ScanMalware.com

Statistics

What ScanMalware saw in the last 24 hours: the infrastructure behind malicious websites, the threats they carry, and where scanned URLs come from.

Public scans
4,284
3,968 distinct sites
Malicious scans
1,711
39.9% of public scans
Malicious sites
1,458
distinct hostnames

Scans and malicious scans

All public scans per hour (UTC)

MaliciousOther scans
Hover a column for details · peak 241
11-09 10:00 UTC11-10 10:00 UTC
Show as table
PeriodScansMalicious
11-09 10:00 UTC7223
11-09 11:00 UTC17668
11-09 12:00 UTC202100
11-09 13:00 UTC241122
11-09 14:00 UTC18459
11-09 15:00 UTC17069
11-09 16:00 UTC16363
11-09 17:00 UTC17667
11-09 18:00 UTC17963
11-09 19:00 UTC16076
11-09 20:00 UTC19574
11-09 21:00 UTC16160
11-09 22:00 UTC16662
11-09 23:00 UTC16168
11-10 00:00 UTC21181
11-10 01:00 UTC19786
11-10 02:00 UTC16453
11-10 03:00 UTC16974
11-10 04:00 UTC16265
11-10 05:00 UTC17869
11-10 06:00 UTC17156
11-10 07:00 UTC16669
11-10 08:00 UTC18669
11-10 09:00 UTC16567
11-10 10:00 UTC10948

IP addresses hosting the most malicious sites

Distinct malicious hostnames per IP address

IP addressNetworkSites
🇺🇸199.36.158.100CDNAS54113 Fastly, Inc.392
🇺🇸104.18.54.45CDNAS13335 Cloudflare, Inc.127
🇺🇸104.18.50.34CDNAS13335 Cloudflare, Inc.125
🇺🇸188.114.97.3CDNAS13335 Cloudflare, Inc.63
🇺🇸188.114.96.3CDNAS13335 Cloudflare, Inc.58
🇸🇬43.174.247.29AS139341 ACE10
🇺🇸64.29.17.131CDNAS16509 Amazon.com, Inc.10
🇺🇸172.66.47.12CDNAS13335 Cloudflare, Inc.9
🇸🇬43.174.246.29AS139341 ACE9
🇭🇰156.225.108.42AS139057 Edgenext Legend Dynasty Pte. Ltd.8
🇺🇸64.29.17.195CDNAS16509 Amazon.com, Inc.8
🇭🇰156.225.108.41AS139057 Edgenext Legend Dynasty Pte. Ltd.7
🇺🇸216.198.79.131CDNAS16509 Amazon.com, Inc.7
🇺🇸172.66.47.99CDNAS13335 Cloudflare, Inc.6
🇺🇸216.198.79.67CDNAS16509 Amazon.com, Inc.6

Networks (ASNs) with the most malicious sites

Distinct malicious hostnames per network

  1. AS13335 Cloudflare, Inc.
    536
  2. AS54113 Fastly, Inc.
    394
  3. AS16509 Amazon.com, Inc.
    50
  4. AS43350 NForce Entertainment B.V.
    38
  5. AS37963 Hangzhou Alibaba Advertising Co.,Ltd.
    26
  6. AS979 NetLab Global
    21
  7. AS139341 ACE
    19
  8. AS45102 Alibaba (US) Technology Co., Ltd.
    18
  9. AS139057 Edgenext Legend Dynasty Pte. Ltd.
    16
  10. AS45090 Shenzhen Tencent Computer Systems Company Limited
    15
  11. AS16276 OVH SAS
    12
  12. AS20473 The Constant Company, LLC
    11
  13. AS14061 DigitalOcean, LLC
    10
  14. AS152194 CTG Server Limited
    9
  15. AS139659 LUCIDACLOUD LIMITED
    8

Domains with the most malicious subdomains

Distinct malicious subdomains under one registered domain

  1. edgeone.dev
    19
  2. glovonetwork.com
    4
  3. binanceapi.bet
    2
  4. cr-web.workers.dev
    2
  5. truist-webportal.com
    2
  6. urldance.com
    2
  7. 0ee9711ad2ec6d4cff432a62.workers.dev
    1
  8. 146slot.org
    1
  9. 1mb.site
    1
  10. 4everland.app
    1
  11. 69301210093.workers.dev
    1
  12. 92ea2438071f378d2627edbe.workers.dev
    1
  13. abembet.org
    1
  14. addliai.com
    1
  15. addliap.com
    1

