ScanMalware.com

Statistics

What ScanMalware saw in the last 24 hours: the infrastructure behind malicious websites, the threats they carry, and where scanned URLs come from.

Public scans
4,032
3,754 distinct sites
Malicious scans
707
17.5% of public scans
Malicious sites
539
distinct hostnames

Scans and malicious scans

All public scans per hour (UTC)

MaliciousOther scans
Hover a column for details · peak 233
09-25 02:00 UTC09-26 02:00 UTC
Show as table
PeriodScansMalicious
09-25 02:00 UTC7816
09-25 03:00 UTC15915
09-25 04:00 UTC16414
09-25 05:00 UTC15332
09-25 06:00 UTC16415
09-25 07:00 UTC15519
09-25 08:00 UTC17222
09-25 09:00 UTC16926
09-25 10:00 UTC15017
09-25 11:00 UTC17526
09-25 12:00 UTC21575
09-25 13:00 UTC16951
09-25 14:00 UTC23346
09-25 15:00 UTC15327
09-25 16:00 UTC16636
09-25 17:00 UTC15530
09-25 18:00 UTC16027
09-25 19:00 UTC16021
09-25 20:00 UTC16424
09-25 21:00 UTC18330
09-25 22:00 UTC14610
09-25 23:00 UTC17732
09-26 00:00 UTC18664
09-26 01:00 UTC13931
09-26 02:00 UTC871

IP addresses hosting the most malicious sites

Distinct malicious hostnames per IP address

IP addressNetworkSites
🇺🇸188.114.97.9CDNAS13335 Cloudflare, Inc.81
🇺🇸188.114.96.9CDNAS13335 Cloudflare, Inc.79
🇩🇪63.176.8.218CDNAS16509 Amazon.com, Inc.25
🇳🇱158.94.209.214AS202412 Omegatech LTD20
🇺🇸216.198.79.67CDNAS16509 Amazon.com, Inc.18
🇺🇸64.29.17.195CDNAS16509 Amazon.com, Inc.17
🇺🇸216.198.79.3CDNAS16509 Amazon.com, Inc.16
🇸🇬43.174.246.29AS139341 ACE16
🇺🇸64.29.17.67CDNAS16509 Amazon.com, Inc.15
🇺🇸64.29.17.131CDNAS16509 Amazon.com, Inc.14
🇩🇪35.157.26.135CDNAS16509 Amazon.com, Inc.13
🇺🇸104.21.33.193CDNAS13335 Cloudflare, Inc.12
🇺🇸216.198.79.195CDNAS16509 Amazon.com, Inc.12
🇺🇸104.18.54.45CDNAS13335 Cloudflare, Inc.11
🇺🇸216.198.79.131CDNAS16509 Amazon.com, Inc.10

Networks (ASNs) with the most malicious sites

Distinct malicious hostnames per network

  1. AS13335 Cloudflare, Inc.
    309
  2. AS16509 Amazon.com, Inc.
    129
  3. AS139341 ACE
    24
  4. AS202412 Omegatech LTD
    21
  5. AS31898 Oracle Corporation
    4
  6. AS396982 Google LLC
    4
  7. AS24940 Hetzner Online GmbH
    3
  8. AS51167 Contabo GmbH
    3
  9. AS54113 Fastly, Inc.
    3
  10. AS15169 Google LLC
    2
  11. AS214996 netcup GmbH
    2
  12. AS34119 Wildcard UK Limited
    2
  13. AS398101 GoDaddy.com, LLC
    2
  14. AS11990 Unlimited Net, LLC
    1
  15. AS12637 SEEWEB s.r.l.
    1

