ScanMalware.com

Statistics

What ScanMalware saw in the last 30 days: the infrastructure behind malicious websites, the threats they carry, and where scanned URLs come from.

Public scans
66,690
52,222 distinct sites
Malicious scans
16,727
25.1% of public scans
Malicious sites
8,524
distinct hostnames

Scans and malicious scans

All public scans per day (UTC)

MaliciousOther scans
Hover a column for details · peak 4,039
08-2809-27
Show as table
PeriodScansMalicious
08-281,984529
08-291,816769
08-301,500232
08-311,467484
09-011,654373
09-021,690233
09-031,614157
09-041,828401
09-052,110575
09-062,056519
09-071,988557
09-081,567200
09-091,707233
09-101,579205
09-111,728349
09-122,233728
09-132,263929
09-142,1601,009
09-151,915771
09-161,838682
09-171,791626
09-182,222699
09-192,604569
09-202,594642
09-212,677577
09-222,679624
09-233,250723
09-243,730902
09-254,039658
09-264,000686
09-2740786

IP addresses hosting the most malicious sites

Distinct malicious hostnames per IP address

IP addressNetworkSites
🇺🇸188.114.97.9CDNAS13335 Cloudflare, Inc.1,039
🇺🇸188.114.96.9CDNAS13335 Cloudflare, Inc.989
🇺🇸104.18.94.41CDNAS13335 Cloudflare, Inc.758
🇺🇸104.18.95.41CDNAS13335 Cloudflare, Inc.724
🇸🇬43.174.246.29AS139341 ACE219
🇺🇸188.114.96.3CDNAS13335 Cloudflare, Inc.216
🇸🇬43.174.247.29AS139341 ACE209
🇺🇸188.114.97.3CDNAS13335 Cloudflare, Inc.205
🇺🇸216.198.79.195AS16509 Amazon.com, Inc.174
🇩🇪63.176.8.218CDNAS16509 Amazon.com, Inc.174
🇺🇸216.198.79.3AS16509 Amazon.com, Inc.167
🇩🇪35.157.26.135CDNAS16509 Amazon.com, Inc.165
🇺🇸216.198.79.67AS16509 Amazon.com, Inc.163
🇺🇸64.29.17.195AS16509 Amazon.com, Inc.154
🇺🇸64.29.17.67AS16509 Amazon.com, Inc.151

Networks (ASNs) with the most malicious sites

Distinct malicious hostnames per network

  1. AS13335 Cloudflare, Inc.
    4,523
  2. AS16509 Amazon.com, Inc.
    1,229
  3. AS15169 Google LLC
    431
  4. AS139341 ACE
    407
  5. AS396982 Google LLC
    134
  6. AS54113 Fastly, Inc.
    129
  7. AS47583 Hostinger International Limited
    80
  8. AS14618 Amazon.com, Inc.
    71
  9. AS24940 Hetzner Online GmbH
    67
  10. AS31898 Oracle Corporation
    67
  11. AS16276 OVH SAS
    60
  12. AS8560 IONOS SE
    57
  13. AS215311 Regxa Company for Information Technology Ltd
    56
  14. AS22612 Namecheap, Inc.
    49
  15. AS8075 Microsoft Corporation
    49

Domains with the most malicious subdomains

Distinct malicious subdomains under one registered domain

  1. edgeone.dev
    511
  2. cr-web.workers.dev
    40
  3. 152-53-37-155.plesk.page
    20
  4. xsph.ru
    15
  5. edgeone.app
    14
  6. devwatchaudit.casa
    11
  7. weebly.com
    11
  8. devwatchalerts.cyou
    10
  9. devwatchbuild.me
    9
  10. ssffaa4.xyz
    9
  11. devwatchly.lat
    7
  12. windows.net
    7
  13. nisdably.com
    6
  14. 15-204-228-33.plesk.page
    5
  15. 2415054122105.workers.dev
    5

