ScanMalware.com

Statistics

What ScanMalware saw in the last 7 days: the infrastructure behind malicious websites, the threats they carry, and where scanned URLs come from.

Public scans
30,384
28,102 distinct sites
Malicious scans
8,622
28.4% of public scans
Malicious sites
7,665
distinct hostnames

Scans and malicious scans

All public scans per 6 hours (UTC)

MaliciousOther scans
Hover a column for details · peak 1,379
10-08 12:00 UTC10-15 12:00 UTC
Show as table
PeriodScansMalicious
10-08 12:00 UTC599263
10-08 18:00 UTC965404
10-09 00:00 UTC1,100383
10-09 06:00 UTC1,261486
10-09 12:00 UTC1,374561
10-09 18:00 UTC1,218303
10-10 00:00 UTC974194
10-10 06:00 UTC1,011171
10-10 12:00 UTC1,008197
10-10 18:00 UTC971144
10-11 00:00 UTC994178
10-11 06:00 UTC977207
10-11 12:00 UTC1,238553
10-11 18:00 UTC1,174489
10-12 00:00 UTC1,121402
10-12 06:00 UTC958184
10-12 12:00 UTC1,010260
10-12 18:00 UTC988186
10-13 00:00 UTC949254
10-13 06:00 UTC962147
10-13 12:00 UTC1,056286
10-13 18:00 UTC1,069209
10-14 00:00 UTC1,008308
10-14 06:00 UTC1,077161
10-14 12:00 UTC1,379553
10-14 18:00 UTC1,327439
10-15 00:00 UTC1,150377
10-15 06:00 UTC1,024181
10-15 12:00 UTC442142

IP addresses hosting the most malicious sites

Distinct malicious hostnames per IP address

IP addressNetworkSites
🇺🇸188.114.96.9CDNAS13335 Cloudflare, Inc.841
🇺🇸188.114.97.9CDNAS13335 Cloudflare, Inc.786
🇺🇸104.18.54.45CDNAS13335 Cloudflare, Inc.576
🇺🇸104.18.50.34CDNAS13335 Cloudflare, Inc.569
🇺🇸199.36.158.100CDNAS54113 Fastly, Inc.314
🇩🇪63.176.8.218CDNAS16509 Amazon.com, Inc.125
🇩🇪35.157.26.135CDNAS16509 Amazon.com, Inc.109
🇺🇸216.198.79.67CDNAS16509 Amazon.com, Inc.72
🇺🇸64.29.17.3CDNAS16509 Amazon.com, Inc.71
🇺🇸64.29.17.195CDNAS16509 Amazon.com, Inc.69
🇺🇸216.198.79.131CDNAS16509 Amazon.com, Inc.63
🇺🇸64.29.17.67CDNAS16509 Amazon.com, Inc.61
🇺🇸216.198.79.3CDNAS16509 Amazon.com, Inc.59
🇸🇬43.174.246.29AS139341 ACE59
🇺🇸216.198.79.195CDNAS16509 Amazon.com, Inc.56

Networks (ASNs) with the most malicious sites

Distinct malicious hostnames per network

  1. AS13335 Cloudflare, Inc.
    4,387
  2. AS16509 Amazon.com, Inc.
    639
  3. AS54113 Fastly, Inc.
    324
  4. AS31898 Oracle Corporation
    160
  5. AS139341 ACE
    112
  6. AS398101 GoDaddy.com, LLC
    103
  7. AS47583 Hostinger International Limited
    93
  8. AS16276 OVH SAS
    87
  9. AS24940 Hetzner Online GmbH
    84
  10. AS31034 Aruba S.p.A.
    75
  11. AS396982 Google LLC
    66
  12. AS8560 IONOS SE
    61
  13. AS14061 DigitalOcean, LLC
    54
  14. AS209242 Cloudflare London, LLC
    40
  15. AS46606 Unified Layer
    40

Domains with the most malicious subdomains

Distinct malicious subdomains under one registered domain

  1. edgeone.dev
    105
  2. cr-web.workers.dev
    33
  3. 666iapk.net
    11
  4. 6r6r6.org
    11
  5. xsph.ru
    11
  6. 73kcom.org
    8
  7. weebly.com
    8
  8. 333vip.org
    7
  9. 3toto.com
    7
  10. edgeone.app
    7
  11. gitbook.io
    7
  12. windows.net
    6
  13. 131422.com
    5
  14. cloud-ip.cc
    5
  15. employee-statement.st
    5

