ScanMalware.com

Statistics

What ScanMalware saw in the last 30 days: the infrastructure behind malicious websites, the threats they carry, and where scanned URLs come from.

Public scans
108,834
78,063 distinct sites
Malicious scans
26,000
23.9% of public scans
Malicious sites
13,013
distinct hostnames

Scans and malicious scans

All public scans per day (UTC)

MaliciousOther scans
Hover a column for details · peak 4,953
09-1510-15
Show as table
PeriodScansMalicious
09-15787302
09-161,838682
09-171,791626
09-182,222701
09-192,604564
09-202,594635
09-212,677573
09-222,679619
09-233,250714
09-243,730901
09-254,039657
09-264,000685
09-273,876840
09-283,989838
09-293,910834
09-303,929749
10-013,9561,044
10-024,103687
10-034,037783
10-043,990848
10-053,944816
10-064,018814
10-074,011684
10-084,1001,454
10-094,9531,733
10-103,964706
10-114,3831,427
10-124,0771,032
10-134,036896
10-144,7911,461
10-152,556695

IP addresses hosting the most malicious sites

Distinct malicious hostnames per IP address

IP addressNetworkSites
🇺🇸188.114.97.9CDNAS13335 Cloudflare, Inc.1,640
🇺🇸188.114.96.9CDNAS13335 Cloudflare, Inc.1,622
🇺🇸104.18.54.45CDNAS13335 Cloudflare, Inc.1,052
🇺🇸104.18.50.34CDNAS13335 Cloudflare, Inc.1,034
🇺🇸199.36.158.100CDNAS54113 Fastly, Inc.355
🇸🇬43.174.247.29AS139341 ACE320
🇸🇬43.174.246.29AS139341 ACE314
🇺🇸216.198.79.195CDNAS16509 Amazon.com, Inc.230
🇺🇸216.198.79.3CDNAS16509 Amazon.com, Inc.230
🇺🇸64.29.17.3CDNAS16509 Amazon.com, Inc.230
🇺🇸216.198.79.67CDNAS16509 Amazon.com, Inc.229
🇺🇸64.29.17.195CDNAS16509 Amazon.com, Inc.228
🇩🇪35.157.26.135CDNAS16509 Amazon.com, Inc.220
🇺🇸64.29.17.67CDNAS16509 Amazon.com, Inc.215
🇩🇪63.176.8.218CDNAS16509 Amazon.com, Inc.212

Networks (ASNs) with the most malicious sites

Distinct malicious hostnames per network

  1. AS13335 Cloudflare, Inc.
    6,886
  2. AS16509 Amazon.com, Inc.
    1,369
  3. AS139341 ACE
    597
  4. AS54113 Fastly, Inc.
    393
  5. AS31898 Oracle Corporation
    229
  6. AS47583 Hostinger International Limited
    165
  7. AS396982 Google LLC
    141
  8. AS16276 OVH SAS
    134
  9. AS24940 Hetzner Online GmbH
    131
  10. AS8560 IONOS SE
    117
  11. AS398101 GoDaddy.com, LLC
    110
  12. AS15169 Google LLC
    108
  13. AS14061 DigitalOcean, LLC
    91
  14. AS31034 Aruba S.p.A.
    89
  15. AS14618 Amazon.com, Inc.
    68

Domains with the most malicious subdomains

Distinct malicious subdomains under one registered domain

  1. edgeone.dev
    593
  2. cr-web.workers.dev
    45
  3. xsph.ru
    17
  4. windows.net
    15
  5. weebly.com
    12
  6. 666iapk.net
    11
  7. 6r6r6.org
    11
  8. edgeone.app
    10
  9. 15-204-228-33.plesk.page
    9
  10. 333vip.org
    8
  11. 3toto.com
    8
  12. 73kcom.org
    8
  13. devwatchaudit.casa
    7
  14. gitbook.io
    7
  15. 131422.com
    5

