Statistics

IP addresses hosting the most malicious sites#

Distinct malicious hostnames per IP address

Networks (ASNs) with the most malicious sites#

Distinct malicious hostnames per network

1. AS13335 Cloudflare, Inc.
   263
2. AS54113 Fastly, Inc.
   184
3. AS16509 Amazon.com, Inc.
   30
4. AS979 NetLab Global
   21
5. AS37963 Hangzhou Alibaba Advertising Co.,Ltd.
   11
6. AS139057 Edgenext Legend Dynasty Pte. Ltd.
   10
7. AS139341 ACE
   9
8. AS139659 LUCIDACLOUD LIMITED
   8
9. AS152194 CTG Server Limited
   7
10. AS45090 Shenzhen Tencent Computer Systems Company Limited
    7
11. AS55933 Cloudie Limited
    7
12. AS36352 HostPapa
    5
13. AS1014 NetLab Global
    4
14. AS132203 Tencent Building, Kejizhongyi Avenue
    4
15. AS138415 Yancy Limited
    4

Domains with the most malicious subdomains#

Distinct malicious subdomains under one registered domain

1. edgeone.dev
   9
2. truist-webportal.com
   2
3. urldance.com
   2
4. 92ea2438071f378d2627edbe.workers.dev
   1
5. abembet.org
   1
6. aeon888link.org
   1
7. alan4d.org
   1
8. alien203.org
   1
9. amor76.com
   1
10. androiddevpool.com
    1
11. asteria.ai
    1
12. axeiar-vote.xyz
    1
13. b317cl53wt.workers.dev
    1
14. bob974.fr
    1
15. carebridge.blog
    1

Hosting platforms most abused#

Malicious sites on free-subdomain and app-hosting platforms

1. r2.dev
   120
2. web.app
   112
3. firebaseapp.com
   94
4. pages.dev
   76
5. vercel.app
   20
6. workers.dev
   7
7. netlify.app
   4
8. amplifyapp.com
   1
9. onrender.com
   1
10. webflow.io
    1

Threat types#

Malicious scans by the kind of threat found

1. Credential Phishing
   295
2. Other
   184
3. Brand Impersonation
   133
4. Malware Distribution
   88
5. Investment/Crypto Scam
   3
6. Illegal Gambling
   2
7. SEO Spam
   1
8. Tech Support Scam
   1

Top-level domains of malicious sites#

Distinct malicious hostnames per TLD

1. .dev
   212
2. .app
   136
3. .com
   135
4. .org
   10
5. .top
   7
6. .br
   4
7. .cfd
   4
8. .lol
   4
9. .net
   4
10. .se
    3
11. .fr
    2
12. .pl
    2
13. .site
    2
14. .ai
    1
15. .blog
    1

Countries hosting the most malicious sites#

Country of the hosting IP address. The second column leaves out shared CDN addresses, whose location is the network's, not the site's server.

Countries hosting the most malicious sites (own servers)#

Sites not behind a shared CDN, by the country of their server

1. 🇺🇸 United States
   94
2. 🇭🇰 Hong Kong
   34
3. 🇨🇳 China
   33
4. 🇯🇵 Japan
   16
5. 🇸🇬 Singapore
   15
6. 🇫🇷 France
   7
7. 🇩🇪 Germany
   6
8. 🇬🇧 United Kingdom
   5
9. 🇸🇨 Seychelles
   5
10. 🇳🇱 Netherlands
    3
11. 🇧🇷 Brazil
    2
12. 🇪🇸 Spain
    2
13. 🇷🇺 Russia
    2
14. 🇸🇪 Sweden
    2
15. 🇦🇹 Austria
    1

Cities hosting the most malicious sites#

Sites not behind a shared CDN, by the city of their server. The city is known for 136 of 245 such sites.

1. 🇺🇸 Los Angeles · United States
   24
2. 🇭🇰 Hong Kong · Hong Kong
   10
3. 🇯🇵 Tokyo · Japan
   10
4. 🇨🇳 Shanghai · China
   9
5. 🇨🇳 Beijing · China
   6
6. 🇺🇸 Ashburn · United States
   4
7. 🇩🇪 Frankfurt am Main · Germany
   4
8. 🇨🇳 Hangzhou · China
   4
9. 🇺🇸 Atlanta · United States
   3
10. 🇫🇷 Lauterbourg · France
    3
11. 🇸🇬 Singapore · Singapore
    3
12. 🇺🇸 Buffalo · United States
    2
13. 🇨🇳 Chengdu · China
    2
14. 🇺🇸 Hillsboro · United States
    2
15. 🇭🇰 Kwai Chung · Hong Kong
    2

Countries submitting the most URLs#

Ranked by URLs submitted by people. Excludes ScanMalware's own automated scanning.