Domains with the most malicious subdomains

Distinct malicious subdomains under one registered domain

  1. cr-web.workers.dev
    20
  2. edgeone.dev
    20
  3. edgeone.app
    5
  4. 152-53-37-155.plesk.page
    2
  5. 70654733.workers.dev
    2
  6. iceiy.com
    2
  7. archive.org
    1
  8. authorised-support.com
    1
  9. b-cdn.net
    1
  10. bkinterim.com
    1
  11. coinboomai.com
    1
  12. dazesdsxcxmlcxcxcc.workers.dev
    1
  13. guevaracrescentiaatkp22899.workers.dev
    1
  14. hashkey.com
    1
  15. impar.ro
    1

Hosting platforms most abused

Malicious sites on free-subdomain and app-hosting platforms

  1. pages.dev
    230
  2. vercel.app
    92
  3. netlify.app
    31
  4. workers.dev
    27
  5. r2.dev
    20
  6. replit.app
    4
  7. plesk.page
    2
  8. web.app
    2
  9. blob.core.windows.net
    1
  10. duckdns.org
    1
  11. uw.r.appspot.com
    1
  12. wixsite.com
    1

Threat types

Malicious scans by the kind of threat found

  1. Credential Phishing
    368
  2. Malware Distribution
    141
  3. Brand Impersonation
    74
  4. Other
    34
  5. Illegal Gambling
    18
  6. Investment/Crypto Scam
    7
  7. Fake Shopping
    2
  8. Adware/PUP
    1
  9. Advance Fee Fraud
    1

Top-level domains of malicious sites

Distinct malicious hostnames per TLD

  1. .dev
    297
  2. .app
    134
  3. .com
    34
  4. .se
    26
  5. .org
    17
  6. .ru
    5
  7. .io
    3
  8. .co
    2
  9. .de
    2
  10. .net
    2
  11. .page
    2
  12. .at
    1
  13. .br
    1
  14. .ca
    1
  15. .click
    1

Countries hosting the most malicious sites

Country of the hosting IP address. The second column leaves out shared CDN addresses, whose location is the network's, not the site's server.

CountryAll sitesExcl. CDN
🇺🇸 United States43016
🇩🇪 Germany363
🇸🇬 Singapore2424
🇳🇱 Netherlands2121
🇫🇷 France55
🇷🇺 Russia33
🇬🇧 United Kingdom22
🇦🇹 Austria11
🇦🇺 Australia11
🇧🇩 Bangladesh11
🇧🇷 Brazil11
🇨🇭 Switzerland11
🇩🇰 Denmark10
🇫🇮 Finland11
🇭🇰 Hong Kong SAR China11

Countries hosting the most malicious sites (own servers)

Sites not behind a shared CDN, by the country of their server

  1. 🇸🇬 Singapore
    24
  2. 🇳🇱 Netherlands
    21
  3. 🇺🇸 United States
    16
  4. 🇫🇷 France
    5
  5. 🇩🇪 Germany
    3
  6. 🇷🇺 Russia
    3
  7. 🇬🇧 United Kingdom
    2
  8. 🇦🇹 Austria
    1
  9. 🇦🇺 Australia
    1
  10. 🇧🇩 Bangladesh
    1
  11. 🇧🇷 Brazil
    1
  12. 🇨🇭 Switzerland
    1
  13. 🇫🇮 Finland
    1
  14. 🇭🇰 Hong Kong SAR China
    1
  15. 🇮🇳 India
    1

Cities hosting the most malicious sites

Sites not behind a shared CDN, by the city of their server. The city is known for 46 of 89 such sites.

  1. 🇳🇱 Amsterdam · Netherlands
    20
  2. 🇺🇸 Ashburn · United States
    3
  3. 🇫🇷 Lauterbourg · France
    3
  4. 🇺🇸 Manassas · United States
    2
  5. 🇺🇸 Phoenix · United States
    2
  6. 🇷🇴 Bucharest · Romania
    1
  7. 🇺🇸 Chicago · United States
    1
  8. 🇺🇸 Dallas · United States
    1
  9. 🇩🇪 Falkenstein · Germany
    1
  10. 🇫🇮 Helsinki · Finland
    1
  11. 🇭🇰 Hong Kong · Hong Kong SAR China
    1
  12. 🇺🇸 Indianapolis · United States
    1
  13. 🇸🇪 Karlshamn · Sweden
    1
  14. 🇲🇾 Kuala Lumpur · Malaysia
    1
  15. 🇺🇸 Los Angeles · United States
    1

Countries submitting the most URLs

Ranked by URLs submitted by people. Excludes ScanMalware's own automated scanning.