Hosting platforms most abused

Malicious sites on free-subdomain and app-hosting platforms

  1. r2.dev
    252
  2. web.app
    235
  3. firebaseapp.com
    204
  4. pages.dev
    157
  5. vercel.app
    36
  6. workers.dev
    17
  7. netlify.app
    5
  8. onrender.com
    3
  9. blogspot.com
    2
  10. us-iad-10.linodeobjects.com
    2
  11. amplifyapp.com
    1
  12. cloudfront.net
    1
  13. plesk.page
    1
  14. replit.app
    1
  15. s3.amazonaws.com
    1

Threat types

Malicious scans by the kind of threat found

  1. Credential Phishing
    661
  2. Other
    287
  3. Brand Impersonation
    274
  4. Malware Distribution
    153
  5. Investment/Crypto Scam
    5
  6. Illegal Gambling
    4
  7. SEO Spam
    2
  8. Advance Fee Fraud
    2
  9. Tech Support Scam
    1

Top-level domains of malicious sites

Distinct malicious hostnames per TLD

  1. .dev
    445
  2. .com
    297
  3. .app
    278
  4. .top
    17
  5. .org
    16
  6. .net
    7
  7. .br
    6
  8. .cfd
    5
  9. .lol
    5
  10. .icu
    4
  11. .se
    4
  12. .site
    4
  13. .xyz
    4
  14. .cc
    3
  15. .fr
    3

Countries hosting the most malicious sites

Country of the hosting IP address. The second column leaves out shared CDN addresses, whose location is the network's, not the site's server.

CountryAll sitesExcl. CDN
🇺🇸 United States1,129144
🇨🇳 China5757
🇭🇰 Hong Kong5350
🇸🇬 Singapore3939
🇵🇦 Panama3838
🇯🇵 Japan2928
🇩🇪 Germany2215
🇫🇷 France1010
🇬🇧 United Kingdom109
🇳🇱 Netherlands1010
🇸🇨 Seychelles88
🇨🇦 Canada76
🇧🇷 Brazil44
🇪🇸 Spain33
🇸🇪 Sweden32

Countries hosting the most malicious sites (own servers)

Sites not behind a shared CDN, by the country of their server

  1. 🇺🇸 United States
    144
  2. 🇨🇳 China
    57
  3. 🇭🇰 Hong Kong
    50
  4. 🇸🇬 Singapore
    39
  5. 🇵🇦 Panama
    38
  6. 🇯🇵 Japan
    28
  7. 🇩🇪 Germany
    15
  8. 🇫🇷 France
    10
  9. 🇳🇱 Netherlands
    10
  10. 🇬🇧 United Kingdom
    9
  11. 🇸🇨 Seychelles
    8
  12. 🇨🇦 Canada
    6
  13. 🇧🇷 Brazil
    4
  14. 🇪🇸 Spain
    3
  15. 🇦🇺 Australia
    2

Cities hosting the most malicious sites

Sites not behind a shared CDN, by the city of their server. The city is known for 234 of 458 such sites.

  1. 🇺🇸 Los Angeles · United States
    26
  2. 🇯🇵 Tokyo · Japan
    18
  3. 🇨🇳 Beijing · China
    16
  4. 🇭🇰 Hong Kong · Hong Kong
    14
  5. 🇨🇳 Shanghai · China
    14
  6. 🇸🇬 Singapore · Singapore
    11
  7. 🇩🇪 Frankfurt am Main · Germany
    9
  8. 🇺🇸 Ashburn · United States
    8
  9. 🇨🇳 Hangzhou · China
    7
  10. 🇨🇳 Chengdu · China
    5
  11. 🇺🇸 Santa Clara · United States
    5
  12. 🇳🇱 Amsterdam · Netherlands
    4
  13. 🇺🇸 Atlanta · United States
    4
  14. 🇺🇸 Kansas City · United States
    4
  15. 🇺🇸 San Francisco · United States
    4

Countries submitting the most URLs

Ranked by URLs submitted by people. Excludes ScanMalware's own automated scanning.

  1. 1.🇩🇪 Germany
  2. 2.🇨🇭 Switzerland
  3. 3.🇺🇸 United States
  4. 4.🇬🇧 United Kingdom
  5. 5.🇸🇪 Sweden
  6. 6.🇧🇷 Brazil
  7. 7.🇦🇿 Azerbaijan
  8. 8.🇨🇾 Cyprus
  9. 9.🇪🇸 Spain
  10. 10.🇱🇹 Lithuania
  11. 11.🇲🇦 Morocco
  12. 12.🇹🇳 Tunisia
  13. 13.🇫🇷 France
  14. 14.🇰🇿 Kazakhstan
  15. 15.🇱🇾 Libya
  16. 16.🇲🇬 Madagascar
  17. 17.🇳🇱 Netherlands
  18. 18.🇵🇭 Philippines
  19. 19.🇸🇦 Saudi Arabia
  20. 20.🇺🇬 Uganda

Site traffic

Counted from 2026-11-09 (UTC). Scan views and visitors count people only: search engines, other crawlers and automated clients are left out.

