Global Threat Feed

Indicators of compromise mirrored from public reputation feeds. We surface aggregate counts only — individual phishing URLs are never listed. Matched against every IP, prefix, country and TLD across the site.

Unsolicited traffic hitting our distributed sensors — services no legitimate client should ever reach. A clean, high-signal view of what is actively being scanned and exploited in the wild.

The most frequent HTTP exploit attempts our sensors observe — IoT RCE, command injection, webshell drops and CVE probes. Request targets are shown; sensor addresses are redacted.