  1. 1.🇨🇦 Canada
  2. 2.🇮🇹 Italy
  3. 3.🇺🇸 United States
  4. 4.🇪🇸 Spain
  5. 5.🇬🇧 United Kingdom
  6. 6.🇦🇹 Austria
  7. 7.🇧🇷 Brazil
  8. 8.🇨🇭 Switzerland
  9. 9.🇨🇱 Chile
  10. 10.🇩🇪 Germany
  11. 11.🇫🇷 France
  12. 12.🇮🇩 Indonesia
  13. 13.🇮🇳 India
  14. 14.🇱🇹 Lithuania
  15. 15.🇱🇻 Latvia
  16. 16.🇲🇾 Malaysia
  17. 17.🇵🇰 Pakistan
  18. 18.🇸🇪 Sweden

Site traffic

Counted from 2026-09-25 (UTC). Scan views and visitors count people only: search engines, other crawlers and automated clients are left out.

Most viewed scans

Public scan results ranked by the number of people who opened them

  1. 1.padisahbet.yeni-koruma.icuIndex of /
  2. 2.psyrusec.comSign in to your account
  3. 3.sunny-fox-33db.pages.devCloudflare Speed Test 소개 | Cloudflare
  4. 4.artikel-69b5dd2c1248-dpnxxg3ylwbi.edgeone.dev0 コンテナガーデン向けの自動水やり装置 人気ランキング: A Practical Starter Guide
  5. 5.foreign-crimson-8t6kpaas-dpn7f7qb61y2.edgeone.devNext.js by Vercel - The React Framework
  6. 6.itauu.vercel.appBanco Itaú | Abra sua conta Personnalité no Itaú. Atendimento e benefícios pensados para você
  7. 7.preview-chemresolution.pages.devTechnical Resources | Chem Resolution Inc.
  8. 8.reimagined-funicular-ivory.vercel.appNaver Sign in
  9. 9.ziparvel.pages.devNamrata Shirodkar Kiss : 'సరిలేరు నీకెవ్వరు' మూవీ టీం ఫుల్‌ జోష్‌లో ఉంది. - Parzivel
  10. 10.spond.comSpond - The new standard for organizing groups
  11. 11.chubby-olive-5conlg0a-dpnd4j7ahk26.edgeone.devNext.js by Vercel - The React Framework
  12. 12.fluffy-pink-waub20ye-dpxglxsklgjm.edgeone.devTencent Edgeone
  13. 13.x.comVal d'Isère (@valdisere) / X
  14. 14.diezodontologia.comDiez Odontología | Dr. Diego Zoppi - Quilmes
  15. 15.dssprev.pages.devDelightfully Stuck Studios — Places worth getting stuck in

Countries visitors come from

Ranked by the number of people visiting ScanMalware

  1. 1.🇧🇷 Brazil
  2. 2.🇸🇬 Singapore
  3. 3.🇺🇸 United States
  4. 4.🇦🇷 Argentina
  5. 5.🇨🇳 China
  6. 6.🇲🇽 Mexico
  7. 7.🇧🇩 Bangladesh
  8. 8.🇫🇷 France
  9. 9.🇹🇷 Türkiye
  10. 10.🇨🇱 Chile
  11. 11.🇮🇹 Italy
  12. 12.🇺🇦 Ukraine
  13. 13.🇨🇴 Colombia
  14. 14.🇵🇭 Philippines
  15. 15.🇪🇨 Ecuador
  16. 16.🇻🇪 Venezuela
  17. 17.🇵🇪 Peru
  18. 18.🇷🇺 Russia
  19. 19.🇵🇾 Paraguay
  20. 20.🇵🇹 Portugal

