ScanMalware.com

Statistics

What ScanMalware saw in the last 7 days: the infrastructure behind malicious websites, the threats they carry, and where scanned URLs come from.

Public scans
21,644
19,152 distinct sites
Malicious scans
4,725
21.8% of public scans
Malicious sites
3,226
distinct hostnames

Scans and malicious scans

All public scans per 6 hours (UTC)

MaliciousOther scans
Hover a column for details · peak 1,091
09-19 00:00 UTC09-26 00:00 UTC
Show as table
PeriodScansMalicious
09-19 00:00 UTC476122
09-19 06:00 UTC669145
09-19 12:00 UTC640154
09-19 18:00 UTC668103
09-20 00:00 UTC646181
09-20 06:00 UTC653143
09-20 12:00 UTC666175
09-20 18:00 UTC629144
09-21 00:00 UTC673173
09-21 06:00 UTC641137
09-21 12:00 UTC713152
09-21 18:00 UTC650115
09-22 00:00 UTC640179
09-22 06:00 UTC650138
09-22 12:00 UTC727170
09-22 18:00 UTC662137
09-23 00:00 UTC642154
09-23 06:00 UTC70094
09-23 12:00 UTC984237
09-23 18:00 UTC924238
09-24 00:00 UTC893270
09-24 06:00 UTC875215
09-24 12:00 UTC1,000303
09-24 18:00 UTC962119
09-25 00:00 UTC973131
09-25 06:00 UTC985125
09-25 12:00 UTC1,091265
09-25 18:00 UTC990144
09-26 00:00 UTC22262

IP addresses hosting the most malicious sites

Distinct malicious hostnames per IP address

IP addressNetworkSites
🇺🇸188.114.97.9CDNAS13335 Cloudflare, Inc.554
🇺🇸188.114.96.9CDNAS13335 Cloudflare, Inc.531
🇸🇬43.174.247.29AS139341 ACE113
🇸🇬43.174.246.29AS139341 ACE108
🇩🇪63.176.8.218CDNAS16509 Amazon.com, Inc.81
🇩🇪35.157.26.135CDNAS16509 Amazon.com, Inc.78
🇺🇸216.198.79.3CDNAS16509 Amazon.com, Inc.68
🇺🇸216.198.79.67CDNAS16509 Amazon.com, Inc.64
🇺🇸216.198.79.195CDNAS16509 Amazon.com, Inc.61
🇺🇸64.29.17.195CDNAS16509 Amazon.com, Inc.61
🇺🇸64.29.17.131CDNAS16509 Amazon.com, Inc.57
🇺🇸64.29.17.3CDNAS16509 Amazon.com, Inc.56
🇺🇸34.117.33.233CDNAS396982 Google LLC51
🇺🇸64.29.17.67CDNAS16509 Amazon.com, Inc.48
🇺🇸216.198.79.131CDNAS16509 Amazon.com, Inc.47

Networks (ASNs) with the most malicious sites

Distinct malicious hostnames per network

  1. AS13335 Cloudflare, Inc.
    1,819
  2. AS16509 Amazon.com, Inc.
    505
  3. AS139341 ACE
    219
  4. AS396982 Google LLC
    59
  5. AS31898 Oracle Corporation
    34
  6. AS202412 Omegatech LTD
    26
  7. AS24940 Hetzner Online GmbH
    25
  8. AS47583 Hostinger International Limited
    25
  9. AS54113 Fastly, Inc.
    21
  10. AS8560 IONOS SE
    21
  11. AS16276 OVH SAS
    20
  12. AS14061 DigitalOcean, LLC
    17
  13. AS6724 Strato GmbH
    16
  14. AS14618 Amazon.com, Inc.
    12
  15. AS35278 Sprinthost.ru LLC
    12

