ScanMalware.com

Statistics

What ScanMalware saw in the last 24 hours: the infrastructure behind malicious websites, the threats they carry, and where scanned URLs come from.

Public scans
4,021
3,777 distinct sites
Malicious scans
711
17.7% of public scans
Malicious sites
579
distinct hostnames

Scans and malicious scans

All public scans per hour (UTC)

MaliciousOther scans
Hover a column for details · peak 218
10-07 01:00 UTC10-08 01:00 UTC
Show as table
PeriodScansMalicious
10-07 01:00 UTC4120
10-07 02:00 UTC15424
10-07 03:00 UTC15030
10-07 04:00 UTC16532
10-07 05:00 UTC17134
10-07 06:00 UTC14724
10-07 07:00 UTC18215
10-07 08:00 UTC14421
10-07 09:00 UTC17616
10-07 10:00 UTC16733
10-07 11:00 UTC21838
10-07 12:00 UTC19262
10-07 13:00 UTC18636
10-07 14:00 UTC14920
10-07 15:00 UTC15019
10-07 16:00 UTC17920
10-07 17:00 UTC16624
10-07 18:00 UTC15023
10-07 19:00 UTC18628
10-07 20:00 UTC14524
10-07 21:00 UTC16031
10-07 22:00 UTC16026
10-07 23:00 UTC1672
10-08 00:00 UTC19377
10-08 01:00 UTC12332

IP addresses hosting the most malicious sites

Distinct malicious hostnames per IP address

IP addressNetworkSites
🇺🇸104.18.54.45CDNAS13335 Cloudflare, Inc.81
🇺🇸188.114.97.9CDNAS13335 Cloudflare, Inc.73
🇺🇸104.18.50.34CDNAS13335 Cloudflare, Inc.67
🇺🇸188.114.96.9CDNAS13335 Cloudflare, Inc.67
🇩🇪35.157.26.135CDNAS16509 Amazon.com, Inc.18
🇩🇪63.176.8.218CDNAS16509 Amazon.com, Inc.15
🇺🇸34.117.33.233CDNAS396982 Google LLC14
🇺🇸64.29.17.131CDNAS16509 Amazon.com, Inc.13
🇺🇸199.36.158.100CDNAS54113 Fastly, Inc.12
🇺🇸216.198.79.67CDNAS16509 Amazon.com, Inc.10
🇺🇸64.29.17.67CDNAS16509 Amazon.com, Inc.9
🇺🇸216.198.79.3CDNAS16509 Amazon.com, Inc.8
🇺🇸216.198.79.131CDNAS16509 Amazon.com, Inc.7
🇸🇬43.174.246.29AS139341 ACE6
🇺🇸64.29.17.195CDNAS16509 Amazon.com, Inc.6

Networks (ASNs) with the most malicious sites

Distinct malicious hostnames per network

  1. AS13335 Cloudflare, Inc.
    393
  2. AS16509 Amazon.com, Inc.
    84
  3. AS396982 Google LLC
    16
  4. AS54113 Fastly, Inc.
    13
  5. AS398256 Ultahost, Inc.
    10
  6. AS139341 ACE
    9
  7. AS397423 Tier.Net Technologies LLC
    8
  8. AS396356 Latitude.sh
    6
  9. AS174 Cogent Communications, LLC
    4
  10. AS31898 Oracle Corporation
    3
  11. AS397273 Render
    3
  12. AS212238 Datacamp Limited
    2
  13. AS46606 Unified Layer
    2
  14. AS51167 Contabo GmbH
    2
  15. AS51852 Private Layer INC
    2

