ScanMalware.com

Statistics

What ScanMalware saw in the last 12 hours: the infrastructure behind malicious websites, the threats they carry, and where scanned URLs come from.

Public scans
2,140
2,050 distinct sites
Malicious scans
519
24.3% of public scans
Malicious sites
453
distinct hostnames

Scans and malicious scans

All public scans per hour (UTC)

MaliciousOther scans
Hover a column for details · peak 209
10-15 02:00 UTC10-15 14:00 UTC
Show as table
PeriodScansMalicious
10-15 02:00 UTC11770
10-15 03:00 UTC17963
10-15 04:00 UTC16734
10-15 05:00 UTC16825
10-15 06:00 UTC15126
10-15 07:00 UTC18525
10-15 08:00 UTC14931
10-15 09:00 UTC19325
10-15 10:00 UTC16434
10-15 11:00 UTC18240
10-15 12:00 UTC18576
10-15 13:00 UTC20963
10-15 14:00 UTC917

IP addresses hosting the most malicious sites

Distinct malicious hostnames per IP address

IP addressNetworkSites
🇺🇸188.114.96.9CDNAS13335 Cloudflare, Inc.83
🇺🇸188.114.97.9CDNAS13335 Cloudflare, Inc.77
🇺🇸104.18.50.34CDNAS13335 Cloudflare, Inc.26
🇺🇸104.18.54.45CDNAS13335 Cloudflare, Inc.21
🇩🇪63.176.8.218CDNAS16509 Amazon.com, Inc.17
🇺🇸199.36.158.100CDNAS54113 Fastly, Inc.12
🇩🇪35.157.26.135CDNAS16509 Amazon.com, Inc.6
🇺🇸172.245.91.44AS36352 HostPapa5
🇨🇦198.54.132.28AS11878 tzulo, inc.4
🇺🇸216.198.79.195CDNAS16509 Amazon.com, Inc.4
🇸🇬43.174.247.29AS139341 ACE4
🇺🇸64.29.17.3CDNAS16509 Amazon.com, Inc.4
🇺🇸64.29.17.67CDNAS16509 Amazon.com, Inc.4
🇺🇸172.66.44.134CDNAS13335 Cloudflare, Inc.3
🇺🇸172.66.44.60CDNAS13335 Cloudflare, Inc.3

Networks (ASNs) with the most malicious sites

Distinct malicious hostnames per network

  1. AS13335 Cloudflare, Inc.
    353
  2. AS16509 Amazon.com, Inc.
    41
  3. AS54113 Fastly, Inc.
    13
  4. AS139341 ACE
    6
  5. AS36352 HostPapa
    5
  6. AS11878 tzulo, inc.
    4
  7. AS15169 Google LLC
    4
  8. AS396982 Google LLC
    3
  9. AS14061 DigitalOcean, LLC
    2
  10. AS207043 Dedik Services Limited
    2
  11. AS63949 Akamai Connected Cloud
    2
  12. AS8075 Microsoft Corporation
    2
  13. AS14618 Amazon.com, Inc.
    1
  14. AS16276 OVH SAS
    1
  15. AS202412 Omegatech LTD
    1

Domains with the most malicious subdomains

Distinct malicious subdomains under one registered domain

  1. edgeone.dev
    6
  2. no-spotify.com
    4
  3. cloud-ip.cc
    3
  4. cr-web.workers.dev
    3
  5. 57b79ffb3043f32930fb5bee.workers.dev
    1
  6. agnes-terrieux.workers.dev
    1
  7. andres457646.workers.dev
    1
  8. e1e1de714f370d6f275a8fde.workers.dev
    1
  9. elb.us-east-1.amazonaws.com
    1
  10. google.com
    1
  11. lodasaf228.workers.dev
    1
  12. microsoftsupportcenter.digital
    1
  13. mudancascuritibana.com.br
    1
  14. mysaol.com
    1
  15. othersmx.workers.dev
    1

Hosting platforms most abused

Malicious sites on free-subdomain and app-hosting platforms

  1. pages.dev
    275
  2. r2.dev
    47
  3. vercel.app
    22
  4. netlify.app
    19
  5. workers.dev
    13
  6. firebaseapp.com
    7
  7. web.app
    5
  8. replit.app
    2
  9. an.r.appspot.com
    1
  10. ddnss.de
    1
  11. dyn.ddnss.de
    1
  12. github.io
    1
  13. onrender.com
    1
  14. us-east-1.amazonaws.com
    1
  15. webflow.io
    1