Domains with the most malicious subdomains

Distinct malicious subdomains under one registered domain

  1. edgeone.dev
    212
  2. cr-web.workers.dev
    38
  3. xsph.ru
    12
  4. 152-53-37-155.plesk.page
    10
  5. edgeone.app
    8
  6. weebly.com
    6
  7. 2415054122105.workers.dev
    5
  8. othersmx.workers.dev
    5
  9. craftum.io
    3
  10. iceiy.com
    3
  11. 15-204-228-33.plesk.page
    2
  12. 70654733.workers.dev
    2
  13. bp7565357.workers.dev
    2
  14. domainpatchalpha.workers.dev
    2
  15. esu2n5lwqi.workers.dev
    2

Hosting platforms most abused

Malicious sites on free-subdomain and app-hosting platforms

  1. pages.dev
    1,411
  2. vercel.app
    350
  3. netlify.app
    130
  4. workers.dev
    108
  5. r2.dev
    63
  6. replit.app
    51
  7. plesk.page
    13
  8. onrender.com
    7
  9. github.io
    5
  10. blogspot.com
    3
  11. firebaseapp.com
    3
  12. web.app
    3
  13. webflow.io
    2
  14. azurewebsites.net
    1
  15. blob.core.windows.net
    1

Threat types

Malicious scans by the kind of threat found

  1. Credential Phishing
    2,229
  2. Malware Distribution
    1,340
  3. Brand Impersonation
    452
  4. Other
    121
  5. Illegal Gambling
    66
  6. Investment/Crypto Scam
    59
  7. Survey/Reward Scam
    8
  8. Fake Shopping
    8
  9. SEO Spam
    7
  10. Advance Fee Fraud
    6
  11. Tech Support Scam
    5
  12. Adware/PUP
    5

Top-level domains of malicious sites

Distinct malicious hostnames per TLD

  1. .dev
    1,796
  2. .app
    548
  3. .com
    351
  4. .ru
    59
  5. .se
    35
  6. .de
    34
  7. .org
    32
  8. .net
    26
  9. .io
    20
  10. .top
    20
  11. .br
    16
  12. .page
    13
  13. .uk
    13
  14. .nl
    11
  15. .pl
    10

Countries hosting the most malicious sites

Country of the hosting IP address. The second column leaves out shared CDN addresses, whose location is the network's, not the site's server.

CountryAll sitesExcl. CDN
🇺🇸 United States2,446151
🇩🇪 Germany22791
🇸🇬 Singapore226226
🇷🇺 Russia5252
🇳🇱 Netherlands4645
🇫🇷 France2928
🇧🇷 Brazil1918
🇧🇬 Bulgaria1414
🇬🇧 United Kingdom1313
🇮🇳 India1111
🇮🇹 Italy1110
🇪🇸 Spain1010
🇵🇱 Poland1010
🇻🇳 Vietnam88
🇨🇦 Canada74

Countries hosting the most malicious sites (own servers)

Sites not behind a shared CDN, by the country of their server

  1. 🇸🇬 Singapore
    226
  2. 🇺🇸 United States
    151
  3. 🇩🇪 Germany
    91
  4. 🇷🇺 Russia
    52
  5. 🇳🇱 Netherlands
    45
  6. 🇫🇷 France
    28
  7. 🇧🇷 Brazil
    18
  8. 🇧🇬 Bulgaria
    14
  9. 🇬🇧 United Kingdom
    13
  10. 🇮🇳 India
    11
  11. 🇪🇸 Spain
    10
  12. 🇮🇹 Italy
    10
  13. 🇵🇱 Poland
    10
  14. 🇻🇳 Vietnam
    8
  15. 🇩🇰 Denmark
    6

Cities hosting the most malicious sites

Sites not behind a shared CDN, by the city of their server. The city is known for 304 of 782 such sites.

