Live Cyber Attack Map
Active malware command-and-control (C&C) servers being tracked right now by the abuse.ch FEODO Tracker. Each arc shows a known malicious host targeting major cloud and financial hubs.
- QakBot4
- Emotet1
Top countries hosting active C&C
- 1United StatesEmotet, QakBot3
- 2United KingdomQakBot1
- 3JapanQakBot1
Most active malware families
- 1QakBot4
- 2Emotet1
Top attack origins · Cloudflare Radar (2026-05-03 → 2026-05-10)
L3/4 (network) attacks
- 1Brazil30.16%
- 2United States13.51%
- 3India5.42%
- 4France3.65%
- 5Argentina3.30%
- 6Germany2.73%
- 7Colombia2.70%
- 8Poland2.33%
- 9Russian Federation1.94%
- 10Chile1.93%
L7 (application) attacks
- 1United States20.08%
- 2Brazil12.77%
- 3China6.06%
- 4Indonesia5.34%
- 5Germany4.08%
- 6Netherlands3.92%
- 7Singapore3.79%
- 8India3.28%
- 9Vietnam2.49%
- 10United Kingdom2.40%
Top attack TARGETS · Cloudflare Radar (2026-05-03 → 2026-05-10)
L3/4
- 1United States52.90%
- 2Hong Kong33.87%
- 3China8.10%
- 4Germany2.39%
- 5Brazil1.29%
- 6Taiwan0.85%
- 7India0.42%
- 8United Kingdom0.07%
L7
- 1United States42.95%
- 2China21.93%
- 3Canada6.32%
- 4United Kingdom3.35%
- 5Malaysia2.62%
- 6Hong Kong2.09%
- 7Nigeria1.70%
- 8France1.43%
Top attack vectors · Cloudflare Radar
L3/4 vectors
- 1Mirai (UDP) Flood52.92%
- 2UDP Flood28.79%
- 3SYN Flood9.38%
- 4CLDAP Flood2.60%
- 5ACK Flood2.37%
- 6other1.24%
- 7DNS Flood0.94%
- 8TLS Client Hello Flood0.82%
Actively exploited CVEs · CISA KEV
- CVE-2026-422082026-05-08BerriAI LiteLLM
BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorised access to the proxy and the credentials it manages.
- CVE-2026-69732026-05-07Ivanti Endpoint Manager Mobile (EPMM)
Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.
- CVE-2026-03002026-05-06Palo Alto Networks PAN-OS
Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.
- CVE-2026-314312026-05-01Linux Kernel
Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.
- CVE-2026-419402026-04-30WebPros cPanel & WHM and WP2 (WordPress Squared)Ransomware
WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
- CVE-2024-17082026-04-28ConnectWise ScreenConnect
ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.
- CVE-2026-322022026-04-28Microsoft Windows
Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.
- CVE-2025-296352026-04-24D-Link DIR-823X
D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- CVE-2024-73992026-04-24Samsung MagicINFO 9 Server
Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority.
- CVE-2024-577282026-04-24SimpleHelp SimpleHelp
SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.
- CVE-2024-577262026-04-24SimpleHelp SimpleHelp
SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.
- CVE-2026-399872026-04-23Marimo Marimo
Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.
Top attacked ports · SANS DShield (2026-05-10)
- 1:6842 sources · 46 targets110,200
- 2:234,938 sources · 119 targets108,775
- 3:328927,858 sources · 12 targets62,098
- 4:22221,862 sources · 120 targets58,311
- 5:01,277 sources · 45 targets24,264
- 6:222,072 sources · 116 targets20,619
- 7:4431,809 sources · 115 targets11,919
- 8:801,316 sources · 110 targets9,131
- 9:53529 sources · 108 targets7,449
- 10:9200417 sources · 115 targets7,115
- 11:526426 sources · 8 targets6,455
- 12:578414 sources · 4 targets6,438
Most active attacker IPs
- 89.248.163.2009,396 attacks
- 185.94.111.17,310 attacks
- 66.240.205.344,671 attacks
- 207.90.244.64,525 attacks
- 80.82.77.334,497 attacks
- 80.82.77.1394,488 attacks
Cybersecurity news · Hacker News
- CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers
- Nvidia confirms GeForce NOW data breach affecting Armenian users
- Canvas outage tied to cyberattack wreaked havoc on colleges' final exam season
- Canvas Data Breach; DeepSeek V4 Flash Boosts LLM Inference 4.3x
- International cyber attack disrupts swathe of universities and schools
- Chaos erupts as cyberattack disrupts learning platform Canvas amid finals
- Cyberattack hits Canvas system used by schools as finals loom
- Canvas outage delays college finals across the country
- We mapped the nationwide Instructure breach
- International cyber attack disrupts swathe of universities and schools
- CISA gives feds four days to patch Ivanti flaw exploited as zero-day
- CPanel's 30-Day Security Storm
Recently observed threats
| IP | Country | Malware | Hosting / ASN | Last online |
|---|---|---|---|---|
| 50.16.16.211:443 | US | QakBot | AMAZON-AES | 2026-03-12 |
| 162.243.103.246:8080 | US | Emotet | DIGITALOCEAN-ASN | 2026-03-07 |
| 27.133.154.218:443 | JP | QakBot | SAKURA-B SAKURA Internet Inc. | 2026-03-05 |
| 34.204.119.63:443 | US | QakBot | AMAZON-AES | 2026-03-01 |
| 178.62.3.223:443 | GB | QakBot | DIGITALOCEAN-ASN - DigitalOcean, LLC | 2026-02-18 |
About this map
This map visualizes active command-and-control (C&C) servers being tracked in real time by abuse.ch FEODO Tracker, a long-running threat intelligence project that tracks botnets like Emotet, QakBot, IcedID, TrickBot, and Dridex. Each point on the globe is the geolocation of a host that has been observed serving malware or coordinating infected machines.
We refresh the feed every ten minutes. Arcs from each source country are drawn to common attack targets (major cloud, financial, and government hubs) — these are illustrative of where malicious traffic is most likely to land, not literal observed attack paths.
DownRightNow uses signals like these alongside our own probe network to spot the difference between a normal outage and one with abnormal network activity. Want alerts when this hits services you depend on? See how monitoring works →