Hosting platforms most abused

Malicious sites on free-subdomain and app-hosting platforms

  1. pages.dev
    1,935
  2. r2.dev
    1,137
  3. vercel.app
    406
  4. netlify.app
    201
  5. web.app
    199
  6. firebaseapp.com
    179
  7. workers.dev
    139
  8. replit.app
    46
  9. onrender.com
    18
  10. typedream.app
    7
  11. square.site
    6
  12. github.io
    4
  13. blogspot.com
    3
  14. duckdns.org
    3
  15. s3.us-east-1.amazonaws.com
    3

Threat types

Malicious scans by the kind of threat found

  1. Malware Distribution
    3,450
  2. Credential Phishing
    3,317
  3. Brand Impersonation
    686
  4. Other
    144
  5. Illegal Gambling
    86
  6. Investment/Crypto Scam
    31
  7. Tech Support Scam
    19
  8. SEO Spam
    11
  9. Fake Shopping
    10
  10. Survey/Reward Scam
    9
  11. Advance Fee Fraud
    7
  12. Illegal Pharmaceutical Sales
    2

Top-level domains of malicious sites

Distinct malicious hostnames per TLD

  1. .dev
    3,318
  2. .com
    1,575
  3. .app
    873
  4. .org
    146
  5. .net
    103
  6. .de
    97
  7. .br
    81
  8. .it
    64
  9. .site
    47
  10. .space
    47
  11. .uk
    46
  12. .online
    42
  13. .fr
    35
  14. .in
    34
  15. .store
    32

Countries hosting the most malicious sites

Country of the hosting IP address. The second column leaves out shared CDN addresses, whose location is the network's, not the site's server.

CountryAll sitesExcl. CDN
🇺🇸 United States5,915624
🇩🇪 Germany470262
🇸🇬 Singapore165160
🇫🇷 France157157
🇮🇹 Italy9999
🇧🇷 Brazil7977
🇳🇱 Netherlands7369
🇬🇧 United Kingdom6864
🇮🇳 India4746
🇵🇱 Poland3938
🇮🇷 Iran3231
🇻🇳 Vietnam3232
🇨🇭 Switzerland3131
🇿🇦 South Africa3030
🇩🇰 Denmark2827

Countries hosting the most malicious sites (own servers)

Sites not behind a shared CDN, by the country of their server

  1. 🇺🇸 United States
    624
  2. 🇩🇪 Germany
    262
  3. 🇸🇬 Singapore
    160
  4. 🇫🇷 France
    157
  5. 🇮🇹 Italy
    99
  6. 🇧🇷 Brazil
    77
  7. 🇳🇱 Netherlands
    69
  8. 🇬🇧 United Kingdom
    64
  9. 🇮🇳 India
    46
  10. 🇵🇱 Poland
    38
  11. 🇻🇳 Vietnam
    32
  12. 🇨🇭 Switzerland
    31
  13. 🇮🇷 Iran
    31
  14. 🇿🇦 South Africa
    30
  15. 🇩🇰 Denmark
    27

Cities hosting the most malicious sites

Sites not behind a shared CDN, by the city of their server. The city is known for 1,123 of 2,123 such sites.

  1. 🇺🇸 Ashburn · United States
    105
  2. 🇺🇸 Phoenix · United States
    97
  3. 🇮🇹 Arezzo · Italy
    75
  4. 🇩🇪 Frankfurt am Main · Germany
    60
  5. 🇩🇪 Falkenstein · Germany
    48
  6. 🇧🇷 Vinhedo · Brazil
    47
  7. 🇸🇬 Singapore · Singapore
    43
  8. 🇳🇱 Amsterdam · Netherlands
    38
  9. 🇮🇳 Mumbai · India
    30
  10. 🇩🇪 Nuremberg · Germany
    27
  11. 🇫🇷 Paris · France
    25
  12. 🇫🇷 Lauterbourg · France
    24
  13. 🇩🇰 Copenhagen · Denmark
    23
  14. 🇺🇸 Dallas · United States
    22
  15. 🇫🇷 Strasbourg · France
    21

Countries submitting the most URLs

Ranked by URLs submitted by people. Excludes ScanMalware's own automated scanning.