Hosting platforms most abused

Malicious sites on free-subdomain and app-hosting platforms

  1. pages.dev
    2,899
  2. vercel.app
    894
  3. netlify.app
    301
  4. workers.dev
    223
  5. r2.dev
    192
  6. replit.app
    62
  7. plesk.page
    30
  8. web.app
    24
  9. firebaseapp.com
    18
  10. onrender.com
    15
  11. blogspot.com
    12
  12. s3.amazonaws.com
    12
  13. azurewebsites.net
    11
  14. github.io
    11
  15. cloudfront.net
    5

Threat types

Malicious scans by the kind of threat found

  1. Credential Phishing
    6,607
  2. Malware Distribution
    5,665
  3. Brand Impersonation
    1,962
  4. Other
    309
  5. Illegal Gambling
    205
  6. Investment/Crypto Scam
    157
  7. Fake Shopping
    31
  8. SEO Spam
    22
  9. Survey/Reward Scam
    21
  10. Advance Fee Fraud
    17
  11. Tech Support Scam
    11
  12. Illegal Pharmaceutical Sales
    8

Top-level domains of malicious sites

Distinct malicious hostnames per TLD

  1. .dev
    3,830
  2. .com
    1,438
  3. .app
    1,308
  4. .net
    120
  5. .ru
    117
  6. .org
    114
  7. .top
    91
  8. .de
    81
  9. .cfd
    74
  10. .click
    74
  11. .xyz
    66
  12. .cc
    65
  13. .in
    41
  14. .info
    41
  15. .br
    38

Countries hosting the most malicious sites

Country of the hosting IP address. The second column leaves out shared CDN addresses, whose location is the network's, not the site's server.

CountryAll sitesExcl. CDN
🇺🇸 United States6,495794
🇩🇪 Germany666343
🇸🇬 Singapore433432
🇳🇱 Netherlands118108
🇫🇷 France9389
🇷🇺 Russia7573
🇧🇬 Bulgaria6464
🇬🇧 United Kingdom5655
🇭🇰 Hong Kong SAR China4844
🇧🇷 Brazil4442
🇸🇪 Sweden4138
🇮🇳 India3230
🇮🇹 Italy2523
🇨🇦 Canada2321
🇪🇸 Spain2323

Countries hosting the most malicious sites (own servers)

Sites not behind a shared CDN, by the country of their server

  1. 🇺🇸 United States
    794
  2. 🇸🇬 Singapore
    432
  3. 🇩🇪 Germany
    343
  4. 🇳🇱 Netherlands
    108
  5. 🇫🇷 France
    89
  6. 🇷🇺 Russia
    73
  7. 🇧🇬 Bulgaria
    64
  8. 🇬🇧 United Kingdom
    55
  9. 🇭🇰 Hong Kong SAR China
    44
  10. 🇧🇷 Brazil
    42
  11. 🇸🇪 Sweden
    38
  12. 🇮🇳 India
    30
  13. 🇪🇸 Spain
    23
  14. 🇮🇹 Italy
    23
  15. 🇨🇦 Canada
    21

Cities hosting the most malicious sites

Sites not behind a shared CDN, by the city of their server. The city is known for 974 of 2,508 such sites.

  1. 🇩🇪 Frankfurt am Main · Germany
    177
  2. 🇳🇱 Amsterdam · Netherlands
    53
  3. 🇧🇬 Sofia · Bulgaria
    47
  4. 🇺🇸 Ashburn · United States
    40
  5. 🇩🇪 Falkenstein · Germany
    37
  6. 🇺🇸 Phoenix · United States
    27
  7. 🇫🇷 Lauterbourg · France
    23
  8. 🇫🇷 Paris · France
    21
  9. 🇫🇮 Helsinki · Finland
    19
  10. 🇩🇪 Nuremberg · Germany
    19
  11. 🇸🇬 Singapore · Singapore
    19
  12. 🇺🇸 Hillsboro · United States
    18
  13. 🇺🇸 Manassas · United States
    18
  14. 🇧🇷 Vinhedo · Brazil
    18
  15. 🇭🇰 Hong Kong · Hong Kong SAR China
    17

Countries submitting the most URLs

Ranked by URLs submitted by people. Excludes ScanMalware's own automated scanning.