Hosting platforms most abused

Malicious sites on free-subdomain and app-hosting platforms

  1. pages.dev
    3,341
  2. r2.dev
    1,282
  3. vercel.app
    954
  4. netlify.app
    315
  5. workers.dev
    284
  6. web.app
    232
  7. firebaseapp.com
    203
  8. replit.app
    82
  9. onrender.com
    26
  10. github.io
    14
  11. blogspot.com
    10
  12. plesk.page
    10
  13. typedream.app
    7
  14. square.site
    6
  15. webflow.io
    5

Threat types

Malicious scans by the kind of threat found

  1. Credential Phishing
    12,529
  2. Malware Distribution
    7,665
  3. Brand Impersonation
    2,366
  4. Other
    465
  5. Illegal Gambling
    259
  6. Investment/Crypto Scam
    203
  7. Survey/Reward Scam
    50
  8. Tech Support Scam
    45
  9. Fake Shopping
    35
  10. Advance Fee Fraud
    30
  11. SEO Spam
    30
  12. Illegal Pharmaceutical Sales
    18

Top-level domains of malicious sites

Distinct malicious hostnames per TLD

  1. .dev
    5,505
  2. .com
    2,604
  3. .app
    1,614
  4. .org
    232
  5. .net
    190
  6. .de
    160
  7. .br
    110
  8. .se
    93
  9. .it
    86
  10. .ru
    86
  11. .top
    75
  12. .uk
    75
  13. .online
    68
  14. .cc
    66
  15. .io
    63

Countries hosting the most malicious sites

Country of the hosting IP address. The second column leaves out shared CDN addresses, whose location is the network's, not the site's server.

CountryAll sitesExcl. CDN
🇺🇸 United States9,655991
🇩🇪 Germany828490
🇸🇬 Singapore676670
🇫🇷 France225223
🇳🇱 Netherlands144137
🇮🇹 Italy126124
🇧🇷 Brazil115111
🇬🇧 United Kingdom113109
🇮🇳 India6866
🇷🇺 Russia6565
🇧🇬 Bulgaria5555
🇵🇱 Poland5352
🇻🇳 Vietnam4848
🇨🇭 Switzerland4745
🇪🇸 Spain4544

Countries hosting the most malicious sites (own servers)

Sites not behind a shared CDN, by the country of their server

  1. 🇺🇸 United States
    991
  2. 🇸🇬 Singapore
    670
  3. 🇩🇪 Germany
    490
  4. 🇫🇷 France
    223
  5. 🇳🇱 Netherlands
    137
  6. 🇮🇹 Italy
    124
  7. 🇧🇷 Brazil
    111
  8. 🇬🇧 United Kingdom
    109
  9. 🇮🇳 India
    66
  10. 🇷🇺 Russia
    65
  11. 🇧🇬 Bulgaria
    55
  12. 🇵🇱 Poland
    52
  13. 🇻🇳 Vietnam
    48
  14. 🇨🇭 Switzerland
    45
  15. 🇪🇸 Spain
    44

Cities hosting the most malicious sites

Sites not behind a shared CDN, by the city of their server. The city is known for 1,844 of 3,939 such sites.

  1. 🇺🇸 Ashburn · United States
    149
  2. 🇩🇪 Frankfurt am Main · Germany
    140
  3. 🇺🇸 Phoenix · United States
    133
  4. 🇮🇹 Arezzo · Italy
    88
  5. 🇳🇱 Amsterdam · Netherlands
    73
  6. 🇩🇪 Falkenstein · Germany
    73
  7. 🇧🇷 Vinhedo · Brazil
    64
  8. 🇸🇬 Singapore · Singapore
    61
  9. 🇮🇳 Mumbai · India
    41
  10. 🇩🇪 Nuremberg · Germany
    41
  11. 🇫🇷 Paris · France
    39
  12. 🇫🇷 Lauterbourg · France
    37
  13. 🇧🇬 Sofia · Bulgaria
    35
  14. 🇩🇰 Copenhagen · Denmark
    34
  15. 🇺🇸 Dallas · United States
    32

Countries submitting the most URLs

Ranked by URLs submitted by people. Excludes ScanMalware's own automated scanning.