Domains with the most malicious subdomains

Distinct malicious subdomains under one registered domain

  1. edgeone.dev
    9
  2. cr-web.workers.dev
    4
  3. wleemwfrv-2af.workers.dev
    2
  4. 1231302h.pl
    1
  5. 1266b8dd0c622df28d9af103.workers.dev
    1
  6. 15-204-228-33.plesk.page
    1
  7. 6e6248522346e7b34cdee839.workers.dev
    1
  8. 70bd88adaf0dd0164cd39348.workers.dev
    1
  9. 8go.workers.dev
    1
  10. alibaba99.com
    1
  11. antimoney-laundering.org
    1
  12. assistenzarecapiti.workers.dev
    1
  13. craftum.io
    1
  14. esu2n5lwqi.workers.dev
    1
  15. file-share-document-2026-08-26-0nedrive.cloud
    1

Hosting platforms most abused

Malicious sites on free-subdomain and app-hosting platforms

  1. pages.dev
    202
  2. r2.dev
    148
  3. vercel.app
    53
  4. netlify.app
    28
  5. workers.dev
    24
  6. replit.app
    14
  7. firebaseapp.com
    7
  8. web.app
    5
  9. onrender.com
    3
  10. github.io
    1
  11. laravel.cloud
    1
  12. plesk.page
    1

Threat types

Malicious scans by the kind of threat found

  1. Credential Phishing
    459
  2. Malware Distribution
    83
  3. Brand Impersonation
    80
  4. Other
    23
  5. Investment/Crypto Scam
    8
  6. Illegal Gambling
    7
  7. Tech Support Scam
    4
  8. Survey/Reward Scam
    3
  9. SEO Spam
    1
  10. Advance Fee Fraud
    1

Top-level domains of malicious sites

Distinct malicious hostnames per TLD

  1. .dev
    383
  2. .app
    100
  3. .com
    52
  4. .ru
    5
  5. .se
    5
  6. .cloud
    3
  7. .ua
    3
  8. .de
    2
  9. .ink
    2
  10. .io
    2
  11. .net
    2
  12. .online
    2
  13. .bi
    1
  14. .br
    1
  15. .cam
    1

Countries hosting the most malicious sites

Country of the hosting IP address. The second column leaves out shared CDN addresses, whose location is the network's, not the site's server.

CountryAll sitesExcl. CDN
🇺🇸 United States51335
🇩🇪 Germany302
🇸🇬 Singapore109
🇷🇺 Russia44
🇬🇧 United Kingdom33
🇧🇷 Brazil21
🇨🇭 Switzerland22
🇫🇷 France22
🇳🇱 Netherlands22
🇩🇰 Denmark11
🇪🇪 Estonia11
🇮🇪 Ireland10
🇮🇳 India11
🇮🇹 Italy10
🇸🇪 Sweden10

Countries hosting the most malicious sites (own servers)

Sites not behind a shared CDN, by the country of their server

  1. 🇺🇸 United States
    35
  2. 🇸🇬 Singapore
    9
  3. 🇷🇺 Russia
    4
  4. 🇬🇧 United Kingdom
    3
  5. 🇨🇭 Switzerland
    2
  6. 🇩🇪 Germany
    2
  7. 🇫🇷 France
    2
  8. 🇳🇱 Netherlands
    2
  9. 🇧🇷 Brazil
    1
  10. 🇩🇰 Denmark
    1
  11. 🇪🇪 Estonia
    1
  12. 🇮🇳 India
    1
  13. 🇻🇬 British Virgin Islands
    1

Cities hosting the most malicious sites

Sites not behind a shared CDN, by the city of their server. The city is known for 44 of 64 such sites.

  1. 🇺🇸 New York · United States
    11
  2. 🇺🇸 Ashburn · United States
    10
  3. 🇺🇸 New City · United States
    5
  4. 🇺🇸 Clifton · United States
    4
  5. 🇫🇷 Lauterbourg · France
    2
  6. 🇨🇭 Rümlang · Switzerland
    2
  7. 🇳🇱 Amsterdam · Netherlands
    1
  8. 🇩🇰 Copenhagen · Denmark
    1
  9. 🇩🇪 Falkenstein · Germany
    1
  10. 🇧🇷 Marialva · Brazil
    1
  11. 🇮🇳 Mumbai · India
    1
  12. 🇳🇱 Naaldwijk · Netherlands
    1
  13. 🇺🇸 Phoenix · United States
    1
  14. 🇺🇸 Reston · United States
    1
  15. 🇷🇺 St Petersburg · Russia
    1

Countries submitting the most URLs

Ranked by URLs submitted by people. Excludes ScanMalware's own automated scanning.