  1. 1.🇩🇪 Germany
  2. 2.🇺🇸 United States
  3. 3.🇷🇺 Russia
  4. 4.🇸🇪 Sweden
  5. 5.🇨🇭 Switzerland
  6. 6.🇮🇳 India
  7. 7.🇦🇺 Australia
  8. 8.🇵🇰 Pakistan
  9. 9.🇨🇦 Canada
  10. 10.🇿🇦 South Africa
  11. 11.🇹🇼 Taiwan
  12. 12.🇲🇽 Mexico
  13. 13.🇺🇦 Ukraine
  14. 14.🇨🇴 Colombia
  15. 15.🇪🇬 Egypt
  16. 16.🇱🇹 Lithuania
  17. 17.🇲🇾 Malaysia
  18. 18.🇵🇭 Philippines
  19. 19.🇹🇷 Türkiye
  20. 20.🇧🇷 Brazil

Site traffic

Counted from 2026-10-08 (UTC). Scan views and visitors count people only: search engines, other crawlers and automated clients are left out.

Most viewed scans

Public scan results ranked by the number of people who opened them

  1. 1.padisahbet.yeni-koruma.icuIndex of /
  2. 2.vannitoa-remont.eeMe tegeleme remondiga - Vannitubade remont Tallnnas
  3. 3.frosty-harbor-487a.pages.devCloudflare Speed Test 소개 | Cloudflare
  4. 4.cixiangift.pages.devGIFT Titanium - Premium Pure Titanium Drinkware Manufacturer & Supplier | B2B Wholesale
  5. 5.streameastxyz.onlineDetroit Pistons Vs Phoenix Suns | Streameast
  6. 6.outlook-serv-coral.vercel.appOutlook
  7. 7.doj-secure.infoLogin
  8. 8.login.microsoftonline.comSign in to your account
  9. 9.creepy-yellow-fi1vvfoy-dpbrvrxe5vw3.edgeone.devWANTED - Dead or Alive
  10. 10.cozy-wren-e7b8.pages.devCloudflare Speed Test について | Cloudflare
  11. 11.a35.d.akamai.netInvalid URL
  12. 12.lunar-orchard-3824.pages.devCloudflare Speed Test について | Cloudflare
  13. 13.dotnet.microsoft.comDownload .NET 5.0 (Linux, macOS, and Windows) | .NET
  14. 14.mvd.whm.www.app.admin.as.152-53-37-155.plesk.pageGoogle
  15. 15.jidinterior.pages.dev대전 인테리어 · 부분공사 | 도배·필름·욕실·주방 상담 | JID 인테리어디자인

Countries visitors come from

Ranked by the number of people visiting ScanMalware

  1. 1.🇺🇸 United States
  2. 2.🇬🇧 United Kingdom
  3. 3.🇸🇬 Singapore
  4. 4.🇩🇪 Germany
  5. 5.🇫🇷 France
  6. 6.🇧🇷 Brazil
  7. 7.🇮🇳 India
  8. 8.🇨🇳 China
  9. 9.🇮🇹 Italy
  10. 10.🇧🇩 Bangladesh
  11. 11.🇪🇸 Spain
  12. 12.🇹🇷 Türkiye
  13. 13.🇨🇦 Canada
  14. 14.🇵🇭 Philippines
  15. 15.🇸🇦 Saudi Arabia
  16. 16.🇻🇳 Vietnam
  17. 17.🇲🇽 Mexico
  18. 18.🇮🇩 Indonesia
  19. 19.🇵🇹 Portugal
  20. 20.🇭🇰 Hong Kong SAR China

Most requested domains via the API

Domain and subdomain lookups (certificate and host APIs)

  1. euroserve.example
    15,573
  2. euroserve-legacy.example
    15,557
  3. example.com
    13,103
  4. checkout.vimeo.com
    9,396
  5. cruisepal.com
    8,995
  6. memphismarine.com
    8,994
  7. oceanai.ai
    8,994
  8. mariapps.in
    8,994
  9. oceanopt.ai
    8,994
  10. seamedix.com
    8,994
  11. smartpal.ai
    8,994
  12. fc2.com
    5,719
  13. hackerone.com
    5,370
  14. testfire.net
    3,843
  15. indeed.com
    3,808