Most requested domains via the API

Domain and subdomain lookups (certificate and host APIs)

  1. cosmos.windows-int.net
    5,004
  2. mariapps.in
    2,840
  3. cruisepal.com
    2,840
  4. smartpal.ai
    2,840
  5. oceanai.ai
    2,840
  6. memphismarine.com
    2,840
  7. seamedix.com
    2,840
  8. oceanopt.ai
    2,840
  9. example.com
    1,552
  10. trendmilcro.com
    1,498
  11. e2e.test
    1,113
  12. httpbin.org
    850
  13. bld3r.com
    720
  14. qld33.top
    700
  15. msb.com.vn
    650

Most requested registered domains via the API

Lookups grouped by registered domain; hover for how many names were looked up

  1. deere.com
    39,474
  2. kpmg.com
    37,975
  3. bmwgroup.com
    29,368
  4. tamu.edu
    20,018
  5. bmw.com
    18,132
  6. google.com
    10,252
  7. wjunction.com
    8,711
  8. zoho.com
    7,480
  9. onehousing.com.vn
    6,970
  10. magento.com
    6,718
  11. att.com
    6,220
  12. windows-int.net
    5,270
  13. eldoradobrasil.com.br
    4,416
  14. usiminas.com
    4,140
  15. ennov.com
    3,680

Busiest API endpoints

API requests by endpoint (our own systems excluded)

  1. /api/v1/search/smql
    1,929,476
  2. /api/v1/ct/dns/{host}
    1,918,758
  3. /api/v1/hosts/{host}
    1,917,103
  4. /api/v1/hosts/{x}
    15,659
  5. /api/v1/ct/dns/{x}
    15,656
  6. /api/v1/domains/{host}/scans
    15,472
  7. /api/v1/tls/{id}
    7,809
  8. /api/v1/jarm/scan/{id}
    7,570
  9. /api/v1/result/{id}
    6,420
  10. /api/v1/search/ip/{ip}
    5,374
  11. /api/v1/yara/{id}
    4,888
  12. /api/v1/search/jarm/{hash}
    4,807
  13. /api/v1/rdap/{id}
    3,273
  14. /api/v1/ioc/{id}
    3,251
  15. /api/v1/ct/{host}
    3,173

JavaScript

Scripts loaded by the 2,336 websites scanned in the last 24 hours, counted as the number of distinct websites. Third-party means the script comes from a different registered domain than the page.

Most popular libraries and frameworks

Websites where the library or framework was detected

  1. jQuery · JavaScript library
    719
  2. React · JavaScript framework
    195
  3. jQuery UI · JavaScript library
    78
  4. Bootstrap · UI framework
    62
  5. Vue.js · JavaScript framework
    53
  6. OWL Carousel · JavaScript library
    53
  7. Swiper · JavaScript library
    47
  8. Lightbox · JavaScript library
    35
  9. AMP · JavaScript framework
    28
  10. Moment.js · JavaScript library
    27
  11. RequireJS · JavaScript framework
    24
  12. Lodash · JavaScript library
    20
  13. Tailwind CSS · UI framework
    19
  14. Nuxt.js · JavaScript framework
    15
  15. ZURB Foundation · UI framework
    14

Most used third-party script providers

Registered domain serving the script

  1. googletagmanager.com
    743
  2. cloudflare.com
    520
  3. google.com
    312
  4. facebook.net
    241
  5. yandex.ru
    225
  6. google-analytics.com
    213
  7. gstatic.com
    190
  8. doubleclick.net
    177
  9. jsdelivr.net
    155
  10. googlesyndication.com
    115
  11. yastatic.net
    115
  12. ajax.googleapis.com
    102
  13. cloudflareinsights.com
    95
  14. jquery.com
    84
  15. mail.ru
    84

