Attacker Intelligence
IPs observed targeting KEVIntel sensors, mapped to exploited CVEs.
321
Unique Attacker IPs
1,902
Exploitation Events
56
Countries
32
KEVs Targeted
Top Attacker IPs
Source IPs ranked by observed exploitation attempts in the selected window.
2026-07-08 20:11 UTC – 2026-07-15 20:11 UTC
| Rank | Attacker | Attempts | CVEs | First Seen | Last Seen | Country | Network |
|---|---|---|---|---|---|---|---|
| 1 | Attacker #1 🇷🇴 | 295 | 1 | 2026-07-14 09:49 UTC | 2026-07-15 07:46 UTC | Bucharest, Bucharest, Romania | AS9009 · M247 Europe SRL |
| 2 | Attacker #2 🇯🇵 | 191 | 1 | 2026-07-13 12:06 UTC | 2026-07-13 14:59 UTC | Tokyo, Tokyo, Japan | AS199524 · G-Core Labs S.A. |
| 3 | Attacker #3 🇯🇵 | 71 | 1 | 2026-07-11 15:35 UTC | 2026-07-11 15:37 UTC | Nakano City, Tokyo, Japan | AS2516 · KDDI CORPORATION |
| 4 | Attacker #4 🇳🇱 | 44 | 1 | 2026-07-08 21:15 UTC | 2026-07-15 18:34 UTC | Amsterdam, North Holland, The Netherlands | AS219502 · Storm Industries LLC |
| 5 | Attacker #5 🇫🇷 | 33 | 4 | 2026-07-11 07:15 UTC | 2026-07-15 07:24 UTC | France | AS211590 · Bucklog SARL |
| 6 | Attacker #6 🇫🇷 | 32 | 2 | 2026-07-10 02:31 UTC | 2026-07-10 09:07 UTC | France | AS42960 · VH Global Limited |
| 7 | Attacker #7 🇫🇷 | 32 | 3 | 2026-07-14 22:30 UTC | 2026-07-15 02:01 UTC | France | AS211590 · Bucklog SARL |
| 8 | Attacker #8 🇫🇷 | 28 | 3 | 2026-07-09 06:22 UTC | 2026-07-14 23:29 UTC | France | AS211590 · Bucklog SARL |
| 9 | Attacker #9 🇸🇪 | 28 | 1 | 2026-07-09 13:44 UTC | 2026-07-09 13:44 UTC | Malmö, Skåne County, Sweden | AS39351 · 31173 Services AB |
| 10 | Attacker #10 🇫🇷 | 28 | 3 | 2026-07-11 07:49 UTC | 2026-07-15 07:22 UTC | France | AS211590 · Bucklog SARL |
| 11 | Attacker #11 🇰🇷 | 27 | 1 | 2026-07-09 03:46 UTC | 2026-07-15 15:13 UTC | Iksan, Jeollabuk-do, South Korea | AS4766 · Korea Telecom |
| 12 | Attacker #12 🇩🇪 | 27 | 3 | 2026-07-09 01:31 UTC | 2026-07-15 13:09 UTC | Falkenstein, Saxony, Germany | AS24940 · Hetzner Online GmbH |
| 13 | Attacker #13 🇳🇱 | 24 | 1 | 2026-07-09 00:19 UTC | 2026-07-10 23:47 UTC | Halfweg, North Holland, The Netherlands | AS55286 · B2 Net Solutions Inc. |
| 14 | Attacker #14 🇭🇰 | 24 | 1 | 2026-07-14 00:54 UTC | 2026-07-14 01:27 UTC | Hong Kong, Hong Kong | AS38136 · Akari Networks |
| 15 | Attacker #15 🇫🇷 | 24 | 1 | 2026-07-11 07:45 UTC | 2026-07-11 08:05 UTC | France | AS211590 · Bucklog SARL |
| 16 | Attacker #16 🇨🇳 | 24 | 1 | 2026-07-14 03:51 UTC | 2026-07-14 03:57 UTC | China | AS24445 · Henan Mobile Communications Co.,Ltd |
