ScanMalware.com

Statistics

What ScanMalware saw in the last 12 hours: the infrastructure behind malicious websites, the threats they carry, and where scanned URLs come from.

Public scans
1,950
1,812 distinct sites
Malicious scans
357
18.3% of public scans
Malicious sites
261
distinct hostnames

Scans and malicious scans

All public scans per hour (UTC)

MaliciousOther scans
Hover a column for details · peak 186
09-25 14:00 UTC09-26 02:00 UTC
Show as table
PeriodScansMalicious
09-25 14:00 UTC5424
09-25 15:00 UTC15327
09-25 16:00 UTC16636
09-25 17:00 UTC15530
09-25 18:00 UTC16027
09-25 19:00 UTC16021
09-25 20:00 UTC16424
09-25 21:00 UTC18330
09-25 22:00 UTC14610
09-25 23:00 UTC17732
09-26 00:00 UTC18664
09-26 01:00 UTC13931
09-26 02:00 UTC1071

IP addresses hosting the most malicious sites

Distinct malicious hostnames per IP address

IP addressNetworkSites
🇺🇸188.114.96.9CDNAS13335 Cloudflare, Inc.53
🇺🇸188.114.97.9CDNAS13335 Cloudflare, Inc.45
🇺🇸216.198.79.3CDNAS16509 Amazon.com, Inc.9
🇺🇸64.29.17.67CDNAS16509 Amazon.com, Inc.9
🇺🇸64.29.17.195CDNAS16509 Amazon.com, Inc.8
🇺🇸216.198.79.67CDNAS16509 Amazon.com, Inc.7
🇺🇸64.29.17.131CDNAS16509 Amazon.com, Inc.7
🇺🇸216.198.79.195CDNAS16509 Amazon.com, Inc.6
🇩🇪63.176.8.218CDNAS16509 Amazon.com, Inc.6
🇺🇸104.18.50.34CDNAS13335 Cloudflare, Inc.5
🇺🇸104.21.33.193CDNAS13335 Cloudflare, Inc.5
🇺🇸172.67.191.247CDNAS13335 Cloudflare, Inc.5
🇺🇸64.29.17.3CDNAS16509 Amazon.com, Inc.5
🇩🇪35.157.26.135CDNAS16509 Amazon.com, Inc.4
🇸🇬43.174.247.29AS139341 ACE4

Networks (ASNs) with the most malicious sites

Distinct malicious hostnames per network

  1. AS13335 Cloudflare, Inc.
    171
  2. AS16509 Amazon.com, Inc.
    57
  3. AS139341 ACE
    7
  4. AS51167 Contabo GmbH
    3
  5. AS24940 Hetzner Online GmbH
    2
  6. AS34119 Wildcard UK Limited
    2
  7. AS54113 Fastly, Inc.
    2
  8. AS151967 DLITS
    1
  9. AS15557 Societe Francaise Du Radiotelephone - SFR SA
    1
  10. AS198610 Beget LLC
    1
  11. AS200758 Datagear LLP
    1
  12. AS214351 Femo It Solutions Limited
    1
  13. AS214996 netcup GmbH
    1
  14. AS22612 Namecheap, Inc.
    1
  15. AS31898 Oracle Corporation
    1

Domains with the most malicious subdomains

Distinct malicious subdomains under one registered domain

  1. cr-web.workers.dev
    9
  2. edgeone.dev
    8
  3. 70654733.workers.dev
    2
  4. iceiy.com
    2
  5. 152-53-37-155.plesk.page
    1
  6. archive.org
    1
  7. authorised-support.com
    1
  8. b-cdn.net
    1
  9. dazesdsxcxmlcxcxcc.workers.dev
    1
  10. hashkey.com
    1
  11. impar.ro
    1
  12. visme.co
    1
  13. voyrapido.com
    1
  14. xsph.ru
    1
  15. znbbmwq.com
    1

Hosting platforms most abused

Malicious sites on free-subdomain and app-hosting platforms

  1. pages.dev
    126
  2. vercel.app
    47
  3. workers.dev
    12
  4. netlify.app
    8
  5. r2.dev
    8
  6. duckdns.org
    1
  7. plesk.page
    1
  8. web.app
    1