  1. 1.🇵🇱 Poland
  2. 2.🇩🇪 Germany
  3. 3.🇺🇸 United States
  4. 4.🇨🇭 Switzerland
  5. 5.🇲🇽 Mexico
  6. 6.🇨🇳 China
  7. 7.🇮🇱 Israel
  8. 8.🇸🇪 Sweden
  9. 9.🇧🇷 Brazil
  10. 10.🇨🇦 Canada
  11. 11.🇬🇧 United Kingdom
  12. 12.🇵🇰 Pakistan

Site traffic

Counted from 2026-10-07 (UTC). Scan views and visitors count people only: search engines, other crawlers and automated clients are left out.

Most viewed scans

Public scan results ranked by the number of people who opened them

  1. 1.svalue-dpxrvbr34s6b.edgeone.devS VALUE.COM v1.2 — Blox Fruits Trading Platform
  2. 2.novel-gold-f7bauhsn-dponbom1t9na.edgeone.dev대만 4일 두 상품 비교
  3. 3.bitsafec.com
  4. 4.rook-browser-dpp5foq6zxbd.edgeone.devRook Browser
  5. 5.vikingrepairdarien.pages.devRequest Viking repair in Darien, CT | Viking Repair Darien
  6. 6.wudaka.comDropCatch.com
  7. 7.lambda256.ioLambda256 Completes Joint Stablecoin Payment and Settlement PoC with South Korea's Credit Card Industry
  8. 8.ihomeproperty.comSan Pedro de Alcántara Ground Floor Apartment
  9. 9.watsonseptember-dpqfdpp8jlsd.edgeone.devWatson Transport Route Fuel Performance
  10. 10.mdhasibulhasan.siteMD. HASIBUL HASAN | CSE Student & ICT Teacher
  11. 11.15-hyperlinkapp-86x.pages.devHyperLink - Prime Broker for Hyperliquid
  12. 12.mask360tanktailor-dpx2tgjy3qf5.edgeone.devTank Tailors x Mask360, growth proposal
  13. 13.misty-dusk-87a5.pages.devCloudflare Speed Test について | Cloudflare
  14. 14.ai-ok-for-parents.pages.devMiddle School (Ages 11 to 13) | AI-OK? AI Safety Resources for Kids & Parents
  15. 15.romabelt1492.camRomaBet Güncel Giriş Adresi 2026 - Dünyanın Prestijli Casino Rehberi

Countries visitors come from

Ranked by the number of people visiting ScanMalware

  1. 1.🇺🇸 United States
  2. 2.🇸🇬 Singapore
  3. 3.🇨🇳 China
  4. 4.🇫🇷 France
  5. 5.🇩🇪 Germany
  6. 6.🇬🇧 United Kingdom
  7. 7.🇭🇰 Hong Kong SAR China
  8. 8.🇧🇷 Brazil
  9. 9.🇵🇹 Portugal
  10. 10.🇨🇦 Canada
  11. 11.🇲🇽 Mexico
  12. 12.🇮🇳 India
  13. 13.🇵🇱 Poland
  14. 14.🇳🇱 Netherlands
  15. 15.🇯🇵 Japan
  16. 16.🇪🇸 Spain
  17. 17.🇧🇩 Bangladesh
  18. 18.🇦🇷 Argentina
  19. 19.🇻🇳 Vietnam
  20. 20.🇲🇾 Malaysia

