Attacker Intelligence
IPs observed targeting KEVIntel sensors, mapped to exploited CVEs.
320
Unique Attacker IPs
1,904
Exploitation Events
55
Countries
32
KEVs Targeted
Top Attacker IPs
Source IPs ranked by observed exploitation attempts in the selected window.
2026-07-08 20:47 UTC – 2026-07-15 20:47 UTC
| Rank | Attacker | Attempts | CVEs | First Seen | Last Seen | Country | Network |
|---|---|---|---|---|---|---|---|
| 1 | Attacker #1 🇷🇴 | 295 | 1 | 2026-07-14 09:49 UTC | 2026-07-15 07:46 UTC | Bucharest, Bucharest, Romania | AS9009 · M247 Europe SRL |
| 2 | Attacker #2 🇯🇵 | 191 | 1 | 2026-07-13 12:06 UTC | 2026-07-13 14:59 UTC | Tokyo, Tokyo, Japan | AS199524 · G-Core Labs S.A. |
| 3 | Attacker #3 🇯🇵 | 71 | 1 | 2026-07-11 15:35 UTC | 2026-07-11 15:37 UTC | Nakano City, Tokyo, Japan | AS2516 · KDDI CORPORATION |
| 4 | Attacker #4 🇳🇱 | 44 | 1 | 2026-07-08 21:15 UTC | 2026-07-15 18:34 UTC | Amsterdam, North Holland, The Netherlands | AS219502 · Storm Industries LLC |
| 5 | Attacker #5 🇫🇷 | 33 | 4 | 2026-07-11 07:15 UTC | 2026-07-15 07:24 UTC | France | AS211590 · Bucklog SARL |
| 6 | Attacker #6 🇫🇷 | 32 | 2 | 2026-07-10 02:31 UTC | 2026-07-10 09:07 UTC | France | AS42960 · VH Global Limited |
| 7 | Attacker #7 🇫🇷 | 32 | 3 | 2026-07-14 22:30 UTC | 2026-07-15 02:01 UTC | France | AS211590 · Bucklog SARL |
| 8 | Attacker #8 🇸🇪 | 28 | 1 | 2026-07-09 13:44 UTC | 2026-07-09 13:44 UTC | Malmö, Skåne County, Sweden | AS39351 · 31173 Services AB |
| 9 | Attacker #9 🇫🇷 | 28 | 3 | 2026-07-11 07:49 UTC | 2026-07-15 07:22 UTC | France | AS211590 · Bucklog SARL |
| 10 | Attacker #10 🇫🇷 | 28 | 3 | 2026-07-09 06:22 UTC | 2026-07-14 23:29 UTC | France | AS211590 · Bucklog SARL |
| 11 | Attacker #11 🇰🇷 | 27 | 1 | 2026-07-09 03:46 UTC | 2026-07-15 15:13 UTC | Iksan, Jeollabuk-do, South Korea | AS4766 · Korea Telecom |
| 12 | Attacker #12 🇩🇪 | 27 | 3 | 2026-07-09 01:31 UTC | 2026-07-15 13:09 UTC | Falkenstein, Saxony, Germany | AS24940 · Hetzner Online GmbH |
| 13 | Attacker #13 🇫🇷 | 24 | 1 | 2026-07-09 06:18 UTC | 2026-07-15 07:49 UTC | France | AS211590 · Bucklog SARL |
| 14 | Attacker #14 🇨🇳 | 24 | 1 | 2026-07-14 03:51 UTC | 2026-07-14 03:57 UTC | China | AS24445 · Henan Mobile Communications Co.,Ltd |
| 15 | Attacker #15 🇫🇷 | 24 | 1 | 2026-07-11 07:45 UTC | 2026-07-11 08:05 UTC | France | AS211590 · Bucklog SARL |
| 16 | Attacker #16 🇳🇱 | 24 | 1 | 2026-07-09 00:19 UTC | 2026-07-10 23:47 UTC | Halfweg, North Holland, The Netherlands | AS55286 · B2 Net Solutions Inc. |