Threat types

Malicious scans by the kind of threat found

  1. Credential Phishing
    330
  2. Malware Distribution
    98
  3. Brand Impersonation
    40
  4. Other
    17
  5. Illegal Gambling
    2
  6. Advance Fee Fraud
    1

Top-level domains of malicious sites

Distinct malicious hostnames per TLD

  1. .dev
    341
  2. .app
    48
  3. .com
    25
  4. .us
    5
  5. .cc
    3
  6. .cfd
    3
  7. .de
    3
  8. .br
    2
  9. .io
    2
  10. .ru
    2
  11. .se
    2
  12. .at
    1
  13. .bid
    1
  14. .co
    1
  15. .delivery
    1

Countries hosting the most malicious sites

Country of the hosting IP address. The second column leaves out shared CDN addresses, whose location is the network's, not the site's server.

CountryAll sitesExcl. CDN
🇺🇸 United States41013
🇩🇪 Germany223
🇸🇬 Singapore76
🇨🇦 Canada55
🇧🇷 Brazil11
🇫🇷 France11
🇮🇱 Israel11
🇱🇹 Lithuania11
🇳🇱 Netherlands11
🇷🇴 Romania11
🇷🇺 Russia11
🇸🇪 Sweden11
🇿🇦 South Africa11

Countries hosting the most malicious sites (own servers)

Sites not behind a shared CDN, by the country of their server

  1. 🇺🇸 United States
    13
  2. 🇸🇬 Singapore
    6
  3. 🇨🇦 Canada
    5
  4. 🇩🇪 Germany
    3
  5. 🇧🇷 Brazil
    1
  6. 🇫🇷 France
    1
  7. 🇮🇱 Israel
    1
  8. 🇱🇹 Lithuania
    1
  9. 🇳🇱 Netherlands
    1
  10. 🇷🇴 Romania
    1
  11. 🇷🇺 Russia
    1
  12. 🇸🇪 Sweden
    1
  13. 🇿🇦 South Africa
    1

Cities hosting the most malicious sites

Sites not behind a shared CDN, by the city of their server. The city is known for 20 of 36 such sites.

  1. 🇺🇸 Elk Grove Village · United States
    5
  2. 🇨🇦 Toronto · Canada
    4
  3. 🇩🇪 Frankfurt am Main · Germany
    3
  4. 🇳🇱 Amsterdam · Netherlands
    1
  5. 🇺🇸 Atlanta · United States
    1
  6. 🇷🇴 Bucharest · Romania
    1
  7. 🇺🇸 Buffalo · United States
    1
  8. 🇺🇸 Chicago · United States
    1
  9. 🇿🇦 Johannesburg · South Africa
    1
  10. 🇫🇷 Lauterbourg · France
    1
  11. 🇱🇹 Vilnius · Lithuania
    1

Countries submitting the most URLs

Ranked by URLs submitted by people. Excludes ScanMalware's own automated scanning.

  1. 1.🇩🇪 Germany
  2. 2.🇸🇪 Sweden
  3. 3.🇨🇭 Switzerland
  4. 4.🇺🇸 United States

Site traffic

Counted from 2026-10-15 (UTC). Scan views and visitors count people only: search engines, other crawlers and automated clients are left out.