1. 1.🇬🇧 United Kingdom
2. 2.🇨🇭 Switzerland
3. 3.🇸🇪 Sweden
4. 4.🇺🇸 United States
5. 5.🇩🇪 Germany
6. 6.🇦🇿 Azerbaijan
7. 7.🇱🇹 Lithuania
8. 8.🇫🇷 France
9. 9.🇱🇾 Libya
10. 10.🇵🇭 Philippines
11. 11.🇸🇦 Saudi Arabia
12. 12.🇺🇬 Uganda

Most viewed scans#

Public scan results ranked by the number of people who opened them

1. 1.sixteensshop.comSixteen
2. 2.clinical-salmon-1xkjlkaz-dpcal4y9clw2.edgeone.devLuật Sư Nhí - Full BXH + Ảnh Phòng Ngủ
3. 3.link.mail.beehiiv.comJust a moment...
4. 4.j5htl-cqp-wg80-kwfom-07-09-2026-aa.pages.devSuspected Phishing | Cloudflare
5. 5.agricova.pages.devDealer Application | Agricova
6. 6.startupcity-bizai.vercel.appOnboarding Form · Startup City × BIZ AI
7. 7.xunfelo-mpt-qavzari-h8d2ka95.pages.devSuspected Phishing | Cloudflare
8. 8.202608.urldance.comLatest @ Sites
9. 9.mio.seArcana Sittsäck 200L, Ø 60 cm | Mio
10. 10.yawning-pink-1yphz7uo-dpbak87jf3o3.edgeone.devA15 灯丝灯｜美国市场应用场景参考
11. 11.chog.bestchog.best | 525: SSL handshake failed
12. 12.lunar-haven-3657-186fac36.pages.devWorker threw exception | lunar-haven-3657-186fac36.pages.dev | Cloudflare
13. 13.barbandjohnsretirement.blogspot.comShould We Stay or Should We Go
14. 14.tman-chi.vercel.appSecurity verification - Microsoft account
15. 15.951943.lolLatest @ Sites

Countries visitors come from#

Ranked by the number of people visiting ScanMalware

1. 1.🇺🇸 United States
2. 2.🇫🇷 France
3. 3.🇧🇷 Brazil
4. 4.🇸🇬 Singapore
5. 5.🇩🇪 Germany
6. 6.🇪🇸 Spain
7. 7.🇬🇧 United Kingdom
8. 8.🇨🇳 China
9. 9.🇨🇦 Canada
10. 10.🇮🇳 India
11. 11.🇮🇹 Italy
12. 12.🇮🇩 Indonesia
13. 13.🇻🇳 Vietnam
14. 14.🇮🇶 Iraq
15. 15.🇨🇴 Colombia
16. 16.🇹🇷 Turkey
17. 17.🇦🇷 Argentina
18. 18.🇵🇹 Portugal
19. 19.🇲🇾 Malaysia
20. 20.🇧🇩 Bangladesh

Most requested registered domains via the API#

Lookups grouped by registered domain

1. kpmg.com
   98,860
2. bmwgroup.com
   44,902
3. leagueoflegends.com
   32,824
4. snowflake.com
   26,778
5. bmw.com
   24,838
6. t-mobile.com
   17,343
7. kpmg.com.au
   12,170
8. kpmg.de
   10,148
9. yelp.com
   9,667
10. renault.com
    9,315
11. cbre.com
    7,499
12. blackstone.com
    7,124
13. wjunction.com
    5,446
14. nba.com
    5,211
15. eldoradobrasil.com.br
    4,926

Busiest API endpoints#

API requests by endpoint (our own systems excluded)

