Global Threat Map

Frequently Asked Questions

Which country has the most malicious IP addresses?

In the snapshot of 2026-10-11, the United States has the most flagged IPv4 networks in absolute terms (2,611), followed by China and India. Relative to the IPv4 address space allocated to each country, Iraq ranks highest with 144 flagged networks per million addresses, ahead of Uzbekistan and Bangladesh. Absolute counts mostly follow where large hosting and data center networks are, so both rankings are shown.

Is the threat map live?

No. It is a daily snapshot of where flagged infrastructure is located, not a live feed of attacks in progress. Every snapshot uses the threat listings that are active on that day; listings that are no longer reported drop out of the next one. The date of the current snapshot is shown at the top of the page.

How often is the threat map updated?

Once a day, in the early morning (UTC). The map, the country pages and the category pages switch to the new snapshot within a few hours.

What does per million IPv4 addresses mean?

Absolute counts mostly show where the large hosting and data center networks are: countries with a lot of address space and cloud capacity always rank first. Dividing a country's flagged networks by the IPv4 space allocated to it by its Regional Internet Registry (AFRINIC, APNIC, ARIN, LACNIC or RIPE NCC) shows how much of that space is involved in malicious activity. Countries with very little address space get no rate.

What is a C2 server?

A command-and-control (C2) server is a machine attackers use to send commands to malware and botnets and to collect stolen data. On the map the C2 category also includes payload hosts and other attacker-run infrastructure, and it takes precedence over all other categories.

Where does the threat map data come from?

The map is aggregated from multiple external and internal threat intelligence sources that ipctl.io collects for its IP reputation API. Every listing that is currently active is placed in a country by IP geolocation and attributed to the network (ASN) that announces it in BGP.

How are IP addresses and ranges counted?

Flagged networks are counted as /24 blocks (IPv6: /64): all listed addresses within one /24 count once, and ranges larger than a /24 count as a single /24, so neither one large entry nor a list that names a whole range address by address can dominate a country. A network listed in several categories is counted once, in the most specific category (C2 before phishing, botnet, brute force, spam, scanner and other malicious activity). Address space that is not announced in BGP is left out.

Does a high rank mean a country is responsible for the attacks?

No. The map shows where flagged infrastructure is located, not who operates it. Attackers rent servers in other countries and use compromised machines anywhere, and geolocation places an address where it is used, which can differ from the country of registration.

Can I check a single IP address against this data?

Yes. The ipctl.io API returns the threat categories, a reputation score, the ASN and the geolocation for any IPv4 or IPv6 address, and the free IP reputation tool on this site does the same in the browser.