Observed Attackers
IPs observed targeting KEVIntel sensors, mapped to exploited CVEs.
1,196
Observed Attackers
15,788
Exploitation Events
81
Countries
49
KEVs Targeted
Top Observed Attackers
Source IPs ranked by observed exploitation attempts in the selected window.
2026-06-14 10:56 UTC – 2026-07-14 10:56 UTC
| Rank | Attacker | Attempts | CVEs | First Seen | Last Seen | Country |
|---|---|---|---|---|---|---|
| 1 | Attacker #1 🇩🇪 | 2,042 | 30 | 2026-07-03 02:13 UTC | 2026-07-03 08:25 UTC | Frankfurt am Main, Hesse, Germany |
| 2 | Attacker #2 🇺🇸 | 1,304 | 5 | 2026-06-16 10:41 UTC | 2026-07-03 13:35 UTC | North Bergen, New Jersey, United States |
| 3 | Attacker #3 🇺🇸 | 909 | 2 | 2026-07-01 01:33 UTC | 2026-07-03 08:24 UTC | Ashburn, Virginia, United States |
| 4 | Attacker #4 🇺🇸 | 406 | 3 | 2026-06-20 16:16 UTC | 2026-07-03 08:24 UTC | North Bergen, New Jersey, United States |
| 5 | Attacker #5 🇭🇰 | 316 | 3 | 2026-06-18 10:04 UTC | 2026-07-03 08:24 UTC | Hong Kong |
| 6 | Attacker #6 🇺🇸 | 298 | 26 | 2026-06-16 12:38 UTC | 2026-07-03 08:24 UTC | United States |
| 7 | Attacker #7 🇺🇸 | 274 | 1 | 2026-06-14 20:24 UTC | 2026-07-03 08:24 UTC | United States |
| 8 | Attacker #8 🇺🇦 | 261 | 1 | 2026-07-04 11:58 UTC | 2026-07-04 12:53 UTC | Kyiv, Kyiv City, Ukraine |
| 9 | Attacker #9 🇰🇷 | 238 | 1 | 2026-07-03 07:24 UTC | 2026-07-03 08:24 UTC | Incheon, Incheon, South Korea |
| 10 | Attacker #10 🇯🇵 | 191 | 1 | 2026-07-13 12:06 UTC | 2026-07-13 14:59 UTC | Tokyo, Tokyo, Japan |
| 11 | Attacker #11 🇮🇩 | 182 | 1 | 2026-06-14 18:44 UTC | 2026-07-03 08:24 UTC | South Tangerang, Banten, Indonesia |
| 12 | Attacker #12 🇯🇵 | 176 | 1 | 2026-06-30 15:23 UTC | 2026-07-11 15:37 UTC | Nakano City, Tokyo, Japan |
| 13 | Attacker #13 🇮🇩 | 172 | 1 | 2026-06-16 12:29 UTC | 2026-07-03 08:24 UTC | Jakarta, Jakarta, Indonesia |
| 14 | Attacker #14 🇫🇷 | 162 | 1 | 2026-07-02 03:56 UTC | 2026-07-03 08:24 UTC | Lauterbourg, Grand Est, France |
| 15 | Attacker #15 🇺🇸 | 160 | 1 | 2026-07-03 01:04 UTC | 2026-07-03 08:24 UTC | San Jose, California, United States |
| 16 | Attacker #16 🇧🇬 | 156 | 2 | 2026-06-16 12:48 UTC | 2026-07-03 08:24 UTC | Bulgaria |
| 17 | Attacker #17 🇨🇾 | 145 | 1 | 2026-06-14 11:04 UTC | 2026-07-03 08:24 UTC | Cyprus |
| 18 | Attacker #18 🇺🇸 | 139 | 1 | 2026-07-03 08:24 UTC | 2026-07-03 08:24 UTC | Chicago, Illinois, United States |
| 19 | Attacker #19 🇵🇭 | 126 | 1 | 2026-06-21 21:09 UTC | 2026-07-03 08:24 UTC | Cebu City, Central Visayas, Philippines |
| 20 | Attacker #20 🇺🇸 | 113 | 26 | 2026-06-29 02:53 UTC | 2026-07-03 08:24 UTC | New York, New York, United States |
| 21 | Attacker #21 🇳🇱 | 99 | 1 | 2026-06-27 12:55 UTC | 2026-07-03 08:24 UTC | Naaldwijk, South Holland, The Netherlands |
| 22 | Attacker #22 🇸🇮 | 96 | 1 | 2026-06-29 14:24 UTC | 2026-07-03 08:24 UTC | Ljubljana, Ljubljana, Slovenia |
| 23 | Attacker #23 🇺🇸 | 91 | 1 | 2026-06-29 13:36 UTC | 2026-07-03 08:24 UTC | Cedar Knolls, New Jersey, United States |
| 24 | Attacker #24 🇻🇳 | 82 | 25 | 2026-06-29 01:36 UTC | 2026-07-03 08:24 UTC | Hanoi, Hanoi, Vietnam |
| 25 | Attacker #25 🇺🇸 | 80 | 1 | 2026-06-26 12:58 UTC | 2026-07-03 08:24 UTC | United States |