Most viewed scans

Public scan results ranked by the number of people who opened them

  1. 1.sixteensshop.comSixteen
  2. 2.link.mail.beehiiv.comJust a moment...
  3. 3.clinical-salmon-1xkjlkaz-dpcal4y9clw2.edgeone.devLuật Sư Nhí - Full BXH + Ảnh Phòng Ngủ
  4. 4.j5htl-cqp-wg80-kwfom-07-09-2026-aa.pages.devSuspected Phishing | Cloudflare
  5. 5.startupcity-bizai.vercel.appOnboarding Form · Startup City × BIZ AI
  6. 6.agricova.pages.devDealer Application | Agricova
  7. 7.xunfelo-mpt-qavzari-h8d2ka95.pages.devSuspected Phishing | Cloudflare
  8. 8.yawning-pink-1yphz7uo-dpbak87jf3o3.edgeone.devA15 灯丝灯｜美国市场应用场景参考
  9. 9.202608.urldance.comLatest @ Sites
  10. 10.mio.seArcana Sittsäck 200L, Ø 60 cm | Mio
  11. 11.chog.bestchog.best | 525: SSL handshake failed
  12. 12.m.royalbankcoin.com星空体育(中国)官方网站|STARSPORTS
  13. 13.951943.lolLatest @ Sites
  14. 14.lunar-haven-3657-186fac36.pages.devWorker threw exception | lunar-haven-3657-186fac36.pages.dev | Cloudflare
  15. 15.playbcgameapp-com-ba1b147f.pages.devAccess Denied

Countries visitors come from

Ranked by the number of people visiting ScanMalware

  1. 1.🇺🇸 United States
  2. 2.🇫🇷 France
  3. 3.🇧🇷 Brazil
  4. 4.🇸🇬 Singapore
  5. 5.🇩🇪 Germany
  6. 6.🇪🇸 Spain
  7. 7.🇬🇧 United Kingdom
  8. 8.🇨🇳 China
  9. 9.🇨🇦 Canada
  10. 10.🇮🇳 India
  11. 11.🇮🇹 Italy
  12. 12.🇮🇩 Indonesia
  13. 13.🇻🇳 Vietnam
  14. 14.🇮🇶 Iraq
  15. 15.🇨🇴 Colombia
  16. 16.🇹🇷 Turkey
  17. 17.🇦🇷 Argentina
  18. 18.🇵🇹 Portugal
  19. 19.🇲🇾 Malaysia
  20. 20.🇧🇩 Bangladesh

Most requested registered domains via the API

Lookups grouped by registered domain

  1. kpmg.com
    98,860
  2. bmwgroup.com
    44,697
  3. leagueoflegends.com
    32,759
  4. snowflake.com
    26,706
  5. bmw.com
    24,734
  6. t-mobile.com
    17,311
  7. kpmg.com.au
    12,170
  8. kpmg.de
    10,148
  9. yelp.com
    9,667
  10. renault.com
    9,301
  11. blackstone.com
    7,124
  12. cbre.com
    7,074
  13. wjunction.com
    5,446
  14. nba.com
    5,147
  15. usiminas.com
    4,899

Busiest API endpoints

API requests by endpoint (our own systems excluded)

  1. /api/v1/search/smql
    2,276,310
  2. /api/v1/ct/dns/{host}
    2,250,143
  3. /api/v1/hosts/{host}
    2,239,769
  4. /api/v1/rdap/{id}
    21,021
  5. /api/v1/domain/history/{host}
    17,642
  6. /api/v1/domain/stats/{host}
    16,879
  7. /api/v1/result/{id}
    15,777
  8. /api/v1/tls/{id}
    12,772
  9. /api/v1/jarm/scan/{id}
    12,429
  10. /api/v1/ioc/{id}
    11,643
  11. /api/v1/rpki/{id}
    11,314
  12. /api/v1/scans/{id}/jsfingerprints
    11,163
  13. /api/v1/js-fingerprinting3/scan/{id}
    11,090
  14. /api/v1/js-fingerprinter2/{id}
    10,687
  15. /api/v1/ct/{host}
    10,485

JavaScript

Scripts loaded by the 2,342 websites scanned in the last 24 hours, counted as the number of distinct websites. Third-party means the script comes from a different registered domain than the page.

