GHOSTNET

Live intel

Every countable capture. Loopback and RFC1918 are excluded as local tests; rows whose country never resolved are still counted.

76,769
Medium
17,783
High
3,327
Low
633
Critical
Hottest origin · France

Where The Knocks Come From

Every geolocated incursion, binned by volume. Origin is where the packets entered from — not who sent them. Rotating an address moves a dot on this map; it does not clear the client signature underneath it.

Top Origin
France
42,033 incursions · 43% of traffic
Countries Seen
135
distinct origins on record
Top 3 Concentration
71%
of all traffic from 3 origins
Fiji — none seenTanzania — none seenW. Sahara — none seenCanada — 705 incursionsUnited States — 10,847 incursionsKazakhstan — 87 incursionsUzbekistan — 85 incursionsPapua New Guinea — none seenIndonesia — 375 incursionsArgentina — 110 incursionsChile — 56 incursionsDem. Rep. Congo — none seenSomalia — none seenKenya — 3 incursionsSudan — none seenChad — none seenHaiti — none seenDominican Republic — 7 incursionsRussia — 345 incursionsBahamas — none seenFalkland Is. — none seenNorway — 523 incursionsGreenland — none seenFr. S. Antarctic Lands — none seenTimor-Leste — none seenSouth Africa — 24 incursionsLesotho — none seenMexico — 87 incursionsUruguay — 7 incursionsBrazil — 274 incursionsBolivia — 29 incursionsPeru — 188 incursionsColombia — 21 incursionsPanama — 6 incursionsCosta Rica — 2 incursionsNicaragua — 3 incursionsHonduras — none seenEl Salvador — 1 incursionsGuatemala — 1 incursionsBelize — none seenVenezuela — 19 incursionsGuyana — none seenSuriname — none seenFrance — 42,033 incursionsEcuador — 15 incursionsPuerto Rico — none seenJamaica — 2 incursionsCuba — none seenZimbabwe — none seenBotswana — none seenNamibia — none seenSenegal — 7 incursionsMali — none seenMauritania — none seenBenin — none seenNiger — none seenNigeria — 22 incursionsCameroon — 3 incursionsTogo — none seenGhana — none seenCôte d'Ivoire — none seenGuinea — none seenGuinea-Bissau — none seenLiberia — none seenSierra Leone — none seenBurkina Faso — none seenCentral African Rep. — none seenCongo — none seenGabon — none seenEq. Guinea — none seenZambia — none seenMalawi — none seenMozambique — 3 incursionseSwatini — none seenAngola — none seenBurundi — none seenIsrael — 6 incursionsLebanon — 1 incursionsMadagascar — none seenPalestine — none seenGambia — none seenTunisia — 7 incursionsAlgeria — 14 incursionsJordan — 2 incursionsUnited Arab Emirates — 28 incursionsQatar — 1 incursionsKuwait — 1 incursionsIraq — 5 incursionsOman — 6 incursionsVanuatu — none seenCambodia — 14 incursionsThailand — 63 incursionsLaos — 2 incursionsMyanmar — 13 incursionsVietnam — 218 incursionsNorth Korea — none seenSouth Korea — 446 incursionsMongolia — 1 incursionsIndia — 410 incursionsBangladesh — 24 incursionsBhutan