  1. 1.🇺🇸 United States
  2. 2.🇸🇪 Sweden
  3. 3.🇷🇺 Russia
  4. 4.🇫🇷 France
  5. 5.🇧🇷 Brazil
  6. 6.🇮🇳 India
  7. 7.🇩🇪 Germany
  8. 8.🇨🇦 Canada
  9. 9.🇮🇹 Italy
  10. 10.🇨🇿 Czechia
  11. 11.🇨🇴 Colombia
  12. 12.🇲🇾 Malaysia
  13. 13.🇱🇹 Lithuania
  14. 14.🇬🇧 United Kingdom
  15. 15.🇲🇽 Mexico
  16. 16.🇱🇻 Latvia
  17. 17.🇵🇸 Palestinian Territories
  18. 18.🇨🇳 China
  19. 19.🇨🇭 Switzerland
  20. 20.🇪🇸 Spain

Site traffic

Counted from 2026-09-10 (UTC), when traffic recording starts. Scan views and visitors count people only: search engines, other crawlers and automated clients are left out.

Most viewed scans

Public scan results ranked by the number of people who opened them

  1. 1.coinbaise.vercel.appCoinbase
  2. 2.padisahbet.yeni-koruma.icuIndex of /
  3. 3.dranivo1-dpvm9g02pa5i.edgeone.devDranivo
  4. 4.massgravel.devMicrosoft Activation Scripts | MAS
  5. 5.caowanting-dpvx56ercts0.edgeone.dev曹婉婷 · AI 内容运营作品集
  6. 6.rokasetu.pages.devEvexaro
  7. 7.hasuncnc.pages.devRequest CNC Machining Quote | Hasun CNC
  8. 8.xfactor300.vercel.appSign in to Xfinity
  9. 9.squidscript.comCloudflare Verification
  10. 10.kxv81-078mjw-pjq49-rel-9w6t2g-hwn64-166a.pages.devMeta for Business | Page Appeal
  11. 11.nexora-8h0.pages.devNexora Prime — Automatiza tus trámites legales en Colombia
  12. 12.toyota.com2026 Toyota GR Supra | Toyota.com
  13. 13.westword.comDavid Byrne Denver Concert Will Make Sense of It All: Q&A
  14. 14.testtaskhub-dpw6esh4kz7x.edgeone.devLog In — TaskHub
  15. 15.govah-site.pages.devVous avez un projet, Govah vous connecte aux professionnels prêts à y répondre - Govah

Countries visitors come from

Ranked by the number of people visiting ScanMalware

  1. 1.🇺🇸 United States
  2. 2.🇧🇷 Brazil
  3. 3.🇸🇬 Singapore
  4. 4.🇨🇳 China
  5. 5.🇫🇷 France
  6. 6.🇦🇷 Argentina
  7. 7.🇩🇪 Germany
  8. 8.🇲🇽 Mexico
  9. 9.🇹🇷 Türkiye
  10. 10.🇬🇧 United Kingdom
  11. 11.🇧🇩 Bangladesh
  12. 12.🇮🇳 India
  13. 13.🇨🇱 Chile
  14. 14.🇮🇹 Italy
  15. 15.🇪🇸 Spain
  16. 16.🇨🇴 Colombia
  17. 17.🇳🇱 Netherlands
  18. 18.🇨🇦 Canada
  19. 19.🇺🇦 Ukraine
  20. 20.🇵🇱 Poland

Most requested domains via the API

Domain and subdomain lookups (certificate and host APIs)

  1. example.com
    22,977
  2. smartpal.ai
    19,828
  3. oceanai.ai
    19,826
  4. cruisepal.com
    19,826
  5. mariapps.in
    19,826
  6. memphismarine.com
    19,826
  7. seamedix.com
    19,825
  8. oceanopt.ai
    19,824
  9. hackerone.com
    10,316
  10. cosmos.windows-int.net
    8,730
  11. indeed.com
    7,894
  12. acme.dk
    7,479
  13. braintree-api.com
    7,255
  14. braintree.tools
    7,174
  15. paydiant.com
    7,164

