLC |
| 25 | Attacker #25 🇰🇿 | 112 | 2 | 2026-06-15 10:59 UTC | 2026-07-19 08:48 UTC | Kazakhstan | AS197556 · Kar-Tel LLC |
| 26 | Attacker #26 🇺🇸 | 110 | 1 | 2026-06-26 12:58 UTC | 2026-07-03 08:24 UTC | United States | AS136209 · CyberForest LLC. |
| 27 | Attacker #27 🇳🇱 | 99 | 1 | 2026-06-27 12:55 UTC | 2026-07-03 08:24 UTC | Naaldwijk, South Holland, The Netherlands | AS49981 · WorldStream B.V. |
| 28 | Attacker #28 🇸🇮 | 96 | 1 | 2026-06-29 14:24 UTC | 2026-07-03 08:24 UTC | Ljubljana, Ljubljana, Slovenia | AS203020 · HostRoyale Technologies Pvt Ltd |
| 29 | Attacker #29 🇩🇪 | 92 | 3 | 2026-06-25 17:17 UTC | 2026-07-19 08:16 UTC | Falkenstein, Saxony, Germany | AS24940 · Hetzner Online GmbH |
| 30 | Attacker #30 🇪🇪 | 91 | 28 | 2026-06-12 00:32 UTC | 2026-07-03 08:24 UTC | Tallinn, Harjumaa, Estonia | AS41745 · Baykov Ilya Sergeevich |
| 31 | Attacker #31 🇺🇸 | 91 | 1 | 2026-06-29 13:36 UTC | 2026-07-03 08:24 UTC | Cedar Knolls, New Jersey, United States | AS63949 · Akamai Connected Cloud |
| 32 | Attacker #32 🇰🇷 | 90 | 1 | 2026-06-11 06:25 UTC | 2026-07-18 21:35 UTC | Iksan, Jeollabuk-do, South Korea | AS4766 · Korea Telecom |
| 33 | Attacker #33 🇻🇳 | 86 | 27 | 2026-06-29 01:36 UTC | 2026-07-03 08:24 UTC | Hanoi, Hanoi, Vietnam | AS45899 · VNPT Corp |
| 34 | Attacker #34 🇨🇦 | 83 | 1 | 2026-07-19 06:19 UTC | 2026-07-19 06:26 UTC | Canada | AS32613 · Leaseweb Canada Inc. |
| 35 | Attacker #35 🇯🇵 | 76 | 1 | 2026-06-14 17:58 UTC | 2026-07-03 08:24 UTC | Tokyo, Tokyo, Japan | AS36002 · GoMami Networks |
| 36 | Attacker #36 🇩🇪 | 75 | 1 | 2026-06-30 08:09 UTC | 2026-07-03 08:24 UTC | Frankfurt am Main, Hesse, Germany | AS14061 · DigitalOcean, LLC |
| 37 | Attacker #37 🇺🇸 | 74 | 1 | 2026-06-21 09:01 UTC | 2026-07-03 08:24 UTC | North Bergen, New Jersey, United States | AS14061 · DigitalOcean, LLC |
| 38 | Attacker #38 🇺🇸 | 72 | 1 | 2026-07-03 07:40 UTC | 2026-07-03 08:25 UTC | Los Angeles, California, United States | AS46475 · Limestone Networks, Inc. |
| 39 | Attacker #39 🇯🇵 | 71 | 2 | 2026-06-12 05:18 UTC | 2026-07-17 04:57 UTC | Tokyo, Tokyo, Japan | AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED |
| 40 | Attacker #40 🇪🇬 | 71 | 1 | 2026-06-25 17:52 UTC | 2026-07-03 08:24 UTC | Cairo, Cairo Governorate, Egypt | AS8452 · IDDQD-AS |
| 41 | Attacker #41 🇮🇳 | 70 | 25 | 2026-06-27 09:35 UTC | 2026-07-03 08:24 UTC | Ahmedabad, Gujarat, India | AS55836 · Reliance Jio Infocomm Limited |
| 42 | Attacker #42 🇸🇬 | 67 | 1 | 2026-07-02 01:45 UTC | 2026-07-03 08:24 UTC | Singapore, Singapore | AS212238 · Datacamp Limited |
| 43 | Attacker #43 🇮🇩 | 65 | 2 | 2026-06-16 06:54 UTC | 2026-07-18 22:35 UTC | Tangerang, Banten, Indonesia | AS17727 · PT. NAP Info Lintas Nusa |
| 44 | Attacker #44 🇸🇬 | 64 | 2 | 2026-06-11 10:04 UTC | 2026-07-17 16:47 UTC | Singapore, Singapore | AS150436 · Byteplus Pte. Ltd. |
| 45 | Attacker #45 🇳🇱 | 61 | 2 | 2026-06-23 06:55 UTC | 2026-07-05 17:33 UTC | Eygelshoven, Limburg, The Netherlands | AS51396 · Pfcloud UG (haftungsbeschrankt) |
| 46 | Attacker #46 🇫🇷 | 58 | 4 | 2026-06-30 14:29 UTC | 2026-07-16 12:37 UTC | France | AS211590 · Bucklog SARL |
| 47 | Attacker #47 🇫🇷 | 58 | 2 | 2026-06-30 14:41 UTC | 2026-07-09 01:42 UTC | Paris, Île-de-France, France | AS12876 · Scaleway SAS |
| 48 | Attacker #48 🇫🇷 | 58 | 3 | 2026-06-27 03:53 UTC | 2026-07-15 02:01 UTC | France | AS211590 · Bucklog SARL |
| 49 | Attacker #49 🇳🇱 | 58 | 35 | 2026-07-19 02:06 UTC | 2026-07-19 02:17 UTC | The Netherlands | AS43350 · NForce Entertainment B.V. |
| 50 | Attacker #50 🇺🇸 | 55 | 1 | 2026-06-18 14:43 UTC | 2026-07-03 08:24 UTC | Los Angeles, California, United States | AS174 · Cogent Communications, LLC |
Unlock attacker IP detail
Pro and Enterprise plans show individual attacker IPs, CVE mappings, first/last seen timestamps, and cross-sensor activity profiles.
Cross-CVE Attacker Intelligence
See which source IPs are targeting multiple exploited vulnerabilities, review per-CVE activity, and drill into Enterprise raw telemetry where available.