Most loaded third-party scripts

Script URL without its query string

  1. www.googletagmanager.com/gtag/js
    689
  2. challenges.cloudflare.com/turnstile/v0/b/d76008a69eab/api.js
    386
  3. www.googletagmanager.com/gtm.js
    318
  4. challenges.cloudflare.com/turnstile/v0/api.js
    292
  5. connect.facebook.net/en_US/fbevents.js
    197
  6. www.google-analytics.com/analytics.js
    188
  7. mc.yandex.ru/metrika/tag.js
    183
  8. www.gstatic.com/recaptcha/releases/kemdRjWFxNjgsGdhRslyEPwU/recaptcha__en.js
    115
  9. www.google.com/recaptcha/api.js
    102
  10. pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
    89
  11. yastatic.net/safeframe-bundles/0.89/host.js
    87
  12. yastatic.net/partner-code-bundles/libs/libs-edc4844f.js
    84
  13. yastatic.net/partner-code-bundles/libs/libs_render-edc4844f.js
    84
  14. static.cloudflareinsights.com/beacon.min.js/v31edd6df95cf4e85bb4c19e7a9bdbcba1788362987495
    83
  15. ep2.adtrafficquality.google/sodar/sodar2.js
    81

Most common first-party scripts

Script path served from the website's own domain

  1. /wp-includes/js/jquery/jquery.min.js
    212
  2. /wp-includes/js/jquery/jquery-migrate.min.js
    192
  3. /wp-includes/js/wp-emoji-release.min.js
    156
  4. /* (3 files)
    116
  5. /cdn-cgi/challenge-platform/h/b/scripts/jsd/d76008a69eab/main.js
    109
  6. /dc6a8720040df98778fe970bf6c000a41750d3ae-71b279128d9d41aa1f02.js
    107
  7. /component---src-containers-sub-page-js-e7fb715774364f9d93eb.js
    103
  8. /cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1
    87
  9. /wp-includes/js/dist/hooks.min.js
    87
  10. /wp-includes/js/dist/i18n.min.js
    83
  11. /wp-includes/js/jquery/ui/core.min.js
    79
  12. /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
    58
  13. /wp-content/plugins/elementor/assets/js/* (3 files)
    56
  14. /checkouts/internal/preloads.js
    53
  15. /cdn/shopifycloud/perf-kit/shopify-perf-kit-3.9.4.min.js
    52

TLS server fingerprints

JARM and JA4S describe how a web server answers a TLS connection; servers running the same software and configuration share a fingerprint. Counted as distinct websites. The malicious rankings order fingerprints by the share of their websites that were malicious (at least 10 websites, 5 of them malicious). JA4S is recorded since 23 September 2026.

Most common JARM fingerprints

FingerprintUsual networkSitesMalicious
27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.652225 (35%)
27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525cCloudflare, Inc.591103 (17%)
3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fbAmazon.com, Inc.477146 (31%)
29d29d00029d29d00041d41d00041db78309d03c04b7072bacbf1ce396279bAmazon.com, Inc.3259 (3%)
40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319Amazon.com, Inc.28836 (13%)
2ad2ad0002ad2ad22c42d42d0000008a5941c13f67e0c0a2c8a36bfeef6920ACE16424 (15%)
27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.16110 (6%)
27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36cGoogle LLC12516 (13%)
16d3fd16d29d29d00042d43d00000071784fa9f8305ba9220d0a7894b6ff2cLoopia AB1030 (0%)
2ad2ad0002ad2ad00042d42d0000002059a3b916699461c5923779b77cf06bAkamai International B.V.996 (6%)
29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36cFastly, Inc.846 (7%)
29d3fd00029d29d00042d43d00041d6f940079659edb62e1c38c38bd26ee84Google LLC7511 (15%)
29d29d00029d29d21c41d41d00041d38d8d683f08c154e73a9de64943d64e4Amazon.com, Inc.651 (2%)
2ad2ad0002ad2ad00042d42d00000000f78d2dc0ce6e5bbc5b8149a4872356Akamai Technologies, Inc.514 (8%)
29d29d00029d29d00029d29d29d29d00efabaa2e194cf5d86dd52d92433babAmazon.com, Inc.490 (0%)