| 26 | Attacker #26 🇯🇵 | 76 | 1 | 2026-06-14 17:58 UTC | 2026-07-03 08:24 UTC | Tokyo, Tokyo, Japan |
| 27 | Attacker #27 🇫🇷 | 76 | 1 | 2026-07-03 08:24 UTC | 2026-07-03 08:24 UTC | Aubervilliers, Île-de-France, France |
| 28 | Attacker #28 🇩🇪 | 75 | 1 | 2026-06-30 08:09 UTC | 2026-07-03 08:24 UTC | Frankfurt am Main, Hesse, Germany |
| 29 | Attacker #29 🇺🇸 | 74 | 1 | 2026-06-21 09:01 UTC | 2026-07-03 08:24 UTC | North Bergen, New Jersey, United States |
| 30 | Attacker #30 🇳🇱 | 74 | 1 | 2026-07-03 08:24 UTC | 2026-07-14 09:22 UTC | Amsterdam, North Holland, The Netherlands |
| 31 | Attacker #31 🇺🇸 | 72 | 1 | 2026-07-03 07:40 UTC | 2026-07-03 08:25 UTC | Los Angeles, California, United States |
| 32 | Attacker #32 🇪🇬 | 71 | 1 | 2026-06-25 17:52 UTC | 2026-07-03 08:24 UTC | Cairo, Cairo Governorate, Egypt |
| 33 | Attacker #33 🇸🇬 | 67 | 1 | 2026-07-02 01:45 UTC | 2026-07-03 08:24 UTC | Singapore, Singapore |
| 34 | Attacker #34 🇩🇪 | 67 | 2 | 2026-06-25 17:17 UTC | 2026-07-14 05:24 UTC | Falkenstein, Saxony, Germany |
| 35 | Attacker #35 🇮🇳 | 66 | 23 | 2026-06-27 09:35 UTC | 2026-07-03 08:24 UTC | Ahmedabad, Gujarat, India |
| 36 | Attacker #36 🇰🇷 | 66 | 1 | 2026-06-14 19:17 UTC | 2026-07-14 07:49 UTC | Iksan, Jeollabuk-do, South Korea |
| 37 | Attacker #37 🇳🇱 | 61 | 2 | 2026-06-23 06:55 UTC | 2026-07-05 17:33 UTC | Eygelshoven, Limburg, The Netherlands |
| 38 | Attacker #38 🇲🇩 | 58 | 1 | 2026-07-03 08:24 UTC | 2026-07-03 08:24 UTC | Chisinau, Chișinău Municipality, Moldova |
| 39 | Attacker #39 🇫🇷 | 58 | 2 | 2026-06-30 14:41 UTC | 2026-07-09 01:42 UTC | Paris, Île-de-France, France |
| 40 | Attacker #40 🇰🇿 | 58 | 1 | 2026-06-15 10:59 UTC | 2026-07-14 09:23 UTC | Kazakhstan |
| 41 | Attacker #41 🇺🇸 | 55 | 1 | 2026-06-18 14:43 UTC | 2026-07-03 08:24 UTC | Los Angeles, California, United States |
| 42 | Attacker #42 🇰🇷 | 53 | 1 | 2026-06-14 14:49 UTC | 2026-07-03 08:24 UTC | Suwon, Gyeonggi-do, South Korea |
| 43 | Attacker #43 🇭🇰 | 53 | 1 | 2026-06-29 06:51 UTC | 2026-07-03 08:24 UTC | Ha Kwai Chung, Kwai Tsing District, Hong Kong |
| 44 | Attacker #44 🇮🇩 | 52 | 1 | 2026-07-01 19:31 UTC | 2026-07-03 08:24 UTC | West Jakarta, Jakarta, Indonesia |
| 45 | Attacker #45 🇳🇱 | 52 | 1 | 2026-07-05 20:47 UTC | 2026-07-05 20:47 UTC | Amsterdam, North Holland, The Netherlands |
| 46 | Attacker #46 🇭🇰 | 50 | 1 | 2026-06-16 10:00 UTC | 2026-07-03 08:24 UTC | Hong Kong |
| 47 | Attacker #47 🇺🇸 | 48 | 1 | 2026-06-15 11:30 UTC | 2026-07-03 08:24 UTC | San Jose, California, United States |
| 48 | Attacker #48 🇺🇸 | 46 | 2 | 2026-06-21 03:46 UTC | 2026-07-03 08:24 UTC | North Bergen, New Jersey, United States |
| 49 | Attacker #49 🇳🇱 | 45 | 2 | 2026-06-25 17:45 UTC | 2026-07-03 08:24 UTC | Amsterdam, North Holland, The Netherlands |
| 50 | Attacker #50 🇸🇬 | 45 | 1 | 2026-06-16 16:08 UTC | 2026-07-03 08:24 UTC | Singapore |
Unlock attacker IP detail
Pro and Enterprise plans show individual attacker IPs, CVE mappings, first/last seen timestamps, and cross-sensor activity profiles.
Cross-CVE Attacker Intelligence
See which source IPs are targeting multiple exploited vulnerabilities, review per-CVE activity, and drill into Enterprise raw telemetry where available.