Threat types

Malicious scans by the kind of threat found

  1. Credential Phishing
    170
  2. Malware Distribution
    100
  3. Brand Impersonation
    34
  4. Other
    16
  5. Illegal Gambling
    15
  6. Investment/Crypto Scam
    4
  7. Fake Shopping
    2
  8. Advance Fee Fraud
    1

Top-level domains of malicious sites

Distinct malicious hostnames per TLD

  1. .dev
    154
  2. .app
    56
  3. .se
    18
  4. .com
    11
  5. .org
    4
  6. .io
    3
  7. .ru
    3
  8. .co
    2
  9. .de
    2
  10. .click
    1
  11. .digital
    1
  12. .fr
    1
  13. .net
    1
  14. .page
    1
  15. .ro
    1

Countries hosting the most malicious sites

Country of the hosting IP address. The second column leaves out shared CDN addresses, whose location is the network's, not the site's server.

CountryAll sitesExcl. CDN
🇺🇸 United States2297
🇩🇪 Germany112
🇸🇬 Singapore77
🇫🇷 France44
🇷🇺 Russia33
🇬🇧 United Kingdom22
🇧🇩 Bangladesh11
🇫🇮 Finland11
🇷🇴 Romania11
🇿🇦 South Africa11

Countries hosting the most malicious sites (own servers)

Sites not behind a shared CDN, by the country of their server

  1. 🇸🇬 Singapore
    7
  2. 🇺🇸 United States
    7
  3. 🇫🇷 France
    4
  4. 🇷🇺 Russia
    3
  5. 🇩🇪 Germany
    2
  6. 🇬🇧 United Kingdom
    2
  7. 🇧🇩 Bangladesh
    1
  8. 🇫🇮 Finland
    1
  9. 🇷🇴 Romania
    1
  10. 🇿🇦 South Africa
    1

Cities hosting the most malicious sites

Sites not behind a shared CDN, by the city of their server. The city is known for 13 of 29 such sites.

  1. 🇫🇷 Lauterbourg · France
    3
  2. 🇷🇴 Bucharest · Romania
    1
  3. 🇺🇸 Chicago · United States
    1
  4. 🇺🇸 Dallas · United States
    1
  5. 🇫🇮 Helsinki · Finland
    1
  6. 🇺🇸 Los Angeles · United States
    1
  7. 🇺🇸 Manassas · United States
    1
  8. 🇿🇦 Midrand · South Africa
    1
  9. 🇩🇪 Nuremberg · Germany
    1
  10. 🇺🇸 Phoenix · United States
    1
  11. 🇷🇺 St Petersburg · Russia
    1

Countries submitting the most URLs

Ranked by URLs submitted by people. Excludes ScanMalware's own automated scanning.

  1. 1.🇮🇹 Italy
  2. 2.🇺🇸 United States
  3. 3.🇪🇸 Spain
  4. 4.🇧🇷 Brazil
  5. 5.🇨🇱 Chile
  6. 6.🇩🇪 Germany
  7. 7.🇫🇷 France
  8. 8.🇬🇧 United Kingdom
  9. 9.🇮🇩 Indonesia
  10. 10.🇱🇹 Lithuania

Site traffic

Counted from 2026-09-25 (UTC). Scan views and visitors count people only: search engines, other crawlers and automated clients are left out.

Most viewed scans

Public scan results ranked by the number of people who opened them

  1. 1.padisahbet.yeni-koruma.icuIndex of /
  2. 2.psyrusec.comSign in to your account
  3. 3.sunny-fox-33db.pages.devCloudflare Speed Test 소개 | Cloudflare
  4. 4.artikel-69b5dd2c1248-dpnxxg3ylwbi.edgeone.dev0 コンテナガーデン向けの自動水やり装置 人気ランキング: A Practical Starter Guide
  5. 5.foreign-crimson-8t6kpaas-dpn7f7qb61y2.edgeone.devNext.js by Vercel - The React Framework
  6. 6.itauu.vercel.appBanco Itaú | Abra sua conta Personnalité no Itaú. Atendimento e benefícios pensados para você
  7. 7.reimagined-funicular-ivory.vercel.appNaver Sign in
  8. 8.preview-chemresolution.pages.devTechnical Resources | Chem Resolution Inc.
  9. 9.ziparvel.pages.devNamrata Shirodkar Kiss : 'సరిలేరు నీకెవ్వరు' మూవీ టీం ఫుల్‌ జోష్‌లో ఉంది. - Parzivel
  10. 10.spond.comSpond - The new standard for organizing groups
  11. 11.fluffy-pink-waub20ye-dpxglxsklgjm.edgeone.devTencent Edgeone
  12. 12.chubby-olive-5conlg0a-dpnd4j7ahk26.edgeone.devNext.js by Vercel - The React Framework
  13. 13.x.comVal d'Isère (@valdisere) / X
  14. 14.diezodontologia.comDiez Odontología | Dr. Diego Zoppi - Quilmes
  15. 15.dssprev.pages.devDelightfully Stuck Studios — Places worth getting stuck in

