Attacker Intelligence
IPs observed targeting KEVIntel sensors, mapped to exploited CVEs.
1,247
Unique Attacker IPs
17,623
Exploitation Events
82
Countries
54
KEVs Targeted
Top Attacker IPs
Source IPs ranked by observed exploitation attempts in the selected window.
2026-04-16 20:34 UTC – 2026-07-15 20:34 UTC
| Rank | Attacker | Attempts | CVEs | First Seen | Last Seen | Country | Network |
|---|---|---|---|---|---|---|---|
| 1 | Attacker #1 🇩🇪 | 2,045 | 31 | 2026-07-03 02:13 UTC | 2026-07-03 08:25 UTC | Frankfurt am Main, Hesse, Germany | AS16276 · OVH SAS |
| 2 | Attacker #2 🇺🇸 | 1,561 | 5 | 2026-06-16 10:41 UTC | 2026-07-03 13:35 UTC | North Bergen, New Jersey, United States | AS14061 · DigitalOcean, LLC |
| 3 | Attacker #3 🇺🇸 | 909 | 2 | 2026-07-01 01:33 UTC | 2026-07-03 08:24 UTC | Ashburn, Virginia, United States | AS14618 · Amazon.com, Inc. |
| 4 | Attacker #4 🇺🇸 | 406 | 3 | 2026-06-20 16:16 UTC | 2026-07-03 08:24 UTC | North Bergen, New Jersey, United States | AS14061 · DigitalOcean, LLC |
| 5 | Attacker #5 🇭🇰 | 316 | 3 | 2026-06-18 10:04 UTC | 2026-07-03 08:24 UTC | Hong Kong | AS134972 · IKUUU NETWORK LTD |
| 6 | Attacker #6 🇺🇸 | 305 | 27 | 2026-06-16 12:38 UTC | 2026-07-03 08:24 UTC | United States | AS199959 · Gwy It Pty Ltd |
| 7 | Attacker #7 🇷🇴 | 295 | 1 | 2026-07-14 09:49 UTC | 2026-07-15 07:46 UTC | Bucharest, Bucharest, Romania | AS9009 · M247 Europe SRL |
| 8 | Attacker #8 🇺🇸 | 287 | 1 | 2026-06-11 08:54 UTC | 2026-07-03 08:24 UTC | Chicago, Illinois, United States | AS212238 · Datacamp Limited |
| 9 | Attacker #9 🇺🇸 | 274 | 1 | 2026-06-14 20:24 UTC | 2026-07-03 08:24 UTC | United States | AS138415 · Yancy Limited |
| 10 | Attacker #10 🇺🇦 | 261 | 1 | 2026-07-04 11:58 UTC | 2026-07-04 12:53 UTC | Kyiv, Kyiv City, Ukraine | AS212238 · Datacamp Limited |
| 11 | Attacker #11 🇰🇷 | 238 | 1 | 2026-07-03 07:24 UTC | 2026-07-03 08:24 UTC | Incheon, Incheon, South Korea | AS199524 · G-Core Labs S.A. |
| 12 | Attacker #12 🇯🇵 | 191 | 1 | 2026-07-13 12:06 UTC | 2026-07-13 14:59 UTC | Tokyo, Tokyo, Japan | AS199524 · G-Core Labs S.A. |
| 13 | Attacker #13 🇮🇩 | 182 | 1 | 2026-06-14 18:44 UTC | 2026-07-03 08:24 UTC | South Tangerang, Banten, Indonesia | AS23700 · Linknet-Fastnet ASN |
| 14 | Attacker #14 🇯🇵 | 176 | 1 | 2026-06-30 15:23 UTC | 2026-07-11 15:37 UTC | Nakano City, Tokyo, Japan | AS2516 · KDDI CORPORATION |
| 15 | Attacker #15 🇮🇩 | 172 | 1 | 2026-06-16 12:29 UTC | 2026-07-03 08:24 UTC | Jakarta, Jakarta, Indonesia | AS21859 · Zenlayer Inc |
| 16 | Attacker #16 🇫🇷 | 162 | 1 | 2026-07-02 03:56 UTC | 2026-07-03 08:24 UTC | Lauterbourg, Grand Est, France | AS51167 · Contabo GmbH |