Most viewed scans

Public scan results ranked by the number of people who opened them

  1. 1.ghostsandgravestones.comSpookiest Ghost Tour & Frightseeing Adventure In America
  2. 2.na4-docusignv1-52fe74b0160e448ceb80dfbd0a1159128ace1fb4dc97c9b1.edgeone.devCertifiedDeliveryNotification
  3. 3.criipto.comCriipto
  4. 4.cedar-field-790d.pages.devCloudflare Speed Test について | Cloudflare
  5. 5.zuduiye-games-dp5wt4eoh3uj.edgeone.dev组队夜 · 今晚玩什么？
  6. 6.bundle-admin.vercel.app
  7. 7.rinjani.myxl.xlaxiata.co.id
  8. 8.willow-otter-2988.pages.devCloudflare Speed Test について | Cloudflare
  9. 9.warm-birch-4d62.pages.devCloudflare Speed Test 소개 | Cloudflare
  10. 10.icarus-ai-website.pages.devAI Website Build for Tradies Australia | Icarus AI
  11. 11.comune.sozzago.no.itComune di Sozzago
  12. 12.vip-hack-nur-islam-vai-dpggx8ep0gjr.edgeone.dev𝐕𝐈𝐏 𝟏𝟎𝟎% 𝐇𝐀𝐂𝐊 𝐒𝐇𝐎𝐓
  13. 13.breezy-tide-7ad8.pages.devCloudflare Speed Test について | Cloudflare
  14. 14.pirika.coPirikaOS — Research. Analyze. Execute.
  15. 15.trygreenbridgecreditsba.comGreenBridge Capital - Get Funded As Fast As 24 Hours

Countries visitors come from

Ranked by the number of people visiting ScanMalware

  1. 1.🇺🇸 United States
  2. 2.🇬🇧 United Kingdom
  3. 3.🇩🇪 Germany
  4. 4.🇧🇷 Brazil
  5. 5.🇮🇳 India
  6. 6.🇫🇷 France
  7. 7.🇸🇬 Singapore
  8. 8.🇧🇩 Bangladesh
  9. 9.🇪🇸 Spain
  10. 10.🇱🇹 Lithuania
  11. 11.🇮🇹 Italy
  12. 12.🇵🇭 Philippines
  13. 13.🇨🇦 Canada
  14. 14.🇨🇳 China
  15. 15.🇮🇩 Indonesia
  16. 16.🇻🇳 Vietnam
  17. 17.🇲🇽 Mexico
  18. 18.🇦🇷 Argentina
  19. 19.🇸🇦 Saudi Arabia
  20. 20.🇰🇪 Kenya

Most requested domains via the API

Domain and subdomain lookups (certificate and host APIs)

  1. euroserve-legacy.example
    1,256
  2. euroserve.example
    1,254
  3. example.com
    890
  4. hackerone.com
    431
  5. testfire.net
    412
  6. pentest-ground.com
    406
  7. fc2.com
    368
  8. o2xygen.ru
    322
  9. aikredo.com
    320
  10. nmbconnectonline.co.zw
    312
  11. indeed.com
    297
  12. google.com
    288
  13. gitlab.com
    281
  14. nasa.gov
    272
  15. shipmin.gov.in
    268

Most requested registered domains via the API

Lookups grouped by registered domain

  1. klarna.com
    14,664
  2. snowflake.com
    14,448
  3. bmwgroup.com
    9,692
  4. bmw.com
    6,046
  5. octocore.ru
    3,290
  6. wjunction.com
    3,266
  7. kpmg.de
    3,142
  8. magento.com
    2,518
  9. inserm.fr
    2,449
  10. edgeone.dev
    2,332
  11. nasa.gov
    2,315
  12. 91aql.com
    2,000
  13. spbmts.ru
    1,960
  14. usiminas.com
    1,848
  15. eldoradobrasil.com.br
    1,808

Busiest API endpoints

API requests by endpoint (our own systems excluded)

  1. /api/v1/ct/dns/{host}
    831,245
  2. /api/v1/hosts/{host}
    827,683
  3. /api/v1/search/smql
    825,498
  4. /api/v1/rdap/{id}
    6,333
  5. /api/v1/domain/history/{host}
    5,244
  6. /api/v1/domain/stats/{host}
    5,215
  7. /api/v1/ct/{host}
    5,183
  8. /api/v1/favicon/{id}
    3,566
  9. /api/v1/tls/{id}
    3,486
  10. /api/v1/scans/{id}/jsfingerprints
    3,456
  11. /api/v1/ioc/{id}
    3,435
  12. /api/v1/js-fingerprinting3/scan/{id}
    3,374
  13. /api/v1/rpki/{id}
    3,368
  14. /api/v1/jarm/scan/{id}
    3,360
  15. /api/v1/js-fingerprinter2/{id}
    3,262

JavaScript

Scripts loaded by the 1,344 websites scanned in the last 12 hours, counted as the number of distinct websites. Third-party means the script comes from a different registered domain than the page.

