Scanners by Country
Hosts scanning or probing services on the internet. On 2026-10-11, 655 scanners were flagged in 40 countries, 4% of all flagged IPv4 networks on the map. The United States has the most in absolute terms (211). Relative to allocated IPv4 space, Belgium ranks highest with 4.05 per million addresses. The network hosting the most is GOOGLE-CLOUD-PLATFORM - Google LLC (AS396982) with 314. Snapshot of (UTC), updated daily.
Which countries have the most scanners?
Top 10 on 2026-10-11.
By flagged networks
- 1.United States211
- 2.Netherlands51
- 3.Belgium50
- 4.Germany41
- 5.Canada28
- 6.United Kingdom28
- 7.Singapore28
- 8.Brazil24
- 9.Japan24
- 10.Hong Kong SAR China19
Per million allocated IPv4 addresses
- 1.Belgium4.05
- 2.Netherlands1.01
- 3.Singapore1.00
- 4.Canada0.41
- 5.Germany0.32
- 6.Brazil0.29
- 7.United Kingdom0.20
- 8.United States0.13
- 9.Japan0.13
Map of scanners by country
Flagged networks per million IPv4 addresses allocated to the country by its RIR. Absolute counts mostly show where the large hosting and data center networks are; the rate shows how much of a country's address space is involved. Countries with less than 262,144 allocated addresses or fewer than 20 flagged networks get no rate.
Countries (Scanner)
40 countries with flagged networks. Select a column to sort.
| # | ||||
|---|---|---|---|---|
| 1 | Belgium | 50 | 4.05 | 12,351,104 |
| 2 | Netherlands | 51 | 1.01 | 50,365,216 |
| 3 | Singapore | 28 | 1.00 | 27,934,784 |
| 4 | Canada | 28 | 0.41 | 68,507,392 |
| 5 | Germany | 41 | 0.32 | 126,529,152 |
| 6 | Brazil | 24 | 0.29 | 81,826,304 |
| 7 | United Kingdom | 28 | 0.20 | 141,818,368 |
| 8 | United States | 211 | 0.13 | 1,616,471,456 |
| 9 | Japan | 24 | 0.13 | 189,009,472 |
| 10 | China | 13 | - | 342,984,448 |
| 11 | India | 18 | - | 42,040,064 |
| 12 | South Korea | 13 | - | 112,514,816 |
| 13 | Hong Kong SAR China | 19 | - | 16,120,640 |
| 14 | Russia | 1 | - | 45,344,832 |
| 15 | Pakistan | 3 | - | 5,681,664 |
| 16 | Indonesia | 11 | - | 19,397,888 |
| 17 | France | 14 | - | 82,274,128 |
| 18 | Ukraine | 3 | - | 9,190,144 |
| 19 | Taiwan | 16 | - | 36,705,792 |
| 20 | Poland | 1 | - | 20,053,960 |
| 21 | Italy | 3 | - | 54,244,992 |
| 22 | Sweden | 4 | - | 31,598,112 |
| 23 | Philippines | 1 | - | 6,268,480 |
| 24 | Australia | 16 | - | 48,445,504 |
| 25 | Mexico | 3 | - | 29,033,984 |
| 26 | Spain | 1 | - | 32,240,256 |
| 27 | Thailand | 3 | - | 8,933,120 |
| 28 | Iran | 2 | - | 10,866,176 |
| 29 | Finland | 6 | - | 13,988,928 |
| 30 | Egypt | 1 | - | 24,152,832 |
| 31 | Bulgaria | 2 | - | 4,345,152 |
| 32 | Romania | 1 | - | 7,852,416 |
| 33 | Switzerland | 7 | - | 23,296,112 |
| 34 | Uzbekistan | 2 | - | 336,128 |
| 35 | Lithuania | 1 | - | 4,133,376 |
| 36 | Czechia | 1 | - | 9,598,912 |
| 37 | Morocco | 1 | - | 12,274,176 |
| 38 | Greece | 1 | - | 5,725,056 |
| 39 | Isle of Man | 1 | - | 135,680 |
| 40 | Monaco | 1 | - | 65,792 |
Networks hosting the most scanners
Autonomous systems announcing the most IPv4 networks flagged as scanners. Large hosting providers appear here because attackers rent their servers, not necessarily because of the operator.
| # | Network | Country | Flagged networks |
|---|---|---|---|
| 1 | AS396982GOOGLE-CLOUD-PLATFORM - Google LLC | US | 314 |
| 2 | AS14061DIGITALOCEAN-ASN - DigitalOcean, LLC | US | 80 |
| 3 | AS8075MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation | US | 42 |
| 4 | AS15169GOOGLE - Google LLC | US | 27 |
| 5 | AS13335CLOUDFLARENET - Cloudflare, Inc. | US | 15 |
| 6 | AS19527GOOGLE-2 - Google LLC | US | 15 |
| 7 | AS4837CHINA169-BACKBONE CHINA UNICOM China169 Backbone | CN | 10 |
| 8 | AS43515YOUTUBE Google Ireland Limited | IE | 8 |
| 9 | AS26548PUREVOLTAGE-INC - PureVoltage Hosting Inc. | US | 7 |
| 10 | AS213954GTS-AS Global Transit Systems LLC | US | 6 |
Other threat categories
Frequently Asked Questions
- Which country has the most scanners?
- In the snapshot of 2026-10-11, the United States has the most scanners in absolute terms (211 flagged networks), followed by the Netherlands (51). Per million allocated IPv4 addresses, Belgium ranks first (4.05). Absolute counts mostly follow where large hosting networks are; the rate shows how much of a country's address space is involved.
- What is a scanner?
- Hosts scanning or probing services on the internet.
- How are scanners counted on this map?
- Flagged addresses are counted as /24 networks: all listed addresses within one /24 count once, and larger ranges count as a single /24. A network listed in several categories is counted once, in the most specific category (C2 before phishing, botnet, brute force, spam, scanner and other malicious activity), so the categories add up to the country total. Address space that is not announced in BGP is left out.
- How often is the data updated?
- Once a day. Every snapshot uses the listings that are active on that day, aggregated from multiple external and internal threat intelligence sources; listings that are no longer reported drop out of the next snapshot.
Check a single IP via the API
The same threat intelligence is available for every address: threat categories, reputation score, ASN and geolocation in one JSON response.