Live threat map
Where active attacker infrastructure is hosted, right now.
Active botnet command-and-control servers, grouped by hosting country. Refreshed every 15 minutes from a public feed. Hover a marker for detail.
Hosts tracked
-
Countries
-
Top country
-
Last updated
-
By country
Top hosting locations
| Country | Hosts | Families |
|---|
Source
Data comes from the upstream feed. Markers show where attacker infrastructure is hosted - not the location of the people operating it, and not attacks against RTA or its clients. Arcs are an illustrative rendering of that infrastructure relative to our coverage region, not captured traffic.