JARM fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
27d40d40d00040d1dc42d43d00041d5691268beec3bcca1d5ab3aacc89645fCloudflare, Inc.4324 (56%)
15d3fd16d29d29d00042d43d0000007cad75e0049912dcaa3fad94e678d707Contabo GmbH105 (50%)
28d28d28d2ad28d1dc42d42d00042ded961c16c68658e95145597cf992c36cGoogle LLC156 (40%)
27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.652225 (35%)
3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fbAmazon.com, Inc.477146 (31%)
15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9bContabo GmbH185 (28%)
2ad2ad0002ad2ad22c42d42d000000a9aee03a49a8a804a0ef27cc7feba684Datacamp Limited298 (28%)
29d29d15d29d29d00042d42d000000df133019600a83abfb096ff3e86cd79dAxByte Internet Services AB266 (23%)
27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525cCloudflare, Inc.591103 (17%)
29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3aeHetzner Online GmbH417 (17%)
29d3fd00029d29d00042d43d00041d6f940079659edb62e1c38c38bd26ee84Google LLC7511 (15%)
2ad2ad0002ad2ad22c42d42d0000008a5941c13f67e0c0a2c8a36bfeef6920ACE16424 (15%)
27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36cGoogle LLC12516 (13%)
40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319Amazon.com, Inc.28836 (13%)
29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36cFastly, Inc.846 (7%)

Most common JA4S fingerprints

FingerprintUsual networkSitesMalicious
t130200_1302_234ea6891581Cloudflare, Inc.2,021417 (21%)
t130200_1302_a56c5b993250ACE1,789109 (6%)
t130200_1301_a56c5b993250Amazon.com, Inc.86936 (4%)
t130200_1303_a56c5b993250Amazon.com, Inc.832188 (23%)
t1206h2_c02f_3603f09c43baAmazon.com, Inc.852 (2%)
t1207h2_c030_b948729f6510GoDaddy.com, LLC363 (8%)
t1207h1_c030_b948729f65103nt solutions LLP311 (3%)
t1207h2_c02f_b948729f6510EdgeCenter LLC302 (7%)
t1207h1_c02f_b948729f6510LLC VK291 (3%)
t1206h2_c02b_3f14cc51fb76Cloudflare, Inc.253 (12%)
t1205h1_c008_845f7282a956Wildcard UK Limited172 (12%)
t1207h2_c02b_b948729f6510EdgeCenter LLC160 (0%)
t1206h2_c02f_3f14cc51fb76Fastly, Inc.141 (7%)
t1207h2_c02c_b948729f6510Domain names registrar REG.RU, Ltd142 (14%)
t1204h2_c030_b252f78b95f6Aruba S.p.A.130 (0%)

JA4S fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
t130200_1303_a56c5b993250Amazon.com, Inc.832188 (23%)
t130200_1302_234ea6891581Cloudflare, Inc.2,021417 (21%)
t130200_1302_a56c5b993250ACE1,789109 (6%)
t130200_1301_a56c5b993250Amazon.com, Inc.86936 (4%)

A scan counts as malicious when our AI verdict rates it Confirmed scam or High risk, or our rule-based verdict rates it Malicious. Threat statistics cover all public scans; the submitting-country ranking covers URLs submitted by people and excludes ScanMalware's own automated scanning. Unlisted and private scans are never shown individually. Refreshed every 10–60 minutes depending on the window · generated 2026-09-26 02:38 UTC.