| 17 | Attacker #17 🇫🇷 | 24 | 1 | 2026-07-09 06:18 UTC | 2026-07-15 07:49 UTC | France | AS211590 · Bucklog SARL |
| 18 | Attacker #18 🇰🇿 | 20 | 1 | 2026-07-09 09:52 UTC | 2026-07-14 09:23 UTC | Kazakhstan | AS197556 · Kar-Tel LLC |
| 19 | Attacker #19 🇮🇩 | 20 | 1 | 2026-07-13 02:15 UTC | 2026-07-13 02:39 UTC | Indonesia | AS150493 · PT Gunung Sedayu Sentosa |
| 20 | Attacker #20 🇫🇷 | 17 | 4 | 2026-07-09 05:38 UTC | 2026-07-09 05:39 UTC | France | AS211590 · Bucklog SARL |
| 21 | Attacker #21 🇫🇷 | 17 | 4 | 2026-07-12 04:45 UTC | 2026-07-12 04:48 UTC | France | AS211590 · Bucklog SARL |
| 22 | Attacker #22 🇫🇷 | 17 | 4 | 2026-07-09 14:18 UTC | 2026-07-09 14:22 UTC | France | AS211590 · Bucklog SARL |
| 23 | Attacker #23 🇫🇷 | 16 | 3 | 2026-07-15 00:03 UTC | 2026-07-15 00:03 UTC | France | AS211590 · Bucklog SARL |
| 24 | Attacker #24 🇫🇷 | 16 | 3 | 2026-07-15 03:00 UTC | 2026-07-15 03:02 UTC | France | AS211590 · Bucklog SARL |
| 25 | Attacker #25 🇯🇵 | 16 | 1 | 2026-07-10 02:55 UTC | 2026-07-15 07:24 UTC | Tokyo, Tokyo, Japan | AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED |
| 26 | Attacker #26 🇹🇭 | 14 | 1 | 2026-07-09 06:12 UTC | 2026-07-11 22:09 UTC | Bangkok, Bangkok, Thailand | AS45458 · SBN-ISP/AWN-ISP and SBN-NIX/AWN-NIX |
| 27 | Attacker #27 🇫🇷 | 12 | 1 | 2026-07-15 02:24 UTC | 2026-07-15 02:24 UTC | France | AS211590 · Bucklog SARL |
| 28 | Attacker #28 🇹🇷 | 12 | 1 | 2026-07-08 23:10 UTC | 2026-07-12 19:33 UTC | Türkiye | AS51559 · Netinternet Bilisim Teknolojileri AS |
| 29 | Attacker #29 🇫🇷 | 12 | 1 | 2026-07-11 07:48 UTC | 2026-07-11 07:48 UTC | France | AS211590 · Bucklog SARL |
| 30 | Attacker #30 🇺🇸 | 11 | 1 | 2026-07-14 21:20 UTC | 2026-07-14 21:25 UTC | Boston, Massachusetts, United States | AS47583 · Hostinger International Limited |
| 31 | Attacker #31 🇸🇬 | 10 | 1 | 2026-07-10 12:37 UTC | 2026-07-14 14:06 UTC | Singapore, Singapore | AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED |
| 32 | Attacker #32 🇳🇱 | 10 | 1 | 2026-07-10 04:40 UTC | 2026-07-10 04:45 UTC | The Netherlands | AS199792 · ClearStack B.V. |
| 33 | Attacker #33 🇸🇬 | 10 | 1 | 2026-07-12 14:38 UTC | 2026-07-14 01:05 UTC | Singapore, Singapore | AS14061 · DigitalOcean, LLC |
| 34 | Attacker #34 🇵🇱 | 10 | 1 | 2026-07-14 05:46 UTC | 2026-07-14 18:27 UTC | Poland | AS202520 · SkyPass Solutions Sp. z.o.o. |
| 35 | Attacker #35 🇦🇪 | 10 | 1 | 2026-07-13 19:37 UTC | 2026-07-13 20:56 UTC | United Arab Emirates | AS203861 · Miteflux Technologies Ltd |