  1. 🇳🇱 Amsterdam · Netherlands
    28
  2. 🇺🇸 Ashburn · United States
    24
  3. 🇩🇪 Frankfurt am Main · Germany
    23
  4. 🇩🇪 Falkenstein · Germany
    15
  5. 🇺🇸 Phoenix · United States
    14
  6. 🇧🇬 Sofia · Bulgaria
    12
  7. 🇺🇸 Manassas · United States
    10
  8. 🇫🇷 Lauterbourg · France
    9
  9. 🇷🇺 St Petersburg · Russia
    9
  10. 🇧🇷 Vinhedo · Brazil
    9
  11. 🇺🇸 Hillsboro · United States
    7
  12. 🇸🇬 Singapore · Singapore
    7
  13. 🇮🇹 Arezzo · Italy
    6
  14. 🇺🇸 Dallas · United States
    6
  15. 🇷🇺 Moscow · Russia
    6

Countries submitting the most URLs

Ranked by URLs submitted by people. Excludes ScanMalware's own automated scanning.

  1. 1.🇺🇸 United States
  2. 2.🇧🇷 Brazil
  3. 3.🇷🇺 Russia
  4. 4.🇨🇦 Canada
  5. 5.🇮🇳 India
  6. 6.🇸🇪 Sweden
  7. 7.🇮🇹 Italy
  8. 8.🇵🇸 Palestinian Territories
  9. 9.🇩🇪 Germany
  10. 10.🇫🇷 France
  11. 11.🇮🇷 Iran
  12. 12.🇲🇾 Malaysia
  13. 13.🇨🇿 Czechia
  14. 14.🇪🇸 Spain
  15. 15.🇬🇧 United Kingdom
  16. 16.🇮🇱 Israel
  17. 17.🇯🇵 Japan
  18. 18.🇱🇹 Lithuania
  19. 19.🇹🇷 Türkiye
  20. 20.🇨🇭 Switzerland

Site traffic

Counted from 2026-09-19 (UTC). Scan views and visitors count people only: search engines, other crawlers and automated clients are left out.

Most viewed scans

Public scan results ranked by the number of people who opened them

  1. 1.rokasetu.pages.devEvexaro
  2. 2.squidscript.comCloudflare Verification
  3. 3.dranivo1-dpvm9g02pa5i.edgeone.devDranivo
  4. 4.testtaskhub-dpw6esh4kz7x.edgeone.devLog In — TaskHub
  5. 5.psyrusec.comSign in to your account
  6. 6.padisahbet.yeni-koruma.icuIndex of /
  7. 7.security-server-landing-page--spencer-hunt1.replit.appSign in to your account
  8. 8.hasuncnc.pages.devRequest CNC Machining Quote | Hasun CNC
  9. 9.inmomirasol.comCloudflare Registrar
  10. 10.cedar-haven-5c7e.pages.devCloudflare Speed Test について | Cloudflare
  11. 11.govah-site.pages.devVous avez un projet, Govah vous connecte aux professionnels prêts à y répondre - Govah
  12. 12.zunmelo-mpt-belfuri-p5x1ka94.pages.devMeta for Business | Page Appeal
  13. 13.77dragon-games.pages.dev77Dragon | 🐉 Result Togel HK Hari Ini & Pengeluaran HK Prize
  14. 14.qorzuni-mpt-belfavi-p8x4me97.pages.devMeta for Business | Page Appeal
  15. 15.midone-template.pages.devValidation - Midone - Tailwind HTML Admin Template

Countries visitors come from

Ranked by the number of people visiting ScanMalware

  1. 1.🇺🇸 United States
  2. 2.🇧🇷 Brazil
  3. 3.🇸🇬 Singapore
  4. 4.🇦🇷 Argentina
  5. 5.🇨🇳 China
  6. 6.🇫🇷 France
  7. 7.🇲🇽 Mexico
  8. 8.🇹🇷 Türkiye
  9. 9.🇧🇩 Bangladesh
  10. 10.🇨🇱 Chile
  11. 11.🇮🇹 Italy
  12. 12.🇩🇪 Germany
  13. 13.🇬🇧 United Kingdom
  14. 14.🇨🇴 Colombia
  15. 15.🇪🇸 Spain
  16. 16.🇺🇦 Ukraine
  17. 17.🇨🇦 Canada
  18. 18.🇪🇨 Ecuador
  19. 19.🇵🇱 Poland
  20. 20.🇳🇱 Netherlands

Most requested domains via the API

Domain and subdomain lookups (certificate and host APIs)