| 17 | Attacker #17 🇫🇷 | 161 | 1 | 2026-06-11 02:30 UTC | 2026-07-03 08:24 UTC | Aubervilliers, Île-de-France, France | AS3215 · Orange |
| 18 | Attacker #18 🇺🇸 | 160 | 1 | 2026-07-03 01:04 UTC | 2026-07-03 08:24 UTC | San Jose, California, United States | AS54600 · PEG TECH INC |
| 19 | Attacker #19 🇨🇾 | 160 | 1 | 2026-06-13 09:52 UTC | 2026-07-03 08:24 UTC | Cyprus | AS197648 · Cloudlayer8 Limited |
| 20 | Attacker #20 🇧🇬 | 156 | 2 | 2026-06-16 12:48 UTC | 2026-07-03 08:24 UTC | Bulgaria | AS209160 · Miti 2000 EOOD |
| 21 | Attacker #21 🇵🇭 | 126 | 1 | 2026-06-21 21:09 UTC | 2026-07-03 08:24 UTC | Cebu City, Central Visayas, Philippines | AS9299 · Philippine Long Distance Telephone Company |
| 22 | Attacker #22 🇲🇩 | 125 | 1 | 2026-06-11 08:07 UTC | 2026-07-03 08:24 UTC | Chisinau, Chișinău Municipality, Moldova | AS39798 · MivoCloud SRL |
| 23 | Attacker #23 🇺🇸 | 116 | 27 | 2026-06-29 02:53 UTC | 2026-07-03 08:24 UTC | New York, New York, United States | AS64286 · LogicWeb Inc. |
| 24 | Attacker #24 🇺🇸 | 110 | 1 | 2026-06-26 12:58 UTC | 2026-07-03 08:24 UTC | United States | AS136209 · CyberForest LLC. |
| 25 | Attacker #25 🇳🇱 | 101 | 1 | 2026-06-29 17:18 UTC | 2026-07-15 18:34 UTC | Amsterdam, North Holland, The Netherlands | AS219502 · Storm Industries LLC |
| 26 | Attacker #26 🇳🇱 | 99 | 1 | 2026-06-27 12:55 UTC | 2026-07-03 08:24 UTC | Naaldwijk, South Holland, The Netherlands | AS49981 · WorldStream B.V. |
| 27 | Attacker #27 🇸🇮 | 96 | 1 | 2026-06-29 14:24 UTC | 2026-07-03 08:24 UTC | Ljubljana, Ljubljana, Slovenia | AS203020 · HostRoyale Technologies Pvt Ltd |
| 28 | Attacker #28 🇺🇸 | 91 | 1 | 2026-06-29 13:36 UTC | 2026-07-03 08:24 UTC | Cedar Knolls, New Jersey, United States | AS63949 · Akamai Connected Cloud |
| 29 | Attacker #29 🇪🇪 | 90 | 27 | 2026-06-12 00:32 UTC | 2026-07-03 08:24 UTC | Tallinn, Harjumaa, Estonia | AS41745 · Baykov Ilya Sergeevich |
| 30 | Attacker #30 🇻🇳 | 84 | 26 | 2026-06-29 01:36 UTC | 2026-07-03 08:24 UTC | Hanoi, Hanoi, Vietnam | AS45899 · VNPT Corp |
| 31 | Attacker #31 🇯🇵 | 76 | 1 | 2026-06-14 17:58 UTC | 2026-07-03 08:24 UTC | Tokyo, Tokyo, Japan | AS36002 · GoMami Networks |
| 32 | Attacker #32 🇩🇪 | 75 | 1 | 2026-06-30 08:09 UTC | 2026-07-03 08:24 UTC | Frankfurt am Main, Hesse, Germany | AS14061 · DigitalOcean, LLC |
| 33 | Attacker #33 🇰🇷 | 74 | 1 | 2026-06-11 06:25 UTC | 2026-07-15 15:13 UTC | Iksan, Jeollabuk-do, South Korea | AS4766 · Korea Telecom |
| 34 | Attacker #34 🇺🇸 | 74 | 1 | 2026-06-21 09:01 UTC | 2026-07-03 08:24 UTC | North Bergen, New Jersey, United States | AS14061 · DigitalOcean, LLC |