Most requested domains via the API

Domain and subdomain lookups (certificate and host APIs)

  1. oceanopt.ai
    2,736
  2. smartpal.ai
    2,736
  3. oceanai.ai
    2,736
  4. cruisepal.com
    2,736
  5. memphismarine.com
    2,736
  6. mariapps.in
    2,736
  7. seamedix.com
    2,736
  8. example.com
    2,018
  9. euroserve.example
    2,017
  10. euroserve-legacy.example
    2,015
  11. hackerone.com
    701
  12. indeed.com
    606
  13. facebook.com
    497
  14. shipmin.gov.in
    468
  15. pentest-ground.com
    458

Most requested registered domains via the API

Lookups grouped by registered domain

  1. bmwgroup.com
    17,954
  2. bmw.com
    10,918
  3. google.com
    9,625
  4. att.com
    6,809
  5. onehousing.com.vn
    6,050
  6. wjunction.com
    5,440
  7. usiminas.com
    4,368
  8. magento.com
    4,171
  9. kpmg.com.au
    4,054
  10. eldoradobrasil.com.br
    3,990
  11. edgeone.dev
    3,817
  12. jnj.com
    3,808
  13. nasa.gov
    3,781
  14. ibm.com
    3,751
  15. octocore.ru
    3,289

Busiest API endpoints

API requests by endpoint (our own systems excluded)

  1. /api/v1/ct/dns/{host}
    1,286,136
  2. /api/v1/hosts/{host}
    1,282,989
  3. /api/v1/search/smql
    1,276,773
  4. /api/v1/rdap/{id}
    11,819
  5. /api/v1/ct/{host}
    10,506
  6. /api/v1/domain/stats/{host}
    10,329
  7. /api/v1/domain/history/{host}
    10,094
  8. /api/v1/favicon/{id}
    9,376
  9. /api/v1/tls/{id}
    9,209
  10. /api/v1/jarm/scan/{id}
    9,168
  11. /api/v1/result/{id}
    8,393
  12. /api/v1/search
    8,131
  13. /api/v1/ioc/{id}
    8,012
  14. /api/v1/scans/{id}/jsfingerprints
    7,990
  15. /api/v1/js-fingerprinting3/scan/{id}
    7,903

JavaScript

Scripts loaded by the 2,516 websites scanned in the last 24 hours, counted as the number of distinct websites. Third-party means the script comes from a different registered domain than the page.

Most popular libraries and frameworks

Websites where the library or framework was detected

  1. jQuery · JavaScript library
    850
  2. Bootstrap · UI framework
    94
  3. Swiper · JavaScript library
    69
  4. jQuery UI · JavaScript library
    64
  5. OWL Carousel · JavaScript library
    63
  6. React · JavaScript framework
    56
  7. Lightbox · JavaScript library
    52
  8. Vue.js · JavaScript framework
    48
  9. Tailwind CSS · UI framework
    31
  10. Lodash · JavaScript library
    31
  11. Material Design Lite · UI framework
    27
  12. Stimulus · JavaScript framework
    25
  13. RequireJS · JavaScript framework
    24
  14. Nuxt.js · JavaScript framework
    22
  15. ZURB Foundation · UI framework
    21

Most used third-party script providers

Registered domain serving the script

  1. googletagmanager.com
    765
  2. cloudflare.com
    570
  3. google.com
    299
  4. yandex.ru
    248
  5. gstatic.com
    238
  6. google-analytics.com
    221
  7. facebook.net
    218
  8. doubleclick.net
    178
  9. ajax.googleapis.com
    147
  10. jsdelivr.net
    144
  11. yastatic.net
    128
  12. jquery.com
    111
  13. googlesyndication.com
    107
  14. cloudflareinsights.com
    99
  15. mail.ru
    89