| 17 | Attacker #17 🇭🇰 | 24 | 1 | 2026-07-14 00:54 UTC | 2026-07-14 01:27 UTC | Hong Kong, Hong Kong | AS38136 · Akari Networks |
| 18 | Attacker #18 🇮🇩 | 20 | 1 | 2026-07-13 02:15 UTC | 2026-07-13 02:39 UTC | Indonesia | AS150493 · PT Gunung Sedayu Sentosa |
| 19 | Attacker #19 🇰🇿 | 20 | 1 | 2026-07-09 09:52 UTC | 2026-07-14 09:23 UTC | Kazakhstan | AS197556 · Kar-Tel LLC |
| 20 | Attacker #20 🇯🇵 | 18 | 1 | 2026-07-10 02:55 UTC | 2026-07-15 20:28 UTC | Tokyo, Tokyo, Japan | AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED |
| 21 | Attacker #21 🇫🇷 | 17 | 4 | 2026-07-09 05:38 UTC | 2026-07-09 05:39 UTC | France | AS211590 · Bucklog SARL |
| 22 | Attacker #22 🇫🇷 | 17 | 4 | 2026-07-09 14:18 UTC | 2026-07-09 14:22 UTC | France | AS211590 · Bucklog SARL |
| 23 | Attacker #23 🇫🇷 | 17 | 4 | 2026-07-12 04:45 UTC | 2026-07-12 04:48 UTC | France | AS211590 · Bucklog SARL |
| 24 | Attacker #24 🇫🇷 | 16 | 3 | 2026-07-15 00:03 UTC | 2026-07-15 00:03 UTC | France | AS211590 · Bucklog SARL |
| 25 | Attacker #25 🇫🇷 | 16 | 3 | 2026-07-15 03:00 UTC | 2026-07-15 03:02 UTC | France | AS211590 · Bucklog SARL |
| 26 | Attacker #26 🇹🇭 | 14 | 1 | 2026-07-09 06:12 UTC | 2026-07-11 22:09 UTC | Bangkok, Bangkok, Thailand | AS45458 · SBN-ISP/AWN-ISP and SBN-NIX/AWN-NIX |
| 27 | Attacker #27 🇹🇷 | 12 | 1 | 2026-07-08 23:10 UTC | 2026-07-12 19:33 UTC | Türkiye | AS51559 · Netinternet Bilisim Teknolojileri AS |
| 28 | Attacker #28 🇫🇷 | 12 | 1 | 2026-07-15 02:24 UTC | 2026-07-15 02:24 UTC | France | AS211590 · Bucklog SARL |
| 29 | Attacker #29 🇫🇷 | 12 | 1 | 2026-07-11 07:48 UTC | 2026-07-11 07:48 UTC | France | AS211590 · Bucklog SARL |
| 30 | Attacker #30 🇺🇸 | 11 | 1 | 2026-07-14 21:20 UTC | 2026-07-14 21:25 UTC | Boston, Massachusetts, United States | AS47583 · Hostinger International Limited |
| 31 | Attacker #31 🇵🇱 | 10 | 1 | 2026-07-14 05:46 UTC | 2026-07-14 18:27 UTC | Poland | AS202520 · SkyPass Solutions Sp. z.o.o. |
| 32 | Attacker #32 🇦🇪 | 10 | 1 | 2026-07-13 19:37 UTC | 2026-07-13 20:56 UTC | United Arab Emirates | AS203861 · Miteflux Technologies Ltd |
| 33 | Attacker #33 🇺🇿 | 10 | 1 | 2026-07-09 06:24 UTC | 2026-07-15 20:32 UTC | Uzbekistan | AS202660 · Uzbektelekom Joint Stock Company |
| 34 | Attacker #34 🇸🇬 | 10 | 1 | 2026-07-09 03:00 UTC | 2026-07-12 20:36 UTC | Singapore, Singapore | AS150436 · Byteplus Pte. Ltd. |
| 35 | Attacker #35 🇸🇬 | 10 | 1 | 2026-07-10 12:37 UTC | 2026-07-14 14:06 UTC | Singapore, Singapore | AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED |
| 36 | Attacker #36 🇩🇪 | 10 | 1 | 2026-07-12 09:59 UTC | 2026-07-12 10:00 UTC | Frankfurt am Main, Hesse, Germany | AS43357 · Owl Limited |
| 37 | Attacker #37 🇸🇬 | 10 | 1 | 2026-07-12 14:38 UTC | 2026-07-14 01:05 UTC | Singapore, Singapore | AS14061 · DigitalOcean, LLC |
| 38 | Attacker #38 🇦🇺 | 10 | 1 | 2026-07-12 18:52 UTC | 2026-07-13 05:18 UTC | Australia | AS133159 · Mammoth Media Pty Ltd |
| 39 | Attacker #39 🇮🇩 | 10 | 1 | 2026-07-09 03:49 UTC | 2026-07-15 18:59 UTC | Tangerang, Banten, Indonesia | AS17727 · PT. NAP Info Lintas Nusa |
| 40 | Attacker #40 🇳🇱 | 10 | 1 | 2026-07-10 04:40 UTC | 2026-07-10 04:45 UTC | The Netherlands | AS199792 · ClearStack B.V. |
| 41 | Attacker #41 🇺🇸 | 9 | 1 | 2026-07-12 08:58 UTC | 2026-07-12 11:00 UTC | Ashburn, Virginia, United States | AS14618 · Amazon.com, Inc. |
| 42 | Attacker #42 🇸🇬 | 8 | 1 | 2026-07-09 15:24 UTC | 2026-07-09 15:24 UTC | Singapore, Singapore | AS30058 · FDCservers.net |
| 43 | Attacker #43 🇮🇪 | 8 | 1 | 2026-07-09 02:46 UTC | 2026-07-13 01:22 UTC | Dublin, Leinster, Ireland | AS36352 · HostPapa |
| 44 | Attacker #44 🇭🇰 | 8 | 1 | 2026-07-09 16:05 UTC | 2026-07-15 06:18 UTC | Hong Kong, Hong Kong | AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED |
| 45 | Attacker #45 🇩🇪 | 8 | 1 | 2026-07-10 18:55 UTC | 2026-07-15 19:27 UTC | Frankfurt am Main, Hesse, Germany | AS215439 · Play2go International Limited |
| 46 | Attacker #46 🇸🇬 | 8 | 1 | 2026-07-11 00:14 UTC | 2026-07-13 07:33 UTC | Singapore, Singapore | AS141995 · Contabo Asia Private Limited |
| 47 | Attacker #47 🇨🇳 | 8 | 1 | 2026-07-10 17:12 UTC | 2026-07-13 15:08 UTC | China | AS9808 · China Mobile Communications Group Co., Ltd. |
| 48 | Attacker #48 🇭🇰 | 8 | 1 | 2026-07-13 05:53 UTC | 2026-07-13 05:54 UTC | Hong Kong, Hong Kong | AS38136 · Akari Networks |
| 49 | Attacker #49 🇸🇨 | 7 | 1 | 2026-07-14 07:57 UTC | 2026-07-15 09:29 UTC | Seychelles | AS49870 · Alsycon B.V. |
| 50 | Attacker #50 🇸🇪 | 6 | 1 | 2026-07-10 21:00 UTC | 2026-07-12 19:04 UTC | Skåne County, Sweden | AS3301 · Telia Company AB |
Unlock attacker IP detail
Pro and Enterprise plans show individual attacker IPs, CVE mappings, first/last seen timestamps, and cross-sensor activity profiles.
Cross-CVE Attacker Intelligence
See which source IPs are targeting multiple exploited vulnerabilities, review per-CVE activity, and drill into Enterprise raw telemetry where available.