  1. 1.🇩🇪 Germany
  2. 2.🇺🇸 United States
  3. 3.🇸🇪 Sweden
  4. 4.🇷🇺 Russia
  5. 5.🇵🇱 Poland
  6. 6.🇨🇭 Switzerland
  7. 7.🇧🇷 Brazil
  8. 8.🇨🇦 Canada
  9. 9.🇮🇳 India
  10. 10.🇨🇳 China
  11. 11.🇮🇹 Italy
  12. 12.🇵🇰 Pakistan
  13. 13.🇲🇽 Mexico
  14. 14.🇫🇷 France
  15. 15.🇱🇹 Lithuania
  16. 16.🇦🇺 Australia
  17. 17.🇬🇧 United Kingdom
  18. 18.🇿🇦 South Africa
  19. 19.🇵🇸 Palestinian Territories
  20. 20.🇹🇷 Türkiye

Site traffic

Counted from 2026-09-15 (UTC). Scan views and visitors count people only: search engines, other crawlers and automated clients are left out.

Most viewed scans

Public scan results ranked by the number of people who opened them

  1. 1.padisahbet.yeni-koruma.icuIndex of /
  2. 2.coinbaise.vercel.appCoinbase
  3. 3.dranivo1-dpvm9g02pa5i.edgeone.devDranivo
  4. 4.xfactor300.vercel.appSign in to Xfinity
  5. 5.secured.firstapexcomm.comFirst Apex Commercial - Login
  6. 6.homegymsetup.xyzHow a toxic self-improvement trend with a funny name took over your feed — homegymsetup.xyz
  7. 7.rokasetu.pages.devEvexaro
  8. 8.jqq6us.info接続確認
  9. 9.toyota.com2026 Toyota GR Supra | Toyota.com
  10. 10.massgravel.devMicrosoft Activation Scripts | MAS
  11. 11.westword.comDavid Byrne Denver Concert Will Make Sense of It All: Q&A
  12. 12.psychological-jade-hbaygccq.edgeone.devSign In.
  13. 13.hasuncnc.pages.devRequest CNC Machining Quote | Hasun CNC
  14. 14.securecheckv1-proceed.pages.devSecure Gateway • Quick Verification
  15. 15.lolalytics.comLeague of Legends Analytics • LoLalytics • Patch 15.24

Countries visitors come from

Ranked by the number of people visiting ScanMalware

  1. 1.🇺🇸 United States
  2. 2.🇧🇷 Brazil
  3. 3.🇸🇬 Singapore
  4. 4.🇬🇧 United Kingdom
  5. 5.🇫🇷 France
  6. 6.🇩🇪 Germany
  7. 7.🇨🇳 China
  8. 8.🇦🇷 Argentina
  9. 9.🇲🇽 Mexico
  10. 10.🇹🇷 Türkiye
  11. 11.🇮🇹 Italy
  12. 12.🇧🇩 Bangladesh
  13. 13.🇮🇳 India
  14. 14.🇪🇸 Spain
  15. 15.🇨🇱 Chile
  16. 16.🇨🇦 Canada
  17. 17.🇨🇴 Colombia
  18. 18.🇵🇹 Portugal
  19. 19.🇳🇱 Netherlands
  20. 20.🇵🇭 Philippines

Most requested domains via the API

Domain and subdomain lookups (certificate and host APIs)

  1. example.com
    48,657
  2. oceanai.ai
    34,756
  3. smartpal.ai
    34,755
  4. cruisepal.com
    34,754
  5. mariapps.in
    34,754
  6. seamedix.com
    34,752
  7. oceanopt.ai
    34,750
  8. memphismarine.com
    34,748
  9. euroserve.example
    28,127
  10. euroserve-legacy.example
    28,084
  11. hackerone.com
    19,646
  12. indeed.com
    15,130
  13. cosmos.windows-int.net
    13,124
  14. acme.dk
    12,627
  15. gitlab.com
    12,220