1. /api/v1/search/smql
   1,055,067
2. /api/v1/ct/dns/{host}
   1,043,679
3. /api/v1/hosts/{host}
   1,038,962
4. /api/v1/rdap/{id}
   9,762
5. /api/v1/result/{id}
   7,957
6. /api/v1/domain/history/{host}
   7,919
7. /api/v1/domain/stats/{host}
   7,154
8. /api/v1/search
   6,011
9. /api/v1/favicon/{id}
   5,388
10. /api/v1/ioc/{id}
    5,059
11. /api/v1/rpki/{id}
    4,821
12. /api/v1/scans/{id}/jsfingerprints
    4,779
13. /api/v1/tls/{id}
    4,715
14. /api/v1/js-fingerprinting3/scan/{id}
    4,706
15. /api/v1/jarm/scan/{id}
    4,535

Most popular libraries and frameworks#

Websites where the library or framework was detected

1. jQuery · JavaScript library
   344
2. Bootstrap · UI framework
   163
3. jQuery Migrate · JavaScript library
   113
4. Marked · JavaScript library
   54
5. React · JavaScript framework
   38
6. jQuery UI · JavaScript library
   33
7. Vue.js · JavaScript framework
   30
8. Underscore.js · JavaScript library
   23
9. Swiper · JavaScript library
   22
10. Tailwind CSS · UI framework
    20
11. Lightbox · JavaScript library
    18
12. Stimulus · JavaScript framework
    16
13. OWL Carousel · JavaScript library
    16
14. Modernizr · JavaScript library
    16
15. Magnific Popup · JavaScript library
    15

Most used third-party script providers#

Registered domain serving the script

1. cloudflare.com
   276
2. googletagmanager.com
   265
3. google.com
   124
4. gstatic.com
   109
5. jquery.com
   102
6. facebook.net
   95
7. ajax.googleapis.com
   88
8. doubleclick.net
   78
9. jsdelivr.net
   59
10. clarity.ms
    47
11. google-analytics.com
    46
12. maps.googleapis.com
    44
13. gtomitsuka.github.io
    40
14. bing.com
    34
15. cloudflareinsights.com
    34

Most loaded third-party scripts#

Script URL without its query string

1. www.googletagmanager.com/gtag/js
   242
2. challenges.cloudflare.com/turnstile/v0/b/8340802ab0bb/api.js
   146
3. www.googletagmanager.com/gtm.js
   138
4. challenges.cloudflare.com/turnstile/v0/api.js
   113
5. connect.facebook.net/en_US/fbevents.js
   87
6. www.gstatic.com/recaptcha/releases/0lEGiwO4Qwx5R9ArxUy0mBpf/recaptcha__en.js
   81
7. www.google.com/recaptcha/api.js
   63
8. ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
   51
9. cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
   49
10. code.jquery.com/jquery-3.1.1.min.js
    48
11. code.jquery.com/jquery-3.3.1.js
    45
12. maps.googleapis.com/maps/api/js
    44
13. gtomitsuka.github.io/gibberish-detector.js/gibberish.min.js
    40
14. www.google-analytics.com/analytics.js
    39
15. www.google.com/recaptcha/api2/webworker.js
    38

Most common first-party scripts#

Script path served from the website's own domain

1. /_next/static/chunks/0cz1d0mv5g_q7.js
   112
2. /wp-includes/js/jquery/jquery.min.js
   104
3. /wp-includes/js/jquery/jquery-migrate.min.js
   96
4. /wp-includes/js/wp-emoji-release.min.js
   88
5. /_next/static/chunks/1jexzsn2qdw84.js
   83
6. /_next/static/chunks/1ntn7efqc-iiw.js
   83
7. /_next/static/chunks/2g05-lers809t.js
   83
8. /_next/static/chunks/14_fsmfcbrrbe.js
   82
9. /_next/static/chunks/3nc6x0_y5iwnk.js
   82
10. /_next/static/chunks/3z-oetkpttgun.js
    81
11. /_next/static/chunks/turbopack-3p84inqw3zu8w.js
    81
12. /_next/static/chunks/3riw0-7aeplln.js
    70
13. /_next/static/chunks/04u9x8_fzw9b5.js
    60
14. /static/js/* (27 files)
    57
15. /_next/static/chunks/12j-n_j2swqsy.js
    56

Most common JARM fingerprints#

JARM fingerprints most associated with malicious sites#

Most common JA4S fingerprints#

JA4S fingerprints most associated with malicious sites#