Most requested registered domains via the API

Lookups grouped by registered domain

  1. deere.com
    528,408
  2. bmwgroup.com
    458,075
  3. bmw.com
    283,692
  4. wjunction.com
    139,147
  5. zoho.com
    119,441
  6. magento.com
    106,920
  7. snowflake.com
    103,846
  8. kpmg.com
    102,026
  9. google.com
    87,684
  10. binus.ac.id
    57,169
  11. usiminas.com
    54,525
  12. eldoradobrasil.com.br
    52,657
  13. onehousing.com.vn
    51,531
  14. edgeone.dev
    45,086
  15. autobild.de
    43,895

Busiest API endpoints

API requests by endpoint (our own systems excluded)

  1. /api/v1/ct/dns/{host}
    21,775,569
  2. /api/v1/hosts/{host}
    21,741,032
  3. /api/v1/search/smql
    21,726,643
  4. /api/v1/rdap/{id}
    83,519
  5. /api/v1/tls/{id}
    80,153
  6. /api/v1/ct/{host}
    78,176
  7. /api/v1/jarm/scan/{id}
    78,032
  8. /api/v1/domain/stats/{host}
    77,372
  9. /api/v1/domain/history/{host}
    74,874
  10. /api/v1/rpki/{id}
    69,404
  11. /api/v1/js-fingerprinting3/scan/{id}
    68,825
  12. /api/v1/ioc/{id}
    68,445
  13. /api/v1/scans/{id}/jsfingerprints
    67,683
  14. /api/v1/js-fingerprinter2/{id}
    65,842
  15. /api/v1/cpe/{id}
    63,640

JavaScript

Scripts loaded by the 29,453 websites scanned in the last 30 days, counted as the number of distinct websites. Third-party means the script comes from a different registered domain than the page.

Most popular libraries and frameworks

Websites where the library or framework was detected

  1. jQuery · JavaScript library
    8,827
  2. React · JavaScript framework
    1,420
  3. Bootstrap · UI framework
    861
  4. jQuery UI · JavaScript library
    847
  5. Vue.js · JavaScript framework
    793
  6. OWL Carousel · JavaScript library
    710
  7. Swiper · JavaScript library
    665
  8. Lightbox · JavaScript library
    543
  9. Tailwind CSS · UI framework
    450
  10. Moment.js · JavaScript library
    313
  11. Nuxt.js · JavaScript framework
    303
  12. Stimulus · JavaScript framework
    262
  13. RequireJS · JavaScript framework
    232
  14. ZURB Foundation · UI framework
    231
  15. AMP · JavaScript framework
    204

Most used third-party script providers

Registered domain serving the script

  1. googletagmanager.com
    10,331
  2. cloudflare.com
    6,182
  3. google.com
    4,498
  4. facebook.net
    3,419
  5. google-analytics.com
    2,949
  6. doubleclick.net
    2,860
  7. jsdelivr.net
    2,346
  8. gstatic.com
    2,034
  9. yandex.ru
    1,973
  10. googlesyndication.com
    1,647
  11. cloudflareinsights.com
    1,525
  12. clarity.ms
    1,431
  13. ajax.googleapis.com
    1,370
  14. adtrafficquality.google
    1,103
  15. licdn.com
    1,100

Most loaded third-party scripts

Script URL without its query string

  1. www.googletagmanager.com/gtag/js
    9,496
  2. www.googletagmanager.com/gtm.js
    5,365
  3. challenges.cloudflare.com/turnstile/v0/api.js
    2,975
  4. connect.facebook.net/en_US/fbevents.js
    2,935
  5. www.google-analytics.com/analytics.js
    2,620
  6. challenges.cloudflare.com/turnstile/v0/g/330e41bb475c/api.js
    2,272
  7. mc.yandex.ru/metrika/tag.js
    1,577
  8. challenges.cloudflare.com/turnstile/v0/b/d76008a69eab/api.js
    1,494
  9. www.google.com/recaptcha/api.js
    1,320
  10. challenges.cloudflare.com/turnstile/v0/b/e694063b5082/api.js
    1,268
  11. pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
    1,224
  12. ep2.adtrafficquality.google/sodar/sodar2.js
    1,102
  13. snap.licdn.com/li.lms-analytics/insight.min.js
    1,090
  14. static.cloudflareinsights.com/beacon.min.js/v31edd6df95cf4e85bb4c19e7a9bdbcba1788362987495
    1,073
  15. translate.google.com/translate_a/element.js
    1,067