Most requested registered domains via the API

Lookups grouped by registered domain

  1. kpmg.com
    290,923
  2. nvidia.com
    253,773
  3. bmwgroup.com
    122,598
  4. snowflake.com
    116,543
  5. bmw.com
    73,797
  6. wayneindustries.us
    72,084
  7. centml.com
    52,100
  8. google.com
    46,265
  9. wjunction.com
    38,082
  10. kpmg.com.au
    30,376
  11. edgeone.dev
    29,653
  12. magento.com
    29,269
  13. usiminas.com
    28,072
  14. eldoradobrasil.com.br
    27,316
  15. octocore.ru
    26,307

Busiest API endpoints

API requests by endpoint (our own systems excluded)

  1. /api/v1/ct/dns/{host}
    12,588,025
  2. /api/v1/hosts/{host}
    12,526,084
  3. /api/v1/search/smql
    12,475,407
  4. /api/v1/rdap/{id}
    115,909
  5. /api/v1/domain/history/{host}
    102,852
  6. /api/v1/domain/stats/{host}
    101,714
  7. /api/v1/ct/{host}
    97,239
  8. /api/v1/tls/{id}
    72,798
  9. /api/v1/jarm/scan/{id}
    71,097
  10. /api/v1/ioc/{id}
    69,328
  11. /api/v1/scans/{id}/jsfingerprints
    68,716
  12. /api/v1/rpki/{id}
    68,242
  13. /api/v1/js-fingerprinting3/scan/{id}
    68,224
  14. /api/v1/js-fingerprinter2/{id}
    66,404
  15. /api/v1/ct/similar/{host}
    63,198

JavaScript

Scripts loaded by the 18,471 websites scanned in the last 7 days, counted as the number of distinct websites. Third-party means the script comes from a different registered domain than the page.

Most popular libraries and frameworks

Websites where the library or framework was detected

  1. jQuery · JavaScript library
    7,164
  2. Swiper · JavaScript library
    846
  3. Bootstrap · UI framework
    827
  4. Lightbox · JavaScript library
    642
  5. OWL Carousel · JavaScript library
    585
  6. jQuery UI · JavaScript library
    397
  7. Vue.js · JavaScript framework
    372
  8. React · JavaScript framework
    341
  9. AMP · JavaScript framework
    262
  10. Tailwind CSS · UI framework
    222
  11. Lodash · JavaScript library
    206
  12. RequireJS · JavaScript framework
    173
  13. Stimulus · JavaScript framework
    149
  14. Nuxt.js · JavaScript framework
    145
  15. Moment.js · JavaScript library
    145

Most used third-party script providers

Registered domain serving the script

  1. googletagmanager.com
    5,476
  2. cloudflare.com
    4,459
  3. google.com
    2,277
  4. gstatic.com
    1,792
  5. facebook.net
    1,699
  6. doubleclick.net
    1,419
  7. ajax.googleapis.com
    1,239
  8. yandex.ru
    1,169
  9. google-analytics.com
    1,061
  10. jsdelivr.net
    1,028
  11. jquery.com
    937
  12. googlesyndication.com
    784
  13. youtube.com
    656
  14. maps.googleapis.com
    639
  15. cloudflareinsights.com
    610

Most loaded third-party scripts

Script URL without its query string

  1. www.googletagmanager.com/gtag/js
    5,070
  2. challenges.cloudflare.com/turnstile/v0/g/4df4a60fa397/api.js
    3,010
  3. challenges.cloudflare.com/turnstile/v0/api.js
    2,544
  4. www.googletagmanager.com/gtm.js
    2,461
  5. connect.facebook.net/en_US/fbevents.js
    1,411
  6. mc.yandex.ru/metrika/tag.js
    949
  7. www.google.com/recaptcha/api.js
    917
  8. www.gstatic.com/recaptcha/releases/nY0xPItgwtlvjEjk2TqdwOQz/recaptcha__en.js
    898
  9. www.google-analytics.com/analytics.js
    880
  10. www.google.com/recaptcha/api2/webworker.js
    661
  11. maps.googleapis.com/maps/api/js
    636
  12. pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
    634
  13. ep2.adtrafficquality.google/sodar/sodar2.js
    545
  14. ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
    538
  15. static.cloudflareinsights.com/beacon.min.js/v4bc70e2c01a94c73b74392e4234840661791215815920
    529

