Attacker Intelligence
IPs observed targeting KEVIntel sensors, mapped to exploited CVEs.
1,230
Unique Attacker IPs
16,190
Exploitation Events
82
Countries
53
KEVs Targeted
Top Attacker IPs
Source IPs ranked by observed exploitation attempts in the selected window.
2026-06-15 20:54 UTC – 2026-07-15 20:54 UTC
| Rank | Attacker | Attempts | CVEs | First Seen | Last Seen | Country | Network |
|---|---|---|---|---|---|---|---|
| 1 | Attacker #1 🇩🇪 | 2,045 | 31 | 2026-07-03 02:13 UTC | 2026-07-03 08:25 UTC | Frankfurt am Main, Hesse, Germany | AS16276 · OVH SAS |
| 2 | Attacker #2 🇺🇸 | 1,561 | 5 | 2026-06-16 10:41 UTC | 2026-07-03 13:35 UTC | North Bergen, New Jersey, United States | AS14061 · DigitalOcean, LLC |
| 3 | Attacker #3 🇺🇸 | 909 | 2 | 2026-07-01 01:33 UTC | 2026-07-03 08:24 UTC | Ashburn, Virginia, United States | AS14618 · Amazon.com, Inc. |
| 4 | Attacker #4 🇺🇸 | 406 | 3 | 2026-06-20 16:16 UTC | 2026-07-03 08:24 UTC | North Bergen, New Jersey, United States | AS14061 · DigitalOcean, LLC |
| 5 | Attacker #5 🇭🇰 | 316 | 3 | 2026-06-18 10:04 UTC | 2026-07-03 08:24 UTC | Hong Kong | AS134972 · IKUUU NETWORK LTD |
| 6 | Attacker #6 🇺🇸 | 305 | 27 | 2026-06-16 12:38 UTC | 2026-07-03 08:24 UTC | United States | AS199959 · Gwy It Pty Ltd |
| 7 | Attacker #7 🇷🇴 | 295 | 1 | 2026-07-14 09:49 UTC | 2026-07-15 07:46 UTC | Bucharest, Bucharest, Romania | AS9009 · M247 Europe SRL |
| 8 | Attacker #8 🇺🇦 | 261 | 1 | 2026-07-04 11:58 UTC | 2026-07-04 12:53 UTC | Kyiv, Kyiv City, Ukraine | AS212238 · Datacamp Limited |
| 9 | Attacker #9 🇰🇷 | 238 | 1 | 2026-07-03 07:24 UTC | 2026-07-03 08:24 UTC | Incheon, Incheon, South Korea | AS199524 · G-Core Labs S.A. |
| 10 | Attacker #10 🇯🇵 | 191 | 1 | 2026-07-13 12:06 UTC | 2026-07-13 14:59 UTC | Tokyo, Tokyo, Japan | AS199524 · G-Core Labs S.A. |
| 11 | Attacker #11 🇯🇵 | 176 | 1 | 2026-06-30 15:23 UTC | 2026-07-11 15:37 UTC | Nakano City, Tokyo, Japan | AS2516 · KDDI CORPORATION |
| 12 | Attacker #12 🇮🇩 | 172 | 1 | 2026-06-16 12:29 UTC | 2026-07-03 08:24 UTC | Jakarta, Jakarta, Indonesia | AS21859 · Zenlayer Inc |
| 13 | Attacker #13 🇫🇷 | 162 | 1 | 2026-07-02 03:56 UTC | 2026-07-03 08:24 UTC | Lauterbourg, Grand Est, France | AS51167 · Contabo GmbH |
| 14 | Attacker #14 🇺🇸 | 160 | 1 | 2026-07-03 01:04 UTC | 2026-07-03 08:24 UTC | San Jose, California, United States | AS54600 · PEG TECH INC |
| 15 | Attacker #15 🇧🇬 | 156 | 2 | 2026-06-16 12:48 UTC | 2026-07-03 08:24 UTC | Bulgaria | AS209160 · Miti 2000 EOOD |
| 16 | Attacker #16 🇺🇸 | 139 | 1 | 2026-07-03 08:24 UTC | 2026-07-03 08:24 UTC | Chicago, Illinois, United States | AS212238 · Datacamp Limited |