| 35 | Attacker #35 🇩🇪 | 73 | 3 | 2026-06-25 17:17 UTC | 2026-07-15 13:09 UTC | Falkenstein, Saxony, Germany | AS24940 · Hetzner Online GmbH |
| 36 | Attacker #36 🇺🇸 | 72 | 1 | 2026-07-03 07:40 UTC | 2026-07-03 08:25 UTC | Los Angeles, California, United States | AS46475 · Limestone Networks, Inc. |
| 37 | Attacker #37 🇪🇬 | 71 | 1 | 2026-06-25 17:52 UTC | 2026-07-03 08:24 UTC | Cairo, Cairo Governorate, Egypt | AS8452 · IDDQD-AS |
| 38 | Attacker #38 🇮🇳 | 68 | 24 | 2026-06-27 09:35 UTC | 2026-07-03 08:24 UTC | Ahmedabad, Gujarat, India | AS55836 · Reliance Jio Infocomm Limited |
| 39 | Attacker #39 🇸🇬 | 67 | 1 | 2026-07-02 01:45 UTC | 2026-07-03 08:24 UTC | Singapore, Singapore | AS212238 · Datacamp Limited |
| 40 | Attacker #40 🇰🇿 | 62 | 1 | 2026-06-15 10:59 UTC | 2026-07-14 09:23 UTC | Kazakhstan | AS197556 · Kar-Tel LLC |
| 41 | Attacker #41 🇳🇱 | 61 | 2 | 2026-06-23 06:55 UTC | 2026-07-05 17:33 UTC | Eygelshoven, Limburg, The Netherlands | AS51396 · Pfcloud UG (haftungsbeschrankt) |
| 42 | Attacker #42 🇫🇷 | 58 | 2 | 2026-06-30 14:41 UTC | 2026-07-09 01:42 UTC | Paris, Île-de-France, France | AS12876 · Scaleway SAS |
| 43 | Attacker #43 🇫🇷 | 58 | 3 | 2026-06-27 03:53 UTC | 2026-07-15 02:01 UTC | France | AS211590 · Bucklog SARL |
| 44 | Attacker #44 🇰🇷 | 55 | 1 | 2026-06-14 14:49 UTC | 2026-07-03 08:24 UTC | Suwon, Gyeonggi-do, South Korea | AS4766 · Korea Telecom |
| 45 | Attacker #45 🇺🇸 | 55 | 1 | 2026-06-18 14:43 UTC | 2026-07-03 08:24 UTC | Los Angeles, California, United States | AS174 · Cogent Communications, LLC |
| 46 | Attacker #46 🇭🇰 | 53 | 1 | 2026-06-29 06:51 UTC | 2026-07-03 08:24 UTC | Ha Kwai Chung, Kwai Tsing District, Hong Kong | AS138997 · Eons Data Communications Limited |
| 47 | Attacker #47 🇫🇷 | 52 | 3 | 2026-06-30 16:32 UTC | 2026-07-15 07:49 UTC | France | AS211590 · Bucklog SARL |
| 48 | Attacker #48 🇮🇩 | 52 | 1 | 2026-07-01 19:31 UTC | 2026-07-03 08:24 UTC | West Jakarta, Jakarta, Indonesia | AS63859 · PT. Eka Mas Republik |
| 49 | Attacker #49 🇳🇱 | 52 | 1 | 2026-07-05 20:47 UTC | 2026-07-05 20:47 UTC | Amsterdam, North Holland, The Netherlands | AS206075 · Hollander & Jacobsen UG (haftungsbeschraenkt) |
| 50 | Attacker #50 🇭🇰 | 50 | 1 | 2026-06-16 10:00 UTC | 2026-07-03 08:24 UTC | Hong Kong | AS38136 · Akari Networks |
Unlock attacker IP detail
Pro and Enterprise plans show individual attacker IPs, CVE mappings, first/last seen timestamps, and cross-sensor activity profiles.
Cross-CVE Attacker Intelligence
See which source IPs are targeting multiple exploited vulnerabilities, review per-CVE activity, and drill into Enterprise raw telemetry where available.