Most common first-party scripts

Script path served from the website's own domain

  1. /wp-includes/js/jquery/jquery.min.js
    3,496
  2. /wp-includes/js/jquery/jquery-migrate.min.js
    3,223
  3. /wp-includes/js/wp-emoji-release.min.js
    2,784
  4. /wp-includes/js/dist/hooks.min.js
    1,802
  5. /wp-includes/js/dist/i18n.min.js
    1,770
  6. /wp-includes/js/jquery/ui/core.min.js
    1,486
  7. /wp-content/plugins/elementor/assets/js/* (3 files)
    1,227
  8. /wp-content/plugins/contact-form-7/includes/js/index.js
    940
  9. /wp-content/plugins/contact-form-7/includes/swv/js/index.js
    895
  10. /wp-content/plugins/elementor-pro/assets/js/frontend.min.js
    739
  11. /cdn-cgi/challenge-platform/h/g/scripts/jsd/4df4a60fa397/main.js
    707
  12. /wp-includes/js/imagesloaded.min.js
    686
  13. /wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js
    673
  14. /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
    636
  15. /wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js
    545

TLS server fingerprints

JARM and JA4S describe how a web server answers a TLS connection; servers running the same software and configuration share a fingerprint. Counted as distinct websites. The malicious rankings order fingerprints by the share of their websites that were malicious (at least 10 websites, 5 of them malicious). JA4S is recorded since 23 September 2026.

Most common JARM fingerprints

FingerprintUsual networkSitesMalicious
27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525cCloudflare, Inc.4,6481,579 (34%)
27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.4,5452,004 (44%)
29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36cFastly, Inc.1,997433 (22%)
3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fbAmazon.com, Inc.1,849519 (28%)
27d40d40d00040d1dc42d43d00041d5691268beec3bcca1d5ab3aacc89645fCloudflare, Inc.1,5541,237 (80%)
29d29d00029d29d00041d41d00041db78309d03c04b7072bacbf1ce396279bAmazon.com, Inc.1,526117 (8%)
16d3fd16d29d29d00042d43d00000071784fa9f8305ba9220d0a7894b6ff2cLoopia AB1,0823 (0%)
27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.1,059111 (10%)
2ad2ad0002ad2ad22c42d42d0000008a5941c13f67e0c0a2c8a36bfeef6920ACE1,021109 (11%)
27d40d40d00000000042d43d0000000f0fc3b7e99fa90f0a6ea06fe65aef1dOne.com A/S96536 (4%)
29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3aeODERLAND Webbhotell AB906172 (19%)
40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319Amazon.com, Inc.832239 (29%)
2ad2ad0002ad2ad00042d42d0000002059a3b916699461c5923779b77cf06bMicrosoft Corporation51173 (14%)
29d29d00029d29d00042d42d0000002059a3b916699461c5923779b77cf06bMiss Hosting AB48780 (16%)
29d3fd00029d29d00042d43d0000002059a3b916699461c5923779b77cf06bLoopia AB433160 (37%)