Countries visitors come from

Ranked by the number of people visiting ScanMalware

  1. 1.🇧🇷 Brazil
  2. 2.🇸🇬 Singapore
  3. 3.🇺🇸 United States
  4. 4.🇦🇷 Argentina
  5. 5.🇨🇳 China
  6. 6.🇲🇽 Mexico
  7. 7.🇧🇩 Bangladesh
  8. 8.🇫🇷 France
  9. 9.🇹🇷 Türkiye
  10. 10.🇨🇱 Chile
  11. 11.🇮🇹 Italy
  12. 12.🇺🇦 Ukraine
  13. 13.🇨🇴 Colombia
  14. 14.🇵🇭 Philippines
  15. 15.🇪🇨 Ecuador
  16. 16.🇻🇪 Venezuela
  17. 17.🇵🇪 Peru
  18. 18.🇷🇺 Russia
  19. 19.🇵🇾 Paraguay
  20. 20.🇵🇹 Portugal

Most requested domains via the API

Domain and subdomain lookups (certificate and host APIs)

  1. cosmos.windows-int.net
    5,004
  2. oceanai.ai
    2,844
  3. cruisepal.com
    2,844
  4. seamedix.com
    2,844
  5. memphismarine.com
    2,844
  6. oceanopt.ai
    2,844
  7. mariapps.in
    2,844
  8. smartpal.ai
    2,844
  9. example.com
    1,560
  10. trendmilcro.com
    1,498
  11. e2e.test
    1,113
  12. httpbin.org
    850
  13. bld3r.com
    720
  14. qld33.top
    700
  15. msb.com.vn
    654

Most requested registered domains via the API

Lookups grouped by registered domain; hover for how many names were looked up

  1. deere.com
    40,105
  2. kpmg.com
    37,975
  3. bmwgroup.com
    29,368
  4. tamu.edu
    20,018
  5. bmw.com
    18,132
  6. google.com
    10,349
  7. wjunction.com
    8,711
  8. zoho.com
    7,480
  9. onehousing.com.vn
    7,012
  10. magento.com
    6,718
  11. att.com
    6,256
  12. windows-int.net
    5,285
  13. eldoradobrasil.com.br
    4,416
  14. usiminas.com
    4,196
  15. ennov.com
    3,680

Busiest API endpoints

API requests by endpoint (our own systems excluded)

  1. /api/v1/search/smql
    1,000,436
  2. /api/v1/ct/dns/{host}
    998,419
  3. /api/v1/hosts/{host}
    997,463
  4. /api/v1/ct/dns/{x}
    7,595
  5. /api/v1/hosts/{x}
    7,594
  6. /api/v1/domains/{host}/scans
    4,250
  7. /api/v1/tls/{id}
    3,005
  8. /api/v1/jarm/scan/{id}
    2,956
  9. /api/v1/result/{id}
    2,014
  10. /api/v1/search/ip/{ip}
    1,967
  11. /api/v1/yara/{id}
    1,584
  12. /api/v1/search/jarm/{hash}
    1,571
  13. /api/v1/ioc/{id}
    1,567
  14. /api/v1/scans/{id}/jsfingerprints
    1,518
  15. /api/v1/rpki/{id}
    1,477

JavaScript

Scripts loaded by the 1,175 websites scanned in the last 12 hours, counted as the number of distinct websites. Third-party means the script comes from a different registered domain than the page.