| 36 | Attacker #36 🇸🇬 | 10 | 1 | 2026-07-09 03:00 UTC | 2026-07-12 20:36 UTC | Singapore, Singapore | AS150436 · Byteplus Pte. Ltd. |
| 37 | Attacker #37 🇩🇪 | 10 | 1 | 2026-07-12 09:59 UTC | 2026-07-12 10:00 UTC | Frankfurt am Main, Hesse, Germany | AS43357 · Owl Limited |
| 38 | Attacker #38 🇦🇺 | 10 | 1 | 2026-07-12 18:52 UTC | 2026-07-13 05:18 UTC | Australia | AS133159 · Mammoth Media Pty Ltd |
| 39 | Attacker #39 🇮🇩 | 10 | 1 | 2026-07-09 03:49 UTC | 2026-07-15 18:59 UTC | Tangerang, Banten, Indonesia | AS17727 · PT. NAP Info Lintas Nusa |
| 40 | Attacker #40 🇺🇸 | 9 | 1 | 2026-07-12 08:58 UTC | 2026-07-12 11:00 UTC | Ashburn, Virginia, United States | AS14618 · Amazon.com, Inc. |
| 41 | Attacker #41 🇸🇬 | 8 | 1 | 2026-07-09 15:24 UTC | 2026-07-09 15:24 UTC | Singapore, Singapore | AS30058 · FDCservers.net |
| 42 | Attacker #42 🇮🇪 | 8 | 1 | 2026-07-09 02:46 UTC | 2026-07-13 01:22 UTC | Dublin, Leinster, Ireland | AS36352 · HostPapa |
| 43 | Attacker #43 🇭🇰 | 8 | 1 | 2026-07-09 16:05 UTC | 2026-07-15 06:18 UTC | Hong Kong, Hong Kong | AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED |
| 44 | Attacker #44 🇩🇪 | 8 | 1 | 2026-07-10 18:55 UTC | 2026-07-15 19:27 UTC | Frankfurt am Main, Hesse, Germany | AS215439 · Play2go International Limited |
| 45 | Attacker #45 🇨🇳 | 8 | 1 | 2026-07-10 17:12 UTC | 2026-07-13 15:08 UTC | China | AS9808 · China Mobile Communications Group Co., Ltd. |
| 46 | Attacker #46 🇸🇬 | 8 | 1 | 2026-07-11 00:14 UTC | 2026-07-13 07:33 UTC | Singapore, Singapore | AS141995 · Contabo Asia Private Limited |
| 47 | Attacker #47 🇭🇰 | 8 | 1 | 2026-07-13 05:53 UTC | 2026-07-13 05:54 UTC | Hong Kong, Hong Kong | AS38136 · Akari Networks |
| 48 | Attacker #48 🇺🇿 | 8 | 1 | 2026-07-09 06:24 UTC | 2026-07-10 15:25 UTC | Uzbekistan | AS202660 · Uzbektelekom Joint Stock Company |
| 49 | Attacker #49 🇸🇨 | 7 | 1 | 2026-07-14 07:57 UTC | 2026-07-15 09:29 UTC | Seychelles | AS49870 · Alsycon B.V. |
| 50 | Attacker #50 🇸🇪 | 6 | 1 | 2026-07-10 21:00 UTC | 2026-07-12 19:04 UTC | Skåne County, Sweden | AS3301 · Telia Company AB |
Unlock attacker IP detail
Pro and Enterprise plans show individual attacker IPs, CVE mappings, first/last seen timestamps, and cross-sensor activity profiles.
Cross-CVE Attacker Intelligence
See which source IPs are targeting multiple exploited vulnerabilities, review per-CVE activity, and drill into Enterprise raw telemetry where available.