Threat Map
Where today's internet attacks are coming from, built from public threat-intelligence feeds.
Live replayThagobyte Threat Map
Loading…
- Attack source (scanning or brute-forcing)
- Attack origin country
- Network DDoS (layer 3)
- Web attacks (layer 7)
- Botnet control server
Attack feed
Top source countries
Most-attacked ports
Most-targeted countries
The map replays the latest snapshot, which is rebuilt every 2 hours. It isn't a feed of every packet. Attack sources are the IPs reported by the most SANS Internet Storm Center (DShield) sensors today. Many of the busiest are research scanners like Shodan and Censys, which is why the US looks so busy. Attack routes come from Cloudflare Radar, and botnet servers from abuse.ch Feodo Tracker. IP Geolocation by DB-IP; locations are approximate.