Most popular libraries and frameworks

Websites where the library or framework was detected

  1. jQuery · JavaScript library
    414
  2. Swiper · JavaScript library
    47
  3. Bootstrap · UI framework
    47
  4. OWL Carousel · JavaScript library
    34
  5. jQuery UI · JavaScript library
    31
  6. React · JavaScript framework
    25
  7. Vue.js · JavaScript framework
    24
  8. Lightbox · JavaScript library
    22
  9. Tailwind CSS · UI framework
    15
  10. Lodash · JavaScript library
    13
  11. Nuxt.js · JavaScript framework
    13
  12. Stimulus · JavaScript framework
    12
  13. RequireJS · JavaScript framework
    12
  14. AMP · JavaScript framework
    8
  15. Moment.js · JavaScript library
    6

Most used third-party script providers

Registered domain serving the script

  1. googletagmanager.com
    399
  2. cloudflare.com
    380
  3. google.com
    154
  4. yandex.ru
    139
  5. facebook.net
    115
  6. gstatic.com
    105
  7. doubleclick.net
    87
  8. google-analytics.com
    86
  9. ajax.googleapis.com
    79
  10. jsdelivr.net
    66
  11. yastatic.net
    59
  12. mail.ru
    55
  13. googlesyndication.com
    53
  14. cloudflareinsights.com
    52
  15. clarity.ms
    42

Most loaded third-party scripts

Script URL without its query string

  1. www.googletagmanager.com/gtag/js
    366
  2. challenges.cloudflare.com/turnstile/v0/api.js
    270
  3. challenges.cloudflare.com/turnstile/v0/g/4df4a60fa397/api.js
    231
  4. www.googletagmanager.com/gtm.js
    188
  5. mc.yandex.ru/metrika/tag.js
    112
  6. connect.facebook.net/en_US/fbevents.js
    98
  7. challenges.cloudflare.com/turnstile/v0/b/d2d3316b729e/api.js
    88
  8. www.google-analytics.com/analytics.js
    67
  9. pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
    49
  10. privacy-cs.mail.ru/static/sync-loader.js
    49
  11. top-fwz1.mail.ru/js/code.js
    49
  12. www.google.com/recaptcha/api.js
    49
  13. top-fwz1.mail.ru/js/dyn-goal-config.js
    47
  14. www.gstatic.com/recaptcha/releases/nY0xPItgwtlvjEjk2TqdwOQz/recaptcha__en.js
    47
  15. static.cloudflareinsights.com/beacon.min.js/v4bc70e2c01a94c73b74392e4234840661791215815920
    45

Most common first-party scripts

Script path served from the website's own domain

  1. /wp-includes/js/jquery/jquery.min.js
    154
  2. /wp-includes/js/jquery/jquery-migrate.min.js
    143
  3. /wp-includes/js/wp-emoji-release.min.js
    115
  4. /wp-includes/js/dist/hooks.min.js
    71
  5. /wp-includes/js/dist/i18n.min.js
    71
  6. /wp-includes/js/jquery/ui/core.min.js
    53
  7. /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
    44
  8. /wp-content/plugins/elementor/assets/js/* (3 files)
    42
  9. /wp-content/plugins/contact-form-7/includes/js/index.js
    38
  10. /wp-content/plugins/contact-form-7/includes/swv/js/index.js
    38
  11. /sw.js
    31
  12. /wp-content/plugins/elementor-pro/assets/js/frontend.min.js
    28
  13. /wp-includes/js/imagesloaded.min.js
    28
  14. /wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js
    26
  15. /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1
    25

TLS server fingerprints

JARM and JA4S describe how a web server answers a TLS connection; servers running the same software and configuration share a fingerprint. Counted as distinct websites. The malicious rankings order fingerprints by the share of their websites that were malicious (at least 10 websites, 5 of them malicious). JA4S is recorded since 23 September 2026.