| 17 | Attacker #17 🇺🇸 | 137 | 1 | 2026-07-03 08:24 UTC | 2026-07-03 08:24 UTC | United States | AS138415 · Yancy Limited |
| 18 | Attacker #18 🇵🇭 | 126 | 1 | 2026-06-21 21:09 UTC | 2026-07-03 08:24 UTC | Cebu City, Central Visayas, Philippines | AS9299 · Philippine Long Distance Telephone Company |
| 19 | Attacker #19 🇺🇸 | 116 | 27 | 2026-06-29 02:53 UTC | 2026-07-03 08:24 UTC | New York, New York, United States | AS64286 · LogicWeb Inc. |
| 20 | Attacker #20 🇺🇸 | 110 | 1 | 2026-06-26 12:58 UTC | 2026-07-03 08:24 UTC | United States | AS136209 · CyberForest LLC. |
| 21 | Attacker #21 🇳🇱 | 101 | 1 | 2026-06-29 17:18 UTC | 2026-07-15 18:34 UTC | Amsterdam, North Holland, The Netherlands | AS219502 · Storm Industries LLC |
| 22 | Attacker #22 🇳🇱 | 99 | 1 | 2026-06-27 12:55 UTC | 2026-07-03 08:24 UTC | Naaldwijk, South Holland, The Netherlands | AS49981 · WorldStream B.V. |
| 23 | Attacker #23 🇸🇮 | 96 | 1 | 2026-06-29 14:24 UTC | 2026-07-03 08:24 UTC | Ljubljana, Ljubljana, Slovenia | AS203020 · HostRoyale Technologies Pvt Ltd |
| 24 | Attacker #24 🇨🇾 | 91 | 1 | 2026-06-16 07:17 UTC | 2026-07-03 08:24 UTC | Cyprus | AS197648 · Cloudlayer8 Limited |
| 25 | Attacker #25 🇺🇸 | 91 | 1 | 2026-06-29 13:36 UTC | 2026-07-03 08:24 UTC | Cedar Knolls, New Jersey, United States | AS63949 · Akamai Connected Cloud |
| 26 | Attacker #26 🇮🇩 | 87 | 1 | 2026-07-03 08:24 UTC | 2026-07-03 08:24 UTC | South Tangerang, Banten, Indonesia | AS23700 · Linknet-Fastnet ASN |
| 27 | Attacker #27 🇻🇳 | 84 | 26 | 2026-06-29 01:36 UTC | 2026-07-03 08:24 UTC | Hanoi, Hanoi, Vietnam | AS45899 · VNPT Corp |
| 28 | Attacker #28 🇫🇷 | 76 | 1 | 2026-07-03 08:24 UTC | 2026-07-03 08:24 UTC | Aubervilliers, Île-de-France, France | AS3215 · Orange |
| 29 | Attacker #29 🇩🇪 | 75 | 1 | 2026-06-30 08:09 UTC | 2026-07-03 08:24 UTC | Frankfurt am Main, Hesse, Germany | AS14061 · DigitalOcean, LLC |
| 30 | Attacker #30 🇺🇸 | 74 | 1 | 2026-06-21 09:01 UTC | 2026-07-03 08:24 UTC | North Bergen, New Jersey, United States | AS14061 · DigitalOcean, LLC |
| 31 | Attacker #31 🇩🇪 | 73 | 3 | 2026-06-25 17:17 UTC | 2026-07-15 13:09 UTC | Falkenstein, Saxony, Germany | AS24940 · Hetzner Online GmbH |
| 32 | Attacker #32 🇺🇸 | 72 | 1 | 2026-07-03 07:40 UTC | 2026-07-03 08:25 UTC | Los Angeles, California, United States | AS46475 · Limestone Networks, Inc. |
| 33 | Attacker #33 🇪🇬 | 71 | 1 | 2026-06-25 17:52 UTC | 2026-07-03 08:24 UTC | Cairo, Cairo Governorate, Egypt | AS8452 · IDDQD-AS |
| 34 | Attacker #34 🇰🇷 | 68 | 1 | 2026-06-15 20:57 UTC | 2026-07-15 15:13 UTC | Iksan, Jeollabuk-do, South Korea | AS4766 · Korea Telecom |