Most popular libraries and frameworks

Websites where the library or framework was detected

  1. jQuery · JavaScript library
    357
  2. React · JavaScript framework
    91
  3. jQuery UI · JavaScript library
    35
  4. Bootstrap · UI framework
    34
  5. Vue.js · JavaScript framework
    34
  6. OWL Carousel · JavaScript library
    30
  7. Lightbox · JavaScript library
    21
  8. Swiper · JavaScript library
    18
  9. AMP · JavaScript framework
    17
  10. RequireJS · JavaScript framework
    12
  11. Lodash · JavaScript library
    11
  12. Nuxt.js · JavaScript framework
    10
  13. Hammer.js · JavaScript library
    9
  14. Moment.js · JavaScript library
    9
  15. Modernizr · JavaScript library
    8

Most used third-party script providers

Registered domain serving the script

  1. googletagmanager.com
    372
  2. cloudflare.com
    263
  3. google.com
    158
  4. yandex.ru
    126
  5. facebook.net
    125
  6. google-analytics.com
    112
  7. doubleclick.net
    103
  8. gstatic.com
    99
  9. jsdelivr.net
    82
  10. yastatic.net
    70
  11. googlesyndication.com
    60
  12. ajax.googleapis.com
    56
  13. cloudflareinsights.com
    49
  14. mail.ru
    48
  15. adtrafficquality.google
    44

Most loaded third-party scripts

Script URL without its query string

  1. www.googletagmanager.com/gtag/js
    349
  2. challenges.cloudflare.com/turnstile/v0/b/d76008a69eab/api.js
    187
  3. www.googletagmanager.com/gtm.js
    158
  4. challenges.cloudflare.com/turnstile/v0/api.js
    143
  5. connect.facebook.net/en_US/fbevents.js
    104
  6. mc.yandex.ru/metrika/tag.js
    101
  7. www.google-analytics.com/analytics.js
    100
  8. www.gstatic.com/recaptcha/releases/kemdRjWFxNjgsGdhRslyEPwU/recaptcha__en.js
    64
  9. www.google.com/recaptcha/api.js
    55
  10. yastatic.net/safeframe-bundles/0.89/host.js
    52
  11. yastatic.net/partner-code-bundles/libs/libs-edc4844f.js
    49
  12. yastatic.net/partner-code-bundles/libs/libs_render-edc4844f.js
    49
  13. yandex.ru/ads/system/context.js
    46
  14. ep2.adtrafficquality.google/sodar/sodar2.js
    44
  15. pagead2.googlesyndication.com/bg/gB2Im7ywZGaT6V0iKhMAgnnbTRH0TG-zboKpZQ5m5yk.js
    43

Most common first-party scripts

Script path served from the website's own domain

  1. /wp-includes/js/jquery/jquery.min.js
    99
  2. /wp-includes/js/jquery/jquery-migrate.min.js
    92
  3. /wp-includes/js/wp-emoji-release.min.js
    84
  4. /cdn-cgi/challenge-platform/h/b/scripts/jsd/d76008a69eab/main.js
    66
  5. /* (3 files)
    57
  6. /component---src-containers-sub-page-js-e7fb715774364f9d93eb.js
    53
  7. /dc6a8720040df98778fe970bf6c000a41750d3ae-71b279128d9d41aa1f02.js
    52
  8. /cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1
    41
  9. /wp-includes/js/dist/hooks.min.js
    33
  10. /wp-includes/js/dist/i18n.min.js
    32
  11. /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
    31
  12. /wp-includes/js/jquery/ui/core.min.js
    30
  13. /wp-content/plugins/elementor/assets/js/* (3 files)
    24
  14. /_next/static/chunks/* (22 files)
    23
  15. /cdn/s/trekkie.storefront.f1ba865b3fecd812ad617f74ac079261075e9edb.min.js
    22

TLS server fingerprints

JARM and JA4S describe how a web server answers a TLS connection; servers running the same software and configuration share a fingerprint. Counted as distinct websites. The malicious rankings order fingerprints by the share of their websites that were malicious (at least 10 websites, 5 of them malicious). JA4S is recorded since 23 September 2026.