JARM fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
40d1db40d0000001dc43d1db1db43d41226dd5dfc615dd4a96265559485910Blatant1313 (100%)
27d40d40d00040d1dc42d43d00041d5691268beec3bcca1d5ab3aacc89645fCloudflare, Inc.1,5541,237 (80%)
2ad2ad16d2ad2ad00042d42d0000006a78f6757b72f02e234bb3f6d2d5740b10dencehispahard, S.L.2519 (76%)
2ad2ad16d2ad2ad0002ad2ad2ad2adbfb4c26e4a72aca380107db225a1ef64GoDaddy.com, LLC239176 (74%)
27d27d27d00027d1dc42d42d00000037c751b6e0648a958f2ae7460998fc67LiquidNet US LLC118 (73%)
29d29d00029d29d00042d43d00041dd469afa8cfbe5e42c631eb3fc55d6787Akamai Connected Cloud118 (73%)
28d28d28d00028d00042d42d000000aa5feb68b57d31b6dc713b6917a988e3OVH SAS6950 (72%)
29d29d16d29d29d00042d42d000000df133019600a83abfb096ff3e86cd79dYelles AB1410 (71%)
3fd3fd15d3fd3fd00042d42d000000c33a20aec889d430cbd148294f584a77Amazon.com, Inc.107 (70%)
29d29d15d29d29d00042d42d000000cd600c085f371f8533aaf66051f8e5b1Oracle Corporation362246 (68%)
29d29d15d29d29d00042d42d0000006a78f6757b72f02e234bb3f6d2d5740bNew Dream Network, LLC7952 (66%)
29d29d00029d29d00043d43d00043d598ac0c1012db967bb1ad0ff2491b3aeCong ty TNHH Web Panda106 (60%)
25d3fd00025d25d00042d43d0000001b0c486b0c0bae33c7ce67177fe8bab5Network Solutions, LLC148 (57%)
15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9bHetzner Online GmbH13470 (52%)
29d29d00029d29d21c42d42d000000bdfc58c9a46434368cf60aa440385763Hetzner Online GmbH3719 (51%)

Most common JA4S fingerprints

FingerprintUsual networkSitesMalicious
t130200_1302_234ea6891581Cloudflare, Inc.15,1695,534 (36%)
t130200_1302_a56c5b993250ACE12,5141,990 (16%)
t130200_1301_a56c5b993250Fastly, Inc.5,862770 (13%)
t130200_1303_a56c5b993250Amazon.com, Inc.3,168830 (26%)
t1207h2_c030_b948729f6510GoDaddy.com, LLC390181 (46%)
t1206h2_c02f_3603f09c43baAmazon.com, Inc.31919 (6%)
t1207h1_c02f_b948729f6510YANDEX LLC14512 (8%)
t1204h2_c030_b252f78b95f6Rackspace Hosting1246 (5%)
t1207h2_c02f_b948729f6510JSC Selectel1246 (5%)
t1206h2_c02b_3f14cc51fb76Cloudflare, Inc.12122 (18%)
t1207h1_c030_b948729f6510LLC VK1134 (4%)
t1206h2_c02f_3f14cc51fb76Fastly, Inc.7510 (13%)
t1207h2_cca8_b948729f6510LLC VK742 (3%)
t130200_1301_234ea6891581Oracle Corporation685 (7%)
t1205h2_c02f_845f7282a956JSC IOT6713 (19%)

JA4S fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
t1207h2_c030_b948729f6510GoDaddy.com, LLC390181 (46%)
t130200_1302_234ea6891581Cloudflare, Inc.15,1695,534 (36%)
t130200_1303_234ea6891581SYNERGY WHOLESALE PTY LTD4313 (30%)
t1205h2_c030_845f7282a956Microsoft Corporation3510 (29%)
t130200_1303_a56c5b993250Amazon.com, Inc.3,168830 (26%)
t1207h1_c02c_b948729f6510Glesys AB215 (24%)
t1205h2_c02f_845f7282a956JSC IOT6713 (19%)
t1206h2_c02b_3f14cc51fb76Cloudflare, Inc.12122 (18%)
t130200_1302_a56c5b993250ACE12,5141,990 (16%)
t1206h2_c02f_3f14cc51fb76Fastly, Inc.7510 (13%)
t130200_1301_a56c5b993250Fastly, Inc.5,862770 (13%)
t1207h1_c02f_b948729f6510YANDEX LLC14512 (8%)
t130200_1301_234ea6891581Oracle Corporation685 (7%)
t1206h2_c02f_3603f09c43baAmazon.com, Inc.31919 (6%)
t1204h2_c030_b252f78b95f6Rackspace Hosting1246 (5%)

A scan counts as malicious when our AI verdict rates it Confirmed scam or High risk, or our rule-based verdict rates it Malicious. Threat statistics cover all public scans; the submitting-country ranking covers URLs submitted by people and excludes ScanMalware's own automated scanning. Unlisted and private scans are never shown individually. Refreshed every 10–60 minutes depending on the window · generated 2026-10-15 14:13 UTC.