Observed Attackers
IPs observed targeting KEVIntel sensors, mapped to exploited CVEs.
1,205
Observed Attackers
16,242
Exploitation Events
81
Countries
51
KEVs Targeted
Top Observed Attackers
Source IPs ranked by observed exploitation attempts in the selected window.
2026-04-15 11:31 UTC – 2026-07-14 11:31 UTC
| Rank | Attacker | Attempts | CVEs | First Seen | Last Seen | Country |
|---|---|---|---|---|---|---|
| 1 | Attacker #1 🇩🇪 | 2,042 | 30 | 2026-07-03 02:13 UTC | 2026-07-03 08:25 UTC | Frankfurt am Main, Hesse, Germany |
| 2 | Attacker #2 🇺🇸 | 1,304 | 5 | 2026-06-16 10:41 UTC | 2026-07-03 13:35 UTC | North Bergen, New Jersey, United States |
| 3 | Attacker #3 🇺🇸 | 909 | 2 | 2026-07-01 01:33 UTC | 2026-07-03 08:24 UTC | Ashburn, Virginia, United States |
| 4 | Attacker #4 🇺🇸 | 406 | 3 | 2026-06-20 16:16 UTC | 2026-07-03 08:24 UTC | North Bergen, New Jersey, United States |
| 5 | Attacker #5 🇭🇰 | 316 | 3 | 2026-06-18 10:04 UTC | 2026-07-03 08:24 UTC | Hong Kong |
| 6 | Attacker #6 🇺🇸 | 298 | 26 | 2026-06-16 12:38 UTC | 2026-07-03 08:24 UTC | United States |
| 7 | Attacker #7 🇺🇸 | 274 | 1 | 2026-06-14 20:24 UTC | 2026-07-03 08:24 UTC | United States |
| 8 | Attacker #8 🇺🇦 | 261 | 1 | 2026-07-04 11:58 UTC | 2026-07-04 12:53 UTC | Kyiv, Kyiv City, Ukraine |
| 9 | Attacker #9 🇰🇷 | 238 | 1 | 2026-07-03 07:24 UTC | 2026-07-03 08:24 UTC | Incheon, Incheon, South Korea |
| 10 | Attacker #10 🇺🇸 | 233 | 1 | 2026-06-11 08:54 UTC | 2026-07-03 08:24 UTC | Chicago, Illinois, United States |
| 11 | Attacker #11 🇯🇵 | 191 | 1 | 2026-07-13 12:06 UTC | 2026-07-13 14:59 UTC | Tokyo, Tokyo, Japan |
| 12 | Attacker #12 🇮🇩 | 182 | 1 | 2026-06-14 18:44 UTC | 2026-07-03 08:24 UTC | South Tangerang, Banten, Indonesia |
| 13 | Attacker #13 🇯🇵 | 176 | 1 | 2026-06-30 15:23 UTC | 2026-07-11 15:37 UTC | Nakano City, Tokyo, Japan |
| 14 | Attacker #14 🇮🇩 | 172 | 1 | 2026-06-16 12:29 UTC | 2026-07-03 08:24 UTC | Jakarta, Jakarta, Indonesia |
| 15 | Attacker #15 🇫🇷 | 162 | 1 | 2026-07-02 03:56 UTC | 2026-07-03 08:24 UTC | Lauterbourg, Grand Est, France |
| 16 | Attacker #16 🇨🇾 | 160 | 1 | 2026-06-13 09:52 UTC | 2026-07-03 08:24 UTC | Cyprus |
| 17 | Attacker #17 🇺🇸 | 160 | 1 | 2026-07-03 01:04 UTC | 2026-07-03 08:24 UTC | San Jose, California, United States |
| 18 | Attacker #18 🇧🇬 | 156 | 2 | 2026-06-16 12:48 UTC | 2026-07-03 08:24 UTC | Bulgaria |
| 19 | Attacker #19 🇫🇷 | 129 | 1 | 2026-06-11 02:30 UTC | 2026-07-03 08:24 UTC | Aubervilliers, Île-de-France, France |
| 20 | Attacker #20 🇵🇭 | 126 | 1 | 2026-06-21 21:09 UTC | 2026-07-03 08:24 UTC | Cebu City, Central Visayas, Philippines |
| 21 | Attacker #21 🇺🇸 | 113 | 26 | 2026-06-29 02:53 UTC | 2026-07-03 08:24 UTC | New York, New York, United States |
| 22 | Attacker #22 🇳🇱 | 99 | 1 | 2026-06-27 12:55 UTC | 2026-07-03 08:24 UTC | Naaldwijk, South Holland, The Netherlands |
| 23 | Attacker #23 🇸🇮 | 96 | 1 | 2026-06-29 14:24 UTC | 2026-07-03 08:24 UTC | Ljubljana, Ljubljana, Slovenia |
| 24 | Attacker #24 🇲🇩 | 92 | 1 | 2026-06-11 08:47 UTC | 2026-07-03 08:24 UTC | Chisinau, Chișinău Municipality, Moldova |
| 25 | Attacker #25 🇺🇸 | 91 | 1 | 2026-06-29 13:36 UTC | 2026-07-03 08:24 UTC | Cedar Knolls, New Jersey, United States |