Most common JARM fingerprints

FingerprintUsual networkSitesMalicious
27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.509273 (54%)
27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525cCloudflare, Inc.32661 (19%)
29d29d00029d29d00041d41d00041db78309d03c04b7072bacbf1ce396279bAmazon.com, Inc.1865 (3%)
29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36cFastly, Inc.14618 (12%)
3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fbAmazon.com, Inc.10628 (26%)
27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.1034 (4%)
16d3fd16d29d29d00042d43d00000071784fa9f8305ba9220d0a7894b6ff2cLoopia AB910 (0%)
27d40d40d00040d1dc42d43d00041d5691268beec3bcca1d5ab3aacc89645fCloudflare, Inc.8047 (59%)
2ad2ad0002ad2ad22c42d42d0000008a5941c13f67e0c0a2c8a36bfeef6920ACE736 (8%)
40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319Amazon.com, Inc.7220 (28%)
27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36cGoogle LLC6718 (27%)
29d29d00029d29d21c41d41d00041d38d8d683f08c154e73a9de64943d64e4Amazon.com, Inc.476 (13%)
27d40d40d00000000042d43d0000000f0fc3b7e99fa90f0a6ea06fe65aef1dOne.com A/S440 (0%)
29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3aeODERLAND Webbhotell AB417 (17%)
29d29d00029d29d00042d42d0000002059a3b916699461c5923779b77cf06bDomain names registrar REG.RU, Ltd390 (0%)

JARM fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
27d40d40d00040d1dc42d43d00041d5691268beec3bcca1d5ab3aacc89645fCloudflare, Inc.8047 (59%)
27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.509273 (54%)
3fd3fd40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319HostPapa105 (50%)
28d28d28d2ad28d1dc42d42d00042ded961c16c68658e95145597cf992c36c—125 (42%)
40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319Amazon.com, Inc.7220 (28%)
27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36cGoogle LLC6718 (27%)
3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fbAmazon.com, Inc.10628 (26%)
27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525cCloudflare, Inc.32661 (19%)
29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3aeODERLAND Webbhotell AB417 (17%)
29d29d00029d29d21c41d41d00041d38d8d683f08c154e73a9de64943d64e4Amazon.com, Inc.476 (13%)
29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36cFastly, Inc.14618 (12%)
2ad2ad0002ad2ad22c42d42d0000008a5941c13f67e0c0a2c8a36bfeef6920ACE736 (8%)
29d29d00029d29d00041d41d00041db78309d03c04b7072bacbf1ce396279bAmazon.com, Inc.1865 (3%)

Most common JA4S fingerprints

FingerprintUsual networkSitesMalicious
t130200_1302_234ea6891581Cloudflare, Inc.1,327428 (32%)
t130200_1302_a56c5b993250ACE1,09141 (4%)
t130200_1301_a56c5b993250Amazon.com, Inc.58344 (8%)
t130200_1303_a56c5b993250Amazon.com, Inc.21453 (25%)
t1207h2_c030_b948729f6510GoDaddy.com, LLC310 (0%)
t1207h1_c02f_b948729f6510Alibaba Cloud (Singapore) Private Limited285 (18%)
t1206h2_c02f_3603f09c43baAmazon.com, Inc.260 (0%)
t1207h2_c02f_b948729f6510CDNvideo LLC142 (14%)
t1207h2_cca8_b948729f6510JSC Selectel140 (0%)
t1206h2_c02b_3f14cc51fb76Cloudflare, Inc.131 (8%)
t1206h2_c02f_3f14cc51fb76Fastly, Inc.100 (0%)
t1207h1_c030_b948729f6510Akamai Technologies, Inc.100 (0%)
t1204h2_c030_b252f78b95f6Rackspace Hosting90 (0%)
t1206h1_c02f_cd2f8cf6dcd7Edgenext Legend Dynasty Pte. Ltd.90 (0%)
t120300_c02f_460f64128655—80 (0%)

JA4S fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
t130200_1302_234ea6891581Cloudflare, Inc.1,327428 (32%)
t130200_1303_a56c5b993250Amazon.com, Inc.21453 (25%)
t1207h1_c02f_b948729f6510Alibaba Cloud (Singapore) Private Limited285 (18%)
t130200_1301_a56c5b993250Amazon.com, Inc.58344 (8%)
t130200_1302_a56c5b993250ACE1,09141 (4%)

A scan counts as malicious when our AI verdict rates it Confirmed scam or High risk, or our rule-based verdict rates it Malicious. Threat statistics cover all public scans; the submitting-country ranking covers URLs submitted by people and excludes ScanMalware's own automated scanning. Unlisted and private scans are never shown individually. Refreshed every 10–60 minutes depending on the window · generated 2026-10-15 14:38 UTC.