Most requested registered domains via the API

Lookups grouped by registered domain

  1. kpmg.com
    795,381
  2. bmwgroup.com
    570,335
  3. deere.com
    445,668
  4. bmw.com
    350,769
  5. nvidia.com
    254,823
  6. snowflake.com
    219,813
  7. wjunction.com
    174,434
  8. google.com
    159,183
  9. magento.com
    134,159
  10. att.com
    115,752
  11. onehousing.com.vn
    112,457
  12. usiminas.com
    109,942
  13. eldoradobrasil.com.br
    107,529
  14. zoho.com
    99,601
  15. edgeone.dev
    99,275

Busiest API endpoints

API requests by endpoint (our own systems excluded)

  1. /api/v1/ct/dns/{host}
    47,611,770
  2. /api/v1/hosts/{host}
    47,457,410
  3. /api/v1/search/smql
    47,373,140
  4. /api/v1/rdap/{id}
    315,738
  5. /api/v1/domain/stats/{host}
    281,601
  6. /api/v1/ct/{host}
    279,722
  7. /api/v1/domain/history/{host}
    276,744
  8. /api/v1/tls/{id}
    231,693
  9. /api/v1/jarm/scan/{id}
    228,164
  10. /api/v1/rpki/{id}
    207,117
  11. /api/v1/ioc/{id}
    206,755
  12. /api/v1/js-fingerprinting3/scan/{id}
    205,121
  13. /api/v1/scans/{id}/jsfingerprints
    204,896
  14. /api/v1/js-fingerprinter2/{id}
    199,420
  15. /api/v1/ct/similar/{host}
    188,240

JavaScript

Scripts loaded by the 51,068 websites scanned in the last 30 days, counted as the number of distinct websites. Third-party means the script comes from a different registered domain than the page.

Most popular libraries and frameworks

Websites where the library or framework was detected

  1. jQuery · JavaScript library
    19,112
  2. React · JavaScript framework
    2,037
  3. Bootstrap · UI framework
    1,924
  4. Swiper · JavaScript library
    1,893
  5. OWL Carousel · JavaScript library
    1,477
  6. Lightbox · JavaScript library
    1,417
  7. jQuery UI · JavaScript library
    1,400
  8. Vue.js · JavaScript framework
    1,048
  9. Tailwind CSS · UI framework
    619
  10. Lodash · JavaScript library
    604
  11. RequireJS · JavaScript framework
    575
  12. Moment.js · JavaScript library
    512
  13. AMP · JavaScript framework
    511
  14. Stimulus · JavaScript framework
    449
  15. Select2 · JavaScript library
    407

Most used third-party script providers

Registered domain serving the script

  1. googletagmanager.com
    17,867
  2. cloudflare.com
    9,903
  3. google.com
    7,889
  4. facebook.net
    5,856
  5. gstatic.com
    5,134
  6. doubleclick.net
    4,853
  7. google-analytics.com
    4,420
  8. jsdelivr.net
    3,452
  9. ajax.googleapis.com
    2,846
  10. yandex.ru
    2,646
  11. googlesyndication.com
    2,570
  12. cloudflareinsights.com
    2,141
  13. clarity.ms
    2,060
  14. jquery.com
    1,964
  15. youtube.com
    1,917

Most loaded third-party scripts

Script URL without its query string

  1. www.googletagmanager.com/gtag/js
    16,537
  2. www.googletagmanager.com/gtm.js
    8,527
  3. connect.facebook.net/en_US/fbevents.js
    4,952
  4. challenges.cloudflare.com/turnstile/v0/api.js
    4,429
  5. challenges.cloudflare.com/turnstile/v0/b/d76008a69eab/api.js
    4,010
  6. www.google-analytics.com/analytics.js
    3,865
  7. challenges.cloudflare.com/turnstile/v0/g/4df4a60fa397/api.js
    3,426
  8. www.google.com/recaptcha/api.js
    2,683
  9. mc.yandex.ru/metrika/tag.js
    2,156
  10. www.google.com/recaptcha/api2/webworker.js
    1,920
  11. pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
    1,912
  12. ep2.adtrafficquality.google/sodar/sodar2.js
    1,751
  13. maps.googleapis.com/maps/api/js
    1,700
  14. static.doubleclick.net/instream/ad_status.js
    1,459
  15. snap.licdn.com/li.lms-analytics/insight.min.js
    1,438