| 26 | Attacker #26 🇪🇪 | 88 | 26 | 2026-06-12 00:32 UTC | 2026-07-03 08:24 UTC | Tallinn, Harjumaa, Estonia |
| 27 | Attacker #27 🇻🇳 | 82 | 25 | 2026-06-29 01:36 UTC | 2026-07-03 08:24 UTC | Hanoi, Hanoi, Vietnam |
| 28 | Attacker #28 🇺🇸 | 80 | 1 | 2026-06-26 12:58 UTC | 2026-07-03 08:24 UTC | United States |
| 29 | Attacker #29 🇯🇵 | 76 | 1 | 2026-06-14 17:58 UTC | 2026-07-03 08:24 UTC | Tokyo, Tokyo, Japan |
| 30 | Attacker #30 🇩🇪 | 75 | 1 | 2026-06-30 08:09 UTC | 2026-07-03 08:24 UTC | Frankfurt am Main, Hesse, Germany |
| 31 | Attacker #31 🇺🇸 | 74 | 1 | 2026-06-21 09:01 UTC | 2026-07-03 08:24 UTC | North Bergen, New Jersey, United States |
| 32 | Attacker #32 🇳🇱 | 74 | 1 | 2026-07-03 08:24 UTC | 2026-07-14 09:22 UTC | Amsterdam, North Holland, The Netherlands |
| 33 | Attacker #33 🇺🇸 | 72 | 1 | 2026-07-03 07:40 UTC | 2026-07-03 08:25 UTC | Los Angeles, California, United States |
| 34 | Attacker #34 🇪🇬 | 71 | 1 | 2026-06-25 17:52 UTC | 2026-07-03 08:24 UTC | Cairo, Cairo Governorate, Egypt |
| 35 | Attacker #35 🇰🇷 | 70 | 1 | 2026-06-11 06:25 UTC | 2026-07-14 07:49 UTC | Iksan, Jeollabuk-do, South Korea |
| 36 | Attacker #36 🇸🇬 | 67 | 1 | 2026-07-02 01:45 UTC | 2026-07-03 08:24 UTC | Singapore, Singapore |
| 37 | Attacker #37 🇩🇪 | 67 | 2 | 2026-06-25 17:17 UTC | 2026-07-14 05:24 UTC | Falkenstein, Saxony, Germany |
| 38 | Attacker #38 🇮🇳 | 66 | 23 | 2026-06-27 09:35 UTC | 2026-07-03 08:24 UTC | Ahmedabad, Gujarat, India |
| 39 | Attacker #39 🇳🇱 | 61 | 2 | 2026-06-23 06:55 UTC | 2026-07-05 17:33 UTC | Eygelshoven, Limburg, The Netherlands |
| 40 | Attacker #40 🇰🇿 | 58 | 1 | 2026-06-15 10:59 UTC | 2026-07-14 09:23 UTC | Kazakhstan |
| 41 | Attacker #41 🇫🇷 | 58 | 2 | 2026-06-30 14:41 UTC | 2026-07-09 01:42 UTC | Paris, Île-de-France, France |
| 42 | Attacker #42 🇺🇸 | 55 | 1 | 2026-06-18 14:43 UTC | 2026-07-03 08:24 UTC | Los Angeles, California, United States |
| 43 | Attacker #43 🇭🇰 | 53 | 1 | 2026-06-29 06:51 UTC | 2026-07-03 08:24 UTC | Ha Kwai Chung, Kwai Tsing District, Hong Kong |
| 44 | Attacker #44 🇰🇷 | 53 | 1 | 2026-06-14 14:49 UTC | 2026-07-03 08:24 UTC | Suwon, Gyeonggi-do, South Korea |
| 45 | Attacker #45 🇮🇩 | 52 | 1 | 2026-07-01 19:31 UTC | 2026-07-03 08:24 UTC | West Jakarta, Jakarta, Indonesia |
| 46 | Attacker #46 🇳🇱 | 52 | 1 | 2026-07-05 20:47 UTC | 2026-07-05 20:47 UTC | Amsterdam, North Holland, The Netherlands |
| 47 | Attacker #47 🇭🇰 | 50 | 1 | 2026-06-16 10:00 UTC | 2026-07-03 08:24 UTC | Hong Kong |
| 48 | Attacker #48 🇺🇸 | 48 | 1 | 2026-06-15 11:30 UTC | 2026-07-03 08:24 UTC | San Jose, California, United States |
| 49 | Attacker #49 🇺🇸 | 46 | 2 | 2026-06-21 03:46 UTC | 2026-07-03 08:24 UTC | North Bergen, New Jersey, United States |
| 50 | Attacker #50 🇸🇬 | 45 | 1 | 2026-06-16 16:08 UTC | 2026-07-03 08:24 UTC | Singapore |
Unlock attacker IP detail
Pro and Enterprise plans show individual attacker IPs, CVE mappings, first/last seen timestamps, and cross-sensor activity profiles.
Cross-CVE Attacker Intelligence
See which source IPs are targeting multiple exploited vulnerabilities, review per-CVE activity, and drill into Enterprise raw telemetry where available.