Most loaded third-party scripts

Script URL without its query string

  1. www.googletagmanager.com/gtag/js
    690
  2. challenges.cloudflare.com/turnstile/v0/g/4df4a60fa397/api.js
    397
  3. www.googletagmanager.com/gtm.js
    345
  4. challenges.cloudflare.com/turnstile/v0/api.js
    311
  5. mc.yandex.ru/metrika/tag.js
    206
  6. www.google-analytics.com/analytics.js
    193
  7. connect.facebook.net/en_US/fbevents.js
    185
  8. www.google.com/recaptcha/api.js
    126
  9. www.gstatic.com/recaptcha/releases/guXhH0v-XMxlzmbTwqkaT4i5/recaptcha__en.js
    121
  10. yandex.ru/ads/system/context.js
    91
  11. yastatic.net/safeframe-bundles/0.89/host.js
    91
  12. yastatic.net/partner-code-bundles/libs/libs-edc4844f.js
    89
  13. yastatic.net/partner-code-bundles/libs/libs_render-edc4844f.js
    89
  14. www.google.com/recaptcha/api2/webworker.js
    86
  15. privacy-cs.mail.ru/static/sync-loader.js
    83

Most common first-party scripts

Script path served from the website's own domain

  1. /wp-includes/js/jquery/jquery.min.js
    277
  2. /wp-includes/js/jquery/jquery-migrate.min.js
    242
  3. /wp-includes/js/wp-emoji-release.min.js
    188
  4. /wp-includes/js/dist/hooks.min.js
    124
  5. /wp-includes/js/dist/i18n.min.js
    118
  6. /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
    103
  7. /cdn-cgi/challenge-platform/h/g/scripts/jsd/4df4a60fa397/main.js
    98
  8. /wp-includes/js/jquery/ui/core.min.js
    87
  9. /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1
    69
  10. /wp-content/plugins/elementor/assets/js/* (3 files)
    64
  11. /wp-content/plugins/contact-form-7/includes/js/index.js
    62
  12. /wp-content/plugins/contact-form-7/includes/swv/js/index.js
    62
  13. /_next/static/chunks/polyfills-42372ed130431b0a.js
    55
  14. /cdn/shopifycloud/checkout-web/assets/c1/* (8 files)
    46
  15. /cdn/shopifycloud/perf-kit/shopify-perf-kit-3.9.6.min.js
    46

TLS server fingerprints

JARM and JA4S describe how a web server answers a TLS connection; servers running the same software and configuration share a fingerprint. Counted as distinct websites. The malicious rankings order fingerprints by the share of their websites that were malicious (at least 10 websites, 5 of them malicious). JA4S is recorded since 23 September 2026.

Most common JARM fingerprints

FingerprintUsual networkSitesMalicious
27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.712211 (30%)
27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525cCloudflare, Inc.68286 (13%)
3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fbAmazon.com, Inc.31172 (23%)
29d29d00029d29d00041d41d00041db78309d03c04b7072bacbf1ce396279bAmazon.com, Inc.29014 (5%)
29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36cFastly, Inc.25518 (7%)
27d40d40d00040d1dc42d43d00041d5691268beec3bcca1d5ab3aacc89645fCloudflare, Inc.250149 (60%)
27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.1926 (3%)
16d3fd16d29d29d00042d43d00000071784fa9f8305ba9220d0a7894b6ff2cLoopia AB1690 (0%)
2ad2ad0002ad2ad22c42d42d0000008a5941c13f67e0c0a2c8a36bfeef6920ACE1359 (7%)
40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319Amazon.com, Inc.12431 (25%)
27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36cGoogle LLC11722 (19%)
29d3fd00029d29d00042d43d00041d6f940079659edb62e1c38c38bd26ee84Google LLC10019 (19%)
2ad2ad0002ad2ad00042d42d0000002059a3b916699461c5923779b77cf06bMicrosoft Corporation965 (5%)
29d29d00029d29d21c41d41d00041d38d8d683f08c154e73a9de64943d64e4Amazon.com, Inc.8110 (12%)
29d29d00029d29d00042d42d0000002059a3b916699461c5923779b77cf06bDomain names registrar REG.RU, Ltd700 (0%)