  1. example.com
    9,567
  2. memphismarine.com
    9,172
  3. mariapps.in
    9,172
  4. smartpal.ai
    9,172
  5. oceanai.ai
    9,172
  6. cruisepal.com
    9,172
  7. seamedix.com
    9,171
  8. oceanopt.ai
    9,171
  9. cosmos.windows-int.net
    6,848
  10. acme.dk
    4,612
  11. e2e.test
    4,299
  12. msb.com.vn
    4,154
  13. hackerone.com
    4,119
  14. indeed.com
    3,441
  15. braintree-api.com
    3,203

Most requested registered domains via the API

Lookups grouped by registered domain; hover for how many names were looked up

  1. deere.com
    220,794
  2. bmwgroup.com
    194,691
  3. bmw.com
    120,400
  4. wjunction.com
    58,759
  5. zoho.com
    50,425
  6. magento.com
    45,160
  7. kpmg.com
    37,969
  8. onehousing.com.vn
    36,948
  9. google.com
    33,677
  10. att.com
    30,013
  11. tamu.edu
    25,571
  12. usiminas.com
    25,064
  13. eldoradobrasil.com.br
    24,831
  14. binus.ac.id
    24,031
  15. edgeone.dev
    22,057

Busiest API endpoints

API requests by endpoint (our own systems excluded)

  1. /api/v1/search/smql
    10,009,435
  2. /api/v1/ct/dns/{host}
    10,002,929
  3. /api/v1/hosts/{host}
    9,991,035
  4. /api/v1/rdap/{id}
    37,602
  5. /api/v1/ct/{host}
    34,680
  6. /api/v1/domain/stats/{host}
    33,607
  7. /api/v1/domains/{host}/scans
    33,465
  8. /api/v1/ct/dns/{x}
    31,582
  9. /api/v1/hosts/{x}
    31,548
  10. /api/v1/domain/history/{host}
    31,195
  11. /api/v1/tls/{id}
    30,502
  12. /api/v1/result/{id}
    29,691
  13. /api/v1/jarm/scan/{id}
    29,643
  14. /api/v1/favicon/{id}
    24,704
  15. /api/v1/ioc/{id}
    22,343

JavaScript

Scripts loaded by the 11,336 websites scanned in the last 7 days, counted as the number of distinct websites. Third-party means the script comes from a different registered domain than the page.

Most popular libraries and frameworks

Websites where the library or framework was detected

  1. jQuery · JavaScript library
    3,635
  2. React · JavaScript framework
    624
  3. jQuery UI · JavaScript library
    378
  4. Bootstrap · UI framework
    307
  5. Swiper · JavaScript library
    285
  6. OWL Carousel · JavaScript library
    274
  7. Vue.js · JavaScript framework
    234
  8. Lightbox · JavaScript library
    227
  9. Moment.js · JavaScript library
    139
  10. RequireJS · JavaScript framework
    111
  11. Tailwind CSS · UI framework
    107
  12. Lodash · JavaScript library
    104
  13. Nuxt.js · JavaScript framework
    100
  14. Stimulus · JavaScript framework
    84
  15. AMP · JavaScript framework
    84

Most used third-party script providers

Registered domain serving the script

  1. googletagmanager.com
    3,622
  2. cloudflare.com
    2,579
  3. google.com
    1,682
  4. yandex.ru
    1,514
  5. facebook.net
    1,156
  6. google-analytics.com
    1,072
  7. doubleclick.net
    957
  8. gstatic.com
    918
  9. jsdelivr.net
    804
  10. yastatic.net
    755
  11. mail.ru
    602
  12. googlesyndication.com
    591
  13. ajax.googleapis.com
    484
  14. cloudflareinsights.com
    454
  15. clarity.ms
    424