Most common first-party scripts

Script path served from the website's own domain

  1. /wp-includes/js/jquery/jquery.min.js
    8,558
  2. /wp-includes/js/jquery/jquery-migrate.min.js
    7,778
  3. /wp-includes/js/wp-emoji-release.min.js
    6,708
  4. /wp-includes/js/dist/hooks.min.js
    4,081
  5. /wp-includes/js/dist/i18n.min.js
    3,968
  6. /wp-includes/js/jquery/ui/core.min.js
    3,261
  7. /wp-content/plugins/elementor/assets/js/* (3 files)
    2,538
  8. /wp-content/plugins/contact-form-7/includes/js/index.js
    2,112
  9. /wp-content/plugins/contact-form-7/includes/swv/js/index.js
    2,027
  10. /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
    2,003
  11. /wp-content/plugins/elementor-pro/assets/js/frontend.min.js
    1,648
  12. /wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js
    1,523
  13. /wp-includes/js/imagesloaded.min.js
    1,468
  14. /cdn-cgi/challenge-platform/h/b/scripts/jsd/d76008a69eab/main.js
    1,370
  15. /checkouts/internal/preloads.js
    1,325

TLS server fingerprints

JARM and JA4S describe how a web server answers a TLS connection; servers running the same software and configuration share a fingerprint. Counted as distinct websites. The malicious rankings order fingerprints by the share of their websites that were malicious (at least 10 websites, 5 of them malicious). JA4S is recorded since 23 September 2026.

Most common JARM fingerprints

FingerprintUsual networkSitesMalicious
27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525cCloudflare, Inc.13,5052,762 (20%)
27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.11,9463,495 (29%)
29d29d00029d29d00041d41d00041db78309d03c04b7072bacbf1ce396279bAmazon.com, Inc.5,226193 (4%)
3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fbAmazon.com, Inc.5,0891,493 (29%)
2ad2ad0002ad2ad22c42d42d0000008a5941c13f67e0c0a2c8a36bfeef6920ACE4,090602 (15%)
27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.3,787178 (5%)
16d3fd16d29d29d00042d43d00000071784fa9f8305ba9220d0a7894b6ff2cLoopia AB3,54011 (0%)
29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36cFastly, Inc.2,971521 (18%)
27d40d40d00040d1dc42d43d00041d5691268beec3bcca1d5ab3aacc89645fCloudflare, Inc.2,1331,532 (72%)
40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319Amazon.com, Inc.1,884374 (20%)
2ad2ad0002ad2ad00042d42d0000002059a3b916699461c5923779b77cf06bMicrosoft Corporation1,785142 (8%)
29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3aeODERLAND Webbhotell AB1,657266 (16%)
27d40d40d00000000042d43d0000000f0fc3b7e99fa90f0a6ea06fe65aef1dOne.com A/S1,65453 (3%)
27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36cGoogle LLC1,514104 (7%)
29d29d00029d29d21c41d41d00041d38d8d683f08c154e73a9de64943d64e4Amazon.com, Inc.1,15181 (7%)

JARM fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
40d1db40d0000001dc43d1db1db43d41226dd5dfc615dd4a96265559485910Blatant1313 (100%)
40d40d40d00000000043d40d40d43d9d4f83ac87494648a3bed4ab670795cdAmazon.com, Inc.1615 (94%)
27d27d27d00027d1dc42d43d0000008ef30d0165f90df21a64bafbc24d66f5Register S.p.A.1110 (91%)
27d27d27d00027d1dc42d42d00000037c751b6e0648a958f2ae7460998fc67LiquidNet US LLC2016 (80%)
27d40d40d00040d1dc42d43d00041d5691268beec3bcca1d5ab3aacc89645fCloudflare, Inc.2,1331,532 (72%)
2ad2ad0002ad2ad00042d42d0000004730e1a02fb93a679b09eac9e25c22fcStrato GmbH4731 (66%)
29d29d00029d29d00042d43d00041dd469afa8cfbe5e42c631eb3fc55d6787Akamai Connected Cloud169 (56%)
2ad2ad16d2ad2ad0002ad2ad2ad2adbfb4c26e4a72aca380107db225a1ef64GoDaddy.com, LLC331186 (56%)
27d27d27d00027d00042d43d00041de2e563ee0d1902aeebdf8197560d8f75Contabo GmbH1810 (56%)
29d29d16d29d29d00042d42d000000df133019600a83abfb096ff3e86cd79dYelles AB2513 (52%)
29d29d15d29d29d00042d42d0000006a78f6757b72f02e234bb3f6d2d5740bNew Dream Network, LLC15479 (51%)
29d29d15d29d29d00042d42d000000cd600c085f371f8533aaf66051f8e5b1Oracle Corporation659338 (51%)
28d28d28d00028d00042d42d000000aa5feb68b57d31b6dc713b6917a988e3OVH SAS15378 (51%)
3fd3fd40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319HostPapa2814 (50%)
29d29d15d29d29d00042d42d0000009435214b849738c4ebab4534b5d158ddOracle Corporation168 (50%)