Most popular libraries and frameworks

Websites where the library or framework was detected

  1. jQuery · JavaScript library
    699
  2. Bootstrap · UI framework
    295
  3. jQuery Migrate · JavaScript library
    240
  4. React · JavaScript framework
    84
  5. Marked · JavaScript library
    67
  6. Vue.js · JavaScript framework
    64
  7. jQuery UI · JavaScript library
    52
  8. Swiper · JavaScript library
    50
  9. Underscore.js · JavaScript library
    48
  10. imagesLoaded · JavaScript library
    48
  11. Lightbox · JavaScript library
    37
  12. Magnific Popup · JavaScript library
    36
  13. OWL Carousel · JavaScript library
    35
  14. Tailwind CSS · UI framework
    34
  15. Stimulus · JavaScript framework
    33

Most used third-party script providers

Registered domain serving the script

  1. cloudflare.com
    574
  2. googletagmanager.com
    542
  3. google.com
    240
  4. facebook.net
    209
  5. gstatic.com
    208
  6. jquery.com
    188
  7. ajax.googleapis.com
    177
  8. doubleclick.net
    158
  9. jsdelivr.net
    105
  10. clarity.ms
    95
  11. google-analytics.com
    92
  12. gtomitsuka.github.io
    91
  13. cloudflareinsights.com
    86
  14. maps.googleapis.com
    69
  15. bing.com
    64

Most loaded third-party scripts

Script URL without its query string

  1. www.googletagmanager.com/gtag/js
    505
  2. challenges.cloudflare.com/turnstile/v0/b/8340802ab0bb/api.js
    324
  3. www.googletagmanager.com/gtm.js
    280
  4. challenges.cloudflare.com/turnstile/v0/api.js
    260
  5. connect.facebook.net/en_US/fbevents.js
    191
  6. ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
    113
  7. www.google.com/recaptcha/api.js
    110
  8. code.jquery.com/jquery-3.1.1.min.js
    108
  9. cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
    107
  10. code.jquery.com/jquery-3.3.1.js
    103
  11. gtomitsuka.github.io/gibberish-detector.js/gibberish.min.js
    91
  12. www.gstatic.com/recaptcha/releases/0lEGiwO4Qwx5R9ArxUy0mBpf/recaptcha__en.js
    89
  13. www.google-analytics.com/analytics.js
    79
  14. scripts.clarity.ms/0.8.77/clarity.js
    76
  15. static.cloudflareinsights.com/beacon.min.js/vce701823e78c4301a35b7e07294d87301792088814092
    74

Most common first-party scripts

Script path served from the website's own domain

  1. /wp-includes/js/jquery/jquery.min.js
    237
  2. /wp-includes/js/jquery/jquery-migrate.min.js
    214
  3. /wp-includes/js/wp-emoji-release.min.js
    193
  4. /_next/static/chunks/0cz1d0mv5g_q7.js
    181
  5. /_next/static/chunks/1ntn7efqc-iiw.js
    143
  6. /_next/static/chunks/14_fsmfcbrrbe.js
    142
  7. /_next/static/chunks/3nc6x0_y5iwnk.js
    142
  8. /_next/static/chunks/1jexzsn2qdw84.js
    141
  9. /_next/static/chunks/2g05-lers809t.js
    141
  10. /_next/static/chunks/3z-oetkpttgun.js
    138
  11. /_next/static/chunks/turbopack-3p84inqw3zu8w.js
    136
  12. /_next/static/chunks/3riw0-7aeplln.js
    125
  13. /_next/static/chunks/04u9x8_fzw9b5.js
    108
  14. /_next/static/chunks/31epa9yds3scr.js
    104
  15. /wp-includes/js/dist/hooks.min.js
    104

TLS server fingerprints

JARM and JA4S describe how a web server answers a TLS connection; servers running the same software and configuration share a fingerprint. Counted as distinct websites. The malicious rankings order fingerprints by the share of their websites that were malicious (at least 10 websites, 5 of them malicious). JA4S is recorded since 23 September 2026.