JARM fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
15d3fd16d29d29d00042d43d000000fe02290512647416dcf0a400ccbc0b6bTier.Net Technologies LLC3123 (74%)
27d40d40d00040d1dc42d43d00041d5691268beec3bcca1d5ab3aacc89645fCloudflare, Inc.250149 (60%)
28d28d28d2ad28d1dc42d42d00042ded961c16c68658e95145597cf992c36cGoogle LLC188 (44%)
27d27d27d0000001dc41d43d00041d1c5ac8aa552261ba8fd1aa9757c06fa5Cloudflare, Inc.125 (42%)
27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.712211 (30%)
40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319Amazon.com, Inc.12431 (25%)
29d29d00029d29d00042d43d00041d5de67cc9954cc85372523050f20b5007Cloudflare, Inc.205 (25%)
3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fbAmazon.com, Inc.31172 (23%)
28d28d28d2ad28d00042d42d0000002754d7386e47d3f44bdc269e2eaff0ffAkamai International B.V.225 (23%)
29d3fd00029d29d00042d43d00041d6f940079659edb62e1c38c38bd26ee84Google LLC10019 (19%)
27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36cGoogle LLC11722 (19%)
27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525cCloudflare, Inc.68286 (13%)
29d29d00029d29d21c41d41d00041d38d8d683f08c154e73a9de64943d64e4Amazon.com, Inc.8110 (12%)
29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36cFastly, Inc.25518 (7%)
2ad2ad0002ad2ad22c42d42d0000008a5941c13f67e0c0a2c8a36bfeef6920ACE1359 (7%)

Most common JA4S fingerprints

FingerprintUsual networkSitesMalicious
t130200_1302_234ea6891581Cloudflare, Inc.2,378515 (22%)
t130200_1302_a56c5b993250ACE1,93597 (5%)
t130200_1301_a56c5b993250Amazon.com, Inc.98664 (6%)
t130200_1303_a56c5b993250Amazon.com, Inc.517103 (20%)
t1206h2_c02f_3603f09c43baAmazon.com, Inc.540 (0%)
t1204h2_c030_b252f78b95f6GlobalConnect AB280 (0%)
t1207h1_c02f_b948729f6510JSC Selectel264 (15%)
t1207h2_c030_b948729f6510GoDaddy.com, LLC260 (0%)
t1207h2_c02c_b948729f6510JSC Selectel210 (0%)
t1207h1_c030_b948729f6510Akamai Technologies, Inc.201 (5%)
t1206h2_c02f_3f14cc51fb76Cloudflare, Inc.190 (0%)
t1207h2_c02f_b948729f6510Domain names registrar REG.RU, Ltd191 (5%)
t1206h2_c02b_3f14cc51fb76Cloudflare, Inc.162 (13%)
t1207h2_c02b_b948729f6510Rambler Internet Holding LLC160 (0%)
t1207h2_cca8_b948729f6510JSC IOT160 (0%)

JA4S fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
t130200_1302_234ea6891581Cloudflare, Inc.2,378515 (22%)
t130200_1303_a56c5b993250Amazon.com, Inc.517103 (20%)
t130200_1301_a56c5b993250Amazon.com, Inc.98664 (6%)
t130200_1302_a56c5b993250ACE1,93597 (5%)

A scan counts as malicious when our AI verdict rates it Confirmed scam or High risk, or our rule-based verdict rates it Malicious. Threat statistics cover all public scans; the submitting-country ranking covers URLs submitted by people and excludes ScanMalware's own automated scanning. Unlisted and private scans are never shown individually. Refreshed every 10–60 minutes depending on the window · generated 2026-10-08 01:50 UTC.