Most common JA4S fingerprints

FingerprintUsual networkSitesMalicious
t130200_1302_234ea6891581Cloudflare, Inc.35,7827,652 (21%)
t130200_1302_a56c5b993250ACE31,7992,853 (9%)
t130200_1301_a56c5b993250Amazon.com, Inc.13,153944 (7%)
t130200_1303_a56c5b993250Amazon.com, Inc.7,4841,506 (20%)
t1206h2_c02f_3603f09c43baAmazon.com, Inc.96328 (3%)
t1207h2_c030_b948729f6510GoDaddy.com, LLC644194 (30%)
t1207h1_c02f_b948729f6510YANDEX LLC35021 (6%)
t1204h2_c030_b252f78b95f6IP Pathways, LLC33811 (3%)
t1207h2_c02f_b948729f6510EdgeCenter LLC3317 (2%)
t1207h1_c030_b948729f6510LLC VK3105 (2%)
t1206h2_c02b_3f14cc51fb76Cloudflare, Inc.26534 (13%)
t130200_1301_234ea6891581SiteVision AB2447 (3%)
t120300_c02f_460f64128655Adobe Inc.2023 (1%)
t1207h2_cca8_b948729f6510LLC VK1824 (2%)
t1206h2_c02f_3f14cc51fb76Fastly, Inc.16911 (7%)

JA4S fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
t1207h2_c030_b948729f6510GoDaddy.com, LLC644194 (30%)
t1206h2_c02b_cd2f8cf6dcd7Alibaba (US) Technology Co., Ltd.205 (25%)
t130200_1302_234ea6891581Cloudflare, Inc.35,7827,652 (21%)
t130200_1303_a56c5b993250Amazon.com, Inc.7,4841,506 (20%)
t1206h1_0033_74f2d60c4b9bMiss Hosting AB367 (19%)
t130200_1303_234ea6891581SYNERGY WHOLESALE PTY LTD9915 (15%)
t1206h2_c02b_3f14cc51fb76Cloudflare, Inc.26534 (13%)
t1205h2_c030_845f7282a956Microsoft Corporation9711 (11%)
t1205h2_c02f_845f7282a956Domain names registrar REG.RU, Ltd14113 (9%)
t130200_1302_a56c5b993250ACE31,7992,853 (9%)
t1207h1_c02c_b948729f6510Yandex.Cloud LLC706 (9%)
t130200_1301_a56c5b993250Amazon.com, Inc.13,153944 (7%)
t1206h2_c02f_3f14cc51fb76Fastly, Inc.16911 (7%)
t1207h1_c02f_b948729f6510YANDEX LLC35021 (6%)
t120400_c030_1b122d51bd39Glesys AB1175 (4%)

A scan counts as malicious when our AI verdict rates it Confirmed scam or High risk, or our rule-based verdict rates it Malicious. Threat statistics cover all public scans; the submitting-country ranking covers URLs submitted by people and excludes ScanMalware's own automated scanning. Unlisted and private scans are never shown individually. Refreshed every 10–60 minutes depending on the window · generated 2026-10-15 13:54 UTC.