Most loaded third-party scripts

Script URL without its query string

  1. www.googletagmanager.com/gtag/js
    3,293
  2. www.googletagmanager.com/gtm.js
    1,774
  3. challenges.cloudflare.com/turnstile/v0/api.js
    1,557
  4. mc.yandex.ru/metrika/tag.js
    1,202
  5. challenges.cloudflare.com/turnstile/v0/b/d76008a69eab/api.js
    1,128
  6. connect.facebook.net/en_US/fbevents.js
    981
  7. www.google-analytics.com/analytics.js
    942
  8. challenges.cloudflare.com/turnstile/v0/g/330e41bb475c/api.js
    858
  9. yastatic.net/safeframe-bundles/0.89/host.js
    569
  10. privacy-cs.mail.ru/static/sync-loader.js
    558
  11. yandex.ru/ads/system/context.js
    533
  12. top-fwz1.mail.ru/js/code.js
    521
  13. top-fwz1.mail.ru/js/dyn-goal-config.js
    501
  14. www.google.com/recaptcha/api.js
    473
  15. pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
    456

Most common first-party scripts

Script path served from the website's own domain

  1. /wp-includes/js/jquery/jquery.min.js
    1,166
  2. /wp-includes/js/jquery/jquery-migrate.min.js
    1,006
  3. /wp-includes/js/wp-emoji-release.min.js
    867
  4. /wp-includes/js/dist/hooks.min.js
    502
  5. /wp-includes/js/dist/i18n.min.js
    492
  6. /wp-includes/js/jquery/ui/core.min.js
    405
  7. /_next/static/chunks/* (30 files)
    322
  8. /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
    315
  9. /wp-content/plugins/elementor/assets/js/* (3 files)
    289
  10. /cdn-cgi/challenge-platform/h/g/scripts/jsd/330e41bb475c/main.js
    288
  11. /sw.js
    276
  12. /cdn-cgi/challenge-platform/h/b/scripts/jsd/d76008a69eab/main.js
    272
  13. /wp-content/plugins/contact-form-7/includes/js/index.js
    239
  14. /_next/static/chunks/polyfills-42372ed130431b0a.js
    236
  15. /wp-content/plugins/contact-form-7/includes/swv/js/index.js
    230

TLS server fingerprints

JARM and JA4S describe how a web server answers a TLS connection; servers running the same software and configuration share a fingerprint. Counted as distinct websites. The malicious rankings order fingerprints by the share of their websites that were malicious (at least 10 websites, 5 of them malicious). JA4S is recorded since 23 September 2026.

Most common JARM fingerprints

FingerprintUsual networkSitesMalicious
27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.3,2991,416 (43%)
27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525cCloudflare, Inc.2,739560 (20%)
29d29d00029d29d00041d41d00041db78309d03c04b7072bacbf1ce396279bAmazon.com, Inc.1,50663 (4%)
3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fbAmazon.com, Inc.1,443541 (37%)
2ad2ad0002ad2ad22c42d42d0000008a5941c13f67e0c0a2c8a36bfeef6920ACE1,117217 (19%)
40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319Amazon.com, Inc.736156 (21%)
27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.67052 (8%)
2ad2ad0002ad2ad00042d42d0000002059a3b916699461c5923779b77cf06bAkamai International B.V.50337 (7%)
27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36cGoogle LLC40654 (13%)
29d3fd00029d29d00042d43d00041d6f940079659edb62e1c38c38bd26ee84Google LLC38965 (17%)
29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36cFastly, Inc.37338 (10%)
29d29d00029d29d00042d42d0000002059a3b916699461c5923779b77cf06bYandex.Cloud LLC32320 (6%)
29d29d00029d29d00041d41d0000005d86ccb1a0567e012264097a0315d7a7Incapsula Inc31112 (4%)
29d29d00029d29d21c41d41d00041d38d8d683f08c154e73a9de64943d64e4Amazon.com, Inc.29926 (9%)
29d29d27d29d29d00041d41d0000000e5f541a0cc9dda3c8432ea5f8815abdLLC VK2760 (0%)

