The internet
Malware and botnets
New malware download sites as abuse.ch’s URLhaus records them, streamed onto the map, beside the command servers that botnets report to.
What you see
- Malware sites, placed by the location of their IP address. Click one for the threat, the malware family, the host, its network and how long it has been seen.
- Botnet command servers from Feodo Tracker. Click one for the malware, address, port, network and when it was last online.
Where the data comes from
- abuse.ch URLhausMalware distribution sites reported by the security community.
- abuse.ch Feodo TrackerBotnet command-and-control servers.
- ip-api.comWhere each address is located.
URLhaus is checked every minute and new sites are pushed straight to the map. Feodo Tracker is read every 5 minutes.
Good to know
- Locations come from IP geolocation, which shows where an address is registered or hosted, not who is behind it.
- Botnet servers are pinned at the middle of their hosting country.
- A listed server is infrastructure, not an attack in progress.
Goes well with
Attack originsThe countries most network-layer DDoS attack traffic comes from, per Cloudflare Radar over the last day, on a live map with each country’s share.
Internet outagesInternet outages around the world from Cloudflare Radar, on a live map: which countries and networks lost connectivity, why, and for how long.
Service incidentsIncidents posted on the status pages of major cloud and software services, on a live map: what is down or degraded right now, in their own words.