Most common JARM fingerprints

FingerprintUsual networkSitesMalicious
27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.344129 (38%)
27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525cCloudflare, Inc.32658 (18%)
3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fbAmazon.com, Inc.20263 (31%)
29d29d00029d29d00041d41d00041db78309d03c04b7072bacbf1ce396279bAmazon.com, Inc.1857 (4%)
40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319Amazon.com, Inc.13412 (9%)
27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.846 (7%)
27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36cGoogle LLC8410 (12%)
16d3fd16d29d29d00042d43d00000071784fa9f8305ba9220d0a7894b6ff2cLoopia AB730 (0%)
2ad2ad0002ad2ad22c42d42d0000008a5941c13f67e0c0a2c8a36bfeef6920ACE718 (11%)
2ad2ad0002ad2ad00042d42d0000002059a3b916699461c5923779b77cf06bAkamai International B.V.635 (8%)
29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36cFastly, Inc.523 (6%)
29d3fd00029d29d00042d43d00041d6f940079659edb62e1c38c38bd26ee84Google LLC451 (2%)
29d29d00029d29d21c41d41d00041d38d8d683f08c154e73a9de64943d64e4Amazon.com, Inc.321 (3%)
2ad2ad16d2ad2ad00042d42d000000df133019600a83abfb096ff3e86cd79dGoogle LLC311 (3%)
21d19d00021d21d00042d43d0000005ad20eceaf7f71ae0887d2ff117bf97fe-Style ISP LLC270 (0%)

JARM fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
27d40d40d00040d1dc42d43d00041d5691268beec3bcca1d5ab3aacc89645fCloudflare, Inc.1610 (63%)
27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.344129 (38%)
3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fbAmazon.com, Inc.20263 (31%)
2ad2ad0002ad2ad22c42d42d000000a9aee03a49a8a804a0ef27cc7feba684Datacamp Limited195 (26%)
27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525cCloudflare, Inc.32658 (18%)
27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36cGoogle LLC8410 (12%)
2ad2ad0002ad2ad22c42d42d0000008a5941c13f67e0c0a2c8a36bfeef6920ACE718 (11%)
40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319Amazon.com, Inc.13412 (9%)
2ad2ad0002ad2ad00042d42d0000002059a3b916699461c5923779b77cf06bAkamai International B.V.635 (8%)
27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.846 (7%)
29d29d00029d29d00041d41d00041db78309d03c04b7072bacbf1ce396279bAmazon.com, Inc.1857 (4%)

Most common JA4S fingerprints

FingerprintUsual networkSitesMalicious
t130200_1302_234ea6891581Cloudflare, Inc.1,092229 (21%)
t130200_1302_a56c5b993250ACE95559 (6%)
t130200_1301_a56c5b993250Amazon.com, Inc.49426 (5%)
t130200_1303_a56c5b993250Amazon.com, Inc.36776 (21%)
t1206h2_c02f_3603f09c43baAmazon.com, Inc.451 (2%)
t1207h1_c030_b948729f6510Telia Company AB191 (5%)
t1207h2_c030_b948729f6510Akamai Technologies, Inc.191 (5%)
t1207h2_c02f_b948729f6510Alibaba (US) Technology Co., Ltd.161 (6%)
t1205h1_c008_845f7282a956Wildcard UK Limited122 (17%)
t1206h2_c02b_3f14cc51fb76Cloudflare, Inc.122 (17%)
t1207h1_c02f_b948729f6510Akamai Technologies, Inc.120 (0%)
t1207h2_c02b_b948729f6510Rambler Internet Holding LLC100 (0%)
t1207h2_c02c_b948729f6510JSC RTComm.RU92 (22%)
t1204h2_c030_b252f78b95f6eTOP sp. z o.o.80 (0%)
t1206h1_c02f_cd2f8cf6dcd7LLC VK80 (0%)

JA4S fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
t130200_1302_234ea6891581Cloudflare, Inc.1,092229 (21%)
t130200_1303_a56c5b993250Amazon.com, Inc.36776 (21%)
t130200_1302_a56c5b993250ACE95559 (6%)
t130200_1301_a56c5b993250Amazon.com, Inc.49426 (5%)

A scan counts as malicious when our AI verdict rates it Confirmed scam or High risk, or our rule-based verdict rates it Malicious. Threat statistics cover all public scans; the submitting-country ranking covers URLs submitted by people and excludes ScanMalware's own automated scanning. Unlisted and private scans are never shown individually. Refreshed every 10–60 minutes depending on the window · generated 2026-09-26 02:47 UTC.