Current risk advisories Verified by our team Live CISA alerts, updated hourly Actively exploited vulnerabilities
Book a consultation
Live · updated daily

Global Attack Activity

Where today's most active attack sources are located, based on traffic hitting thousands of SANS Internet Storm Center sensors worldwide.

Today's briefing

Analyzing today's attack data…

–Top attack sources tracked
–Countries hosting them
–Targets probed
–Most active country
Loading live data…
Fewer More

Top source countries

  1. Loading…

Most targeted services

The network ports attackers probed most often across Storm Center sensors, and what they're usually after.

Loading…

Search today's attack sources

The most active attacking IP addresses reported to the Storm Center. Many are hijacked servers or home devices, not the attackers' own machines. Select an address to see the Storm Center's full report on it.

IP addressNetwork
Loading…

How to read this page

Attack sourceAn IP address that sent unwanted connection attempts to Storm Center sensors, which are ordinary internet-facing machines run by volunteers.
Targets probedHow many different sensor addresses a source tried to reach. High numbers mean broad, automated scanning rather than a targeted attack.
ReportsHow many individual attempts sensors logged from that source.
Country is not attributionAttackers rent cloud servers and hijack devices worldwide, so where traffic comes from rarely tells you who is behind it.
Why it matters to youAny system you expose to the internet receives this scanning within minutes. Keep remote access (RDP, SSH, admin panels) off the open internet, patch internet-facing systems quickly, and require multi-factor sign-in.
Should I block these addresses?Blocking known scanners cuts noise, but the list changes daily. Removing exposed services and patching protects you far more than blocklists alone.
Location shows where attacking servers are hosted, often in cloud or hosting providers, not who is behind an attack. Data: SANS Internet Storm Center, CC BY-NC-SA 4.0. Strat Cyber Advisors is not affiliated with SANS.
Work with
Strat Cyber

Need cybersecurity support? Share your project details. We're here to safeguard your digital assets.

Email
advisors@stratcyberadvisors.com
Members
Create free account · Sign in

Join free to unlock in-depth readiness assessments, executive and vendor toolkits, advisories and the briefing archive.