Most common JARM fingerprints

FingerprintUsual networkSitesMalicious
27d40d40d00040d00041d41d00041d5c54a1f00e65091ffab50f9203d10672Fastly, Inc.825443 (54%)
27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525cCloudflare, Inc.601145 (24%)
27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.591178 (30%)
29d29d00029d29d00041d41d00041db78309d03c04b7072bacbf1ce396279bAmazon.com, Inc.30513 (4%)
27d40d40d00040d1dc42d43d00041d5691268beec3bcca1d5ab3aacc89645fCloudflare, Inc.290253 (87%)
3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fbAmazon.com, Inc.22150 (23%)
27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.20113 (6%)
2ad2ad0002ad2ad22c42d42d0000008a5941c13f67e0c0a2c8a36bfeef6920ACE13720 (15%)
40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319Amazon.com, Inc.12359 (48%)
27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36cGoogle LLC11143 (39%)
07d14d16d21d21d00042d43d0000000adb85743f9b185b8deb52bd9380cb21Miss Hosting AB850 (0%)
29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36cFastly, Inc.8513 (15%)
2ad2ad0002ad2ad00042d42d0000002059a3b916699461c5923779b77cf06bMicrosoft Corporation7711 (14%)
29d29d00029d29d21c41d41d00041d38d8d683f08c154e73a9de64943d64e4Amazon.com, Inc.707 (10%)
29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3aeODERLAND Webbhotell AB6716 (24%)

JARM fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
27d40d40d00040d1dc42d43d00041d5691268beec3bcca1d5ab3aacc89645fCloudflare, Inc.290253 (87%)
21d19d00021d21d00042d43d0000005ad20eceaf7f71ae0887d2ff117bf97fAkamai Connected Cloud128 (67%)
3fd3fd0003fd3fd21c42d42d000000bdfc58c9a46434368cf60aa440385763AROSSCLOUD INC.106 (60%)
27d40d40d00040d00041d41d00041d5c54a1f00e65091ffab50f9203d10672Fastly, Inc.825443 (54%)
40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319Amazon.com, Inc.12359 (48%)
28d28d28d2ad28d1dc42d42d00042ded961c16c68658e95145597cf992c36cGoogle LLC209 (45%)
29d29d15d29d29d00042d42d000000cd600c085f371f8533aaf66051f8e5b1Oracle Corporation2812 (43%)
27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36cGoogle LLC11143 (39%)
15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9bAkamai Connected Cloud176 (35%)
15d3fd16d29d29d00042d43d0000007cad75e0049912dcaa3fad94e678d707Glesys AB155 (33%)
27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.591178 (30%)
27d27d27d0000001dc41d43d00041d1c5ac8aa552261ba8fd1aa9757c06fa5Cloudflare, Inc.175 (29%)
2ad2ad0002ad2ad22c42d42d000000a9aee03a49a8a804a0ef27cc7feba684Datacamp Limited246 (25%)
27d40d40d00040d00042d43d0000007d20e9b9a3e87aa1ec17cb4d646ce9a5ParkLogic Pty Ltd205 (25%)
27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525cCloudflare, Inc.601145 (24%)

Most common JA4S fingerprints

FingerprintUsual networkSitesMalicious
t130200_1302_234ea6891581Cloudflare, Inc.2,180690 (32%)
t130200_1301_a56c5b993250Fastly, Inc.1,517501 (33%)
t130200_1302_a56c5b993250ACE1,370218 (16%)
t130200_1303_a56c5b993250Amazon.com, Inc.405121 (30%)
t1206h2_c02f_3603f09c43baAmazon.com, Inc.525 (10%)
t1206h2_c02f_3f14cc51fb76Fastly, Inc.201 (5%)
t1207h1_c02f_b948729f6510China Unicom Beijing Province Network141 (7%)
t1204h2_c030_b252f78b95f6BM5 Bartosz Malinowski130 (0%)
t1206h2_c02b_3f14cc51fb76Cloudflare, Inc.134 (31%)
t120400_c02f_1d13d5853fceMicrosoft Corporation120 (0%)
t1207h2_c02f_b948729f6510Amazon.com, Inc.120 (0%)
t130200_1301_234ea6891581Rocket Fuel Inc.110 (0%)
t1207h1_c030_b948729f6510Internet Vikings International AB102 (20%)
t1207h2_c030_b948729f6510GoDaddy.com, LLC70 (0%)
t120200_c02f_344b4dce5a52Amazon.com, Inc.60 (0%)

JA4S fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
t130200_1301_a56c5b993250Fastly, Inc.1,517501 (33%)
t130200_1302_234ea6891581Cloudflare, Inc.2,180690 (32%)
t130200_1303_a56c5b993250Amazon.com, Inc.405121 (30%)
t130200_1302_a56c5b993250ACE1,370218 (16%)
t1206h2_c02f_3603f09c43baAmazon.com, Inc.525 (10%)

A scan counts as malicious when our AI verdict rates it Confirmed scam or High risk, or our rule-based verdict rates it Malicious. Threat statistics cover all public scans; the submitting-country ranking covers URLs submitted by people and excludes ScanMalware's own automated scanning. Unlisted and private scans are never shown individually. Refreshed every 30–60 minutes depending on the window · generated 2026-11-10 10:27 UTC.