Most common first-party scripts

Script path served from the website's own domain

  1. /wp-includes/js/jquery/jquery.min.js
    3,305
  2. /wp-includes/js/jquery/jquery-migrate.min.js
    2,858
  3. /wp-includes/js/wp-emoji-release.min.js
    2,453
  4. /wp-includes/js/dist/hooks.min.js
    1,529
  5. /wp-includes/js/dist/i18n.min.js
    1,488
  6. /wp-includes/js/jquery/ui/core.min.js
    1,187
  7. /cdn-cgi/challenge-platform/h/g/scripts/jsd/330e41bb475c/main.js
    1,157
  8. /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
    956
  9. /wp-content/plugins/elementor/assets/js/* (3 files)
    839
  10. /_next/static/chunks/* (30 files)
    756
  11. /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1
    679
  12. /wp-content/plugins/contact-form-7/includes/js/index.js
    665
  13. /wp-content/plugins/contact-form-7/includes/swv/js/index.js
    631
  14. /wp-content/plugins/elementor/assets/js/shared-frontend-handlers.03caa53373b56d3bab67.bundle.min.js
    628
  15. /_next/static/chunks/polyfills-42372ed130431b0a.js
    614

TLS server fingerprints

JARM and JA4S describe how a web server answers a TLS connection; servers running the same software and configuration share a fingerprint. Counted as distinct websites. The malicious rankings order fingerprints by the share of their websites that were malicious (at least 10 websites, 5 of them malicious). JA4S is recorded since 23 September 2026.

Most common JARM fingerprints

FingerprintUsual networkSitesMalicious
27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.8,5302,858 (34%)
27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525cCloudflare, Inc.8,0931,882 (23%)
29d29d00029d29d00041d41d00041db78309d03c04b7072bacbf1ce396279bAmazon.com, Inc.4,634141 (3%)
2ad2ad0002ad2ad22c42d42d0000008a5941c13f67e0c0a2c8a36bfeef6920ACE3,793518 (14%)
3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fbAmazon.com, Inc.3,5341,463 (41%)
27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.1,721101 (6%)
2ad2ad0002ad2ad00042d42d0000002059a3b916699461c5923779b77cf06bMicrosoft Corporation1,446114 (8%)
40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319Amazon.com, Inc.1,337362 (27%)
29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36cFastly, Inc.1,154103 (9%)
27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36cGoogle LLC97489 (9%)
29d29d00029d29d21c41d41d00041d38d8d683f08c154e73a9de64943d64e4Amazon.com, Inc.93971 (8%)
29d3fd00029d29d00042d43d00041d6f940079659edb62e1c38c38bd26ee84Google LLC90690 (10%)
29d29d00029d29d00029d29d29d29d00efabaa2e194cf5d86dd52d92433babAmazon.com, Inc.68111 (2%)
27d40d40d29d40d1dc42d43d00041d9321ee525c34102511d1cb85dd2c9276Google LLC6290 (0%)
29d29d00029d29d00042d42d0000002059a3b916699461c5923779b77cf06bIONOS SE61666 (11%)