| 35 | Attacker #35 🇮🇳 | 68 | 24 | 2026-06-27 09:35 UTC | 2026-07-03 08:24 UTC | Ahmedabad, Gujarat, India | AS55836 · Reliance Jio Infocomm Limited |
| 36 | Attacker #36 🇸🇬 | 67 | 1 | 2026-07-02 01:45 UTC | 2026-07-03 08:24 UTC | Singapore, Singapore | AS212238 · Datacamp Limited |
| 37 | Attacker #37 🇳🇱 | 61 | 2 | 2026-06-23 06:55 UTC | 2026-07-05 17:33 UTC | Eygelshoven, Limburg, The Netherlands | AS51396 · Pfcloud UG (haftungsbeschrankt) |
| 38 | Attacker #38 🇰🇿 | 60 | 1 | 2026-06-16 10:06 UTC | 2026-07-14 09:23 UTC | Kazakhstan | AS197556 · Kar-Tel LLC |
| 39 | Attacker #39 🇲🇩 | 58 | 1 | 2026-07-03 08:24 UTC | 2026-07-03 08:24 UTC | Chisinau, Chișinău Municipality, Moldova | AS39798 · MivoCloud SRL |
| 40 | Attacker #40 🇫🇷 | 58 | 3 | 2026-06-27 03:53 UTC | 2026-07-15 02:01 UTC | France | AS211590 · Bucklog SARL |
| 41 | Attacker #41 🇫🇷 | 58 | 2 | 2026-06-30 14:41 UTC | 2026-07-09 01:42 UTC | Paris, Île-de-France, France | AS12876 · Scaleway SAS |
| 42 | Attacker #42 🇺🇸 | 55 | 1 | 2026-06-18 14:43 UTC | 2026-07-03 08:24 UTC | Los Angeles, California, United States | AS174 · Cogent Communications, LLC |
| 43 | Attacker #43 🇭🇰 | 53 | 1 | 2026-06-29 06:51 UTC | 2026-07-03 08:24 UTC | Ha Kwai Chung, Kwai Tsing District, Hong Kong | AS138997 · Eons Data Communications Limited |
| 44 | Attacker #44 🇮🇩 | 52 | 1 | 2026-07-01 19:31 UTC | 2026-07-03 08:24 UTC | West Jakarta, Jakarta, Indonesia | AS63859 · PT. Eka Mas Republik |
| 45 | Attacker #45 🇳🇱 | 52 | 1 | 2026-07-05 20:47 UTC | 2026-07-05 20:47 UTC | Amsterdam, North Holland, The Netherlands | AS206075 · Hollander & Jacobsen UG (haftungsbeschraenkt) |
| 46 | Attacker #46 🇫🇷 | 52 | 3 | 2026-06-30 16:32 UTC | 2026-07-15 07:49 UTC | France | AS211590 · Bucklog SARL |
| 47 | Attacker #47 🇭🇰 | 50 | 1 | 2026-06-16 10:00 UTC | 2026-07-03 08:24 UTC | Hong Kong | AS38136 · Akari Networks |
| 48 | Attacker #48 🇺🇸 | 46 | 2 | 2026-06-21 03:46 UTC | 2026-07-03 08:24 UTC | North Bergen, New Jersey, United States | AS14061 · DigitalOcean, LLC |
| 49 | Attacker #49 🇳🇱 | 45 | 2 | 2026-06-25 17:45 UTC | 2026-07-03 08:24 UTC | Amsterdam, North Holland, The Netherlands | AS49870 · Alsycon B.V. |
| 50 | Attacker #50 🇸🇬 | 45 | 1 | 2026-06-16 16:08 UTC | 2026-07-03 08:24 UTC | Singapore | AS132203 · Tencent Building, Kejizhongyi Avenue |
Unlock attacker IP detail
Pro and Enterprise plans show individual attacker IPs, CVE mappings, first/last seen timestamps, and cross-sensor activity profiles.
Cross-CVE Attacker Intelligence
See which source IPs are targeting multiple exploited vulnerabilities, review per-CVE activity, and drill into Enterprise raw telemetry where available.