C2 Servers by Country
Command-and-control servers, payload hosts and other attacker-run infrastructure. On 2026-10-11, 588 C2 servers were flagged in 51 countries, 3% of all flagged IPv4 networks on the map. The United States has the most in absolute terms (126). Relative to allocated IPv4 space, Hong Kong SAR China ranks highest with 4.71 per million addresses. The network hosting the most is CTGSERVERLIMITED-AS-AP - CTG Server Limited (AS152194) with 33. Snapshot of (UTC), updated daily.
Which countries have the most C2 servers?
Top 10 on 2026-10-11.
By flagged networks
- 1.United States126
- 2.Hong Kong SAR China76
- 3.Netherlands67
- 4.Germany46
- 5.Singapore40
- 6.Japan30
- 7.France23
- 8.China22
- 9.Brazil19
- 10.United Kingdom12
Per million allocated IPv4 addresses
- 1.Hong Kong SAR China4.71
- 2.Singapore1.43
- 3.Netherlands1.33
- 4.Germany0.36
- 5.France0.28
- 6.Japan0.16
- 7.United States0.08
- 8.China0.06
Map of C2 servers by country
Flagged networks per million IPv4 addresses allocated to the country by its RIR. Absolute counts mostly show where the large hosting and data center networks are; the rate shows how much of a country's address space is involved. Countries with less than 262,144 allocated addresses or fewer than 20 flagged networks get no rate.
Countries (C2)
51 countries with flagged networks. Select a column to sort.
| # | ||||
|---|---|---|---|---|
| 1 | Hong Kong SAR China | 76 | 4.71 | 16,120,640 |
| 2 | Singapore | 40 | 1.43 | 27,934,784 |
| 3 | Netherlands | 67 | 1.33 | 50,365,216 |
| 4 | Germany | 46 | 0.36 | 126,529,152 |
| 5 | France | 23 | 0.28 | 82,274,128 |
| 6 | Japan | 30 | 0.16 | 189,009,472 |
| 7 | United States | 126 | 0.08 | 1,616,471,456 |
| 8 | China | 22 | 0.06 | 342,984,448 |
| 9 | India | 5 | - | 42,040,064 |
| 10 | South Korea | 7 | - | 112,514,816 |
| 11 | Brazil | 19 | - | 81,826,304 |
| 12 | Russia | 12 | - | 45,344,832 |
| 13 | Indonesia | 2 | - | 19,397,888 |
| 14 | Vietnam | 2 | - | 16,502,272 |
| 15 | United Kingdom | 12 | - | 141,818,368 |
| 16 | Canada | 9 | - | 68,507,392 |
| 17 | Argentina | 1 | - | 19,440,384 |
| 18 | Ukraine | 3 | - | 9,190,144 |
| 19 | Taiwan | 1 | - | 36,705,792 |
| 20 | Poland | 7 | - | 20,053,960 |
| 21 | Italy | 1 | - | 54,244,992 |
| 22 | Sweden | 4 | - | 31,598,112 |
| 23 | Philippines | 1 | - | 6,268,480 |
| 24 | Australia | 1 | - | 48,445,504 |
| 25 | Türkiye | 4 | - | 16,832,192 |
| 26 | South Africa | 1 | - | 27,184,896 |
| 27 | Ireland | 1 | - | 10,318,912 |
| 28 | Malaysia | 5 | - | 6,700,800 |
| 29 | Spain | 2 | - | 32,240,256 |
| 30 | Thailand | 5 | - | 8,933,120 |
| 31 | United Arab Emirates | 1 | - | 7,351,296 |
| 32 | Finland | 7 | - | 13,988,928 |
| 33 | Israel | 3 | - | 8,062,080 |
| 34 | Bulgaria | 3 | - | 4,345,152 |
| 35 | Romania | 7 | - | 7,852,416 |
| 36 | Switzerland | 4 | - | 23,296,112 |
| 37 | Lithuania | 4 | - | 4,133,376 |
| 38 | Czechia | 3 | - | 9,598,912 |
| 39 | Moldova | 7 | - | 1,261,568 |
| 40 | Georgia | 1 | - | 1,310,784 |
| 41 | Norway | 1 | - | 15,630,352 |
| 42 | Austria | 2 | - | 11,197,792 |
| 43 | Latvia | 2 | - | 1,851,136 |
| 44 | Luxembourg | 1 | - | 1,850,368 |
| 45 | Estonia | 1 | - | 1,349,160 |
| 46 | Seychelles | 1 | - | 9,288,704 |
| 47 | Panama | 1 | - | 2,188,800 |
| 48 | Slovenia | 1 | - | 2,685,696 |
| 49 | Belarus | 1 | - | 1,793,536 |
| 50 | Belize | 1 | - | 134,656 |
| 51 | Andorra | 1 | - | 62,720 |
Networks hosting the most C2 servers
Autonomous systems announcing the most IPv4 networks flagged as C2 servers. Large hosting providers appear here because attackers rent their servers, not necessarily because of the operator.
| # | Network | Country | Flagged networks |
|---|---|---|---|
| 1 | AS152194CTGSERVERLIMITED-AS-AP - CTG Server Limited | HK | 33 |
| 2 | AS132203TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue | CN | 23 |
| 3 | AS45102ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd. | HK | 19 |
| 4 | AS20473AS-VULTR - The Constant Company, LLC | US | 13 |
| 5 | AS399629BLNWX - BL Networks | US | 10 |
| 6 | AS36352AS-COLOCROSSING - HostPapa | US | 9 |
| 7 | AS207043DEDIK-IO DEDIK SERVICES LIMITED | GB | 8 |
| 8 | AS9009M247 M247 Europe SRL | RO | 8 |
| 9 | AS14061DIGITALOCEAN-ASN - DigitalOcean, LLC | US | 8 |
| 10 | AS24940HETZNER-AS Hetzner Online GmbH | DE | 8 |
Other threat categories
Frequently Asked Questions
- Which country has the most C2 servers?
- In the snapshot of 2026-10-11, the United States has the most C2 servers in absolute terms (126 flagged networks), followed by Hong Kong SAR China (76). Per million allocated IPv4 addresses, Hong Kong SAR China ranks first (4.71). Absolute counts mostly follow where large hosting networks are; the rate shows how much of a country's address space is involved.
- What is a C2 server?
- Command-and-control servers, payload hosts and other attacker-run infrastructure.
- How are C2 servers counted on this map?
- Flagged addresses are counted as /24 networks: all listed addresses within one /24 count once, and larger ranges count as a single /24. A network listed in several categories is counted once, in the most specific category (C2 before phishing, botnet, brute force, spam, scanner and other malicious activity), so the categories add up to the country total. Address space that is not announced in BGP is left out.
- How often is the data updated?
- Once a day. Every snapshot uses the listings that are active on that day, aggregated from multiple external and internal threat intelligence sources; listings that are no longer reported drop out of the next snapshot.
Check a single IP via the API
The same threat intelligence is available for every address: threat categories, reputation score, ASN and geolocation in one JSON response.