JARM fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
3fd3fd00000000000042d43d00041d8700c56a5a5ec6618423b41220f55356—1313 (100%)
27d27d27d00027d1dc42d42d00000037c751b6e0648a958f2ae7460998fc67LiquidNet US LLC1010 (100%)
2ad2ad0002ad2ad00042d42d0000004730e1a02fb93a679b09eac9e25c22fcStrato GmbH3736 (97%)
27d27d27d00027d00043d43d00043dba951fb796b4b956c9799ba19149e94aLeaseWeb Netherlands B.V.119 (82%)
40d40d40d00000000043d40d40d43d9d4f83ac87494648a3bed4ab670795cdAmazon.com, Inc.1411 (79%)
3fd3fd20d3fd3fd21c43d43d00043d8ca0ed80110695458d8382a2423776bd—107 (70%)
27d27d27d00027d00042d43d00041de2e563ee0d1902aeebdf8197560d8f75Contabo GmbH128 (67%)
07d10d11d21d21d07c07d10d07d21dc74a10f0dd8921b3cc912d3ee25ffd0aZAO Web Hosting2716 (59%)
27d40d40d00040d1dc42d43d00041d5691268beec3bcca1d5ab3aacc89645fCloudflare, Inc.385215 (56%)
28d28d28d00028d00042d42d000000aa5feb68b57d31b6dc713b6917a988e3OVH SAS8043 (54%)
07d19d1ad21d21d07c07d19d07d21d4672ec40d49b9362af2f077b2a529ffc—179 (53%)
2ad2ad0002ad2ad22c42d42d0000003e1c6bdcf3ddc0772f99dffca4dddc83Jsc timeweb157 (47%)
3fd3fd0003fd3fd21c42d42d000000bdfc58c9a46434368cf60aa440385763Amazon.com, Inc.16274 (46%)
29d29d20d29d29d21c42d42d0000000f0f2ea251d805c4640f820a3394a07aEdgenext Legend Dynasty Pte. Ltd.167 (44%)
27d40d40d00040d00042d43d0000003d25bc6207ca8acd9652e99aa3724a08Belcloud LTD15465 (42%)

Most common JA4S fingerprints

FingerprintUsual networkSitesMalicious
t130200_1302_234ea6891581Cloudflare, Inc.6,7391,539 (23%)
t130200_1302_a56c5b993250ACE5,774355 (6%)
t130200_1301_a56c5b993250Amazon.com, Inc.2,965139 (5%)
t130200_1303_a56c5b993250Amazon.com, Inc.2,184549 (25%)
t1206h2_c02f_3603f09c43baAmazon.com, Inc.2236 (3%)
t1207h2_c030_b948729f6510GoDaddy.com, LLC1147 (6%)
t1207h2_c02f_b948729f6510EdgeCenter LLC1105 (5%)
t1207h1_c02f_b948729f6510YANDEX LLC991 (1%)
t1207h1_c030_b948729f6510LLC VK752 (3%)
t1206h2_c02b_3f14cc51fb76Cloudflare, Inc.719 (13%)
t130200_1301_234ea6891581SiteVision AB601 (2%)
t1207h2_cca8_b948729f6510LLC VK551 (2%)
t120300_c02f_460f64128655Adobe Inc.451 (2%)
t1206h2_c02f_3f14cc51fb76Fastly, Inc.432 (5%)
t1204h2_c030_b252f78b95f6IP Pathways, LLC370 (0%)

JA4S fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
t130200_1303_a56c5b993250Amazon.com, Inc.2,184549 (25%)
t130200_1302_234ea6891581Cloudflare, Inc.6,7391,539 (23%)
t1206h2_c02b_3f14cc51fb76Cloudflare, Inc.719 (13%)
t130200_1302_a56c5b993250ACE5,774355 (6%)
t1207h2_c030_b948729f6510GoDaddy.com, LLC1147 (6%)
t130200_1301_a56c5b993250Amazon.com, Inc.2,965139 (5%)
t1207h2_c02f_b948729f6510EdgeCenter LLC1105 (5%)
t1206h2_c02f_3603f09c43baAmazon.com, Inc.2236 (3%)

A scan counts as malicious when our AI verdict rates it Confirmed scam or High risk, or our rule-based verdict rates it Malicious. Threat statistics cover all public scans; the submitting-country ranking covers URLs submitted by people and excludes ScanMalware's own automated scanning. Unlisted and private scans are never shown individually. Refreshed every 10–60 minutes depending on the window · generated 2026-09-27 02:31 UTC.