JARM fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
2ad2ad0002ad2ad00042d42d0000004730e1a02fb93a679b09eac9e25c22fcStrato GmbH1818 (100%)
29d29d15d29d29d00042d42d0000006a78f6757b72f02e234bb3f6d2d5740bNew Dream Network, LLC2413 (54%)
27d40d40d00040d1dc42d43d00041d5691268beec3bcca1d5ab3aacc89645fCloudflare, Inc.13470 (52%)
27d27d27d00027d00042d42d0000005631adf8cfd24423913fd470a749070fYelles AB189 (50%)
28d28d28d2ad28d1dc42d42d00042ded961c16c68658e95145597cf992c36cGoogle LLC3215 (47%)
27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.3,2991,416 (43%)
28d28d28d00028d00042d42d000000aa5feb68b57d31b6dc713b6917a988e3OVH SAS2611 (42%)
29d29d15d29d29d00042d42d000000cd600c085f371f8533aaf66051f8e5b1Oracle Corporation11042 (38%)
3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fbAmazon.com, Inc.1,443541 (37%)
27d27d27d0000001dc41d43d00041d1c5ac8aa552261ba8fd1aa9757c06fa5Cloudflare, Inc.238 (35%)
3fd3fd0003fd3fd21c42d42d000000bdfc58c9a46434368cf60aa440385763Tencent Building, Kejizhongyi Avenue3211 (34%)
15d3fd16d29d29d00042d43d0000007cad75e0049912dcaa3fad94e678d707Contabo GmbH3411 (32%)
27d27d27d29d27d1dc42d42d0000000f0f2ea251d805c4640f820a3394a07aAlibaba (US) Technology Co., Ltd.196 (32%)
15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9bAmazon.com, Inc.6921 (30%)
29d29d15d29d29d00042d42d00000072e74222ce193a6f991becaa3da6c94dAmazon.com, Inc.216 (29%)

Most common JA4S fingerprints

FingerprintUsual networkSitesMalicious
t130200_1302_234ea6891581Cloudflare, Inc.4,9241,155 (23%)
t130200_1302_a56c5b993250ACE4,159265 (6%)
t130200_1301_a56c5b993250Amazon.com, Inc.2,07890 (4%)
t130200_1303_a56c5b993250Amazon.com, Inc.1,601409 (26%)
t1206h2_c02f_3603f09c43baAmazon.com, Inc.1715 (3%)
t1207h2_c030_b948729f6510GoDaddy.com, LLC916 (7%)
t1207h2_c02f_b948729f6510EdgeCenter LLC775 (6%)
t1207h1_c02f_b948729f6510YANDEX LLC751 (1%)
t1207h1_c030_b948729f6510LLC VK551 (2%)
t1206h2_c02b_3f14cc51fb76Cloudflare, Inc.505 (10%)
t130200_1301_234ea6891581SiteVision AB401 (3%)
t1207h2_cca8_b948729f6510LLC VK380 (0%)
t120300_c02f_460f64128655AS400246341 (3%)
t1206h2_c02f_3f14cc51fb76Fastly, Inc.332 (6%)
t1207h2_c02c_b948729f6510Akamai Technologies, Inc.323 (9%)

JA4S fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
t130200_1303_a56c5b993250Amazon.com, Inc.1,601409 (26%)
t130200_1302_234ea6891581Cloudflare, Inc.4,9241,155 (23%)
t1206h2_c02b_3f14cc51fb76Cloudflare, Inc.505 (10%)
t1207h2_c030_b948729f6510GoDaddy.com, LLC916 (7%)
t1207h2_c02f_b948729f6510EdgeCenter LLC775 (6%)
t130200_1302_a56c5b993250ACE4,159265 (6%)
t130200_1301_a56c5b993250Amazon.com, Inc.2,07890 (4%)
t1206h2_c02f_3603f09c43baAmazon.com, Inc.1715 (3%)

A scan counts as malicious when our AI verdict rates it Confirmed scam or High risk, or our rule-based verdict rates it Malicious. Threat statistics cover all public scans; the submitting-country ranking covers URLs submitted by people and excludes ScanMalware's own automated scanning. Unlisted and private scans are never shown individually. Refreshed every 10–60 minutes depending on the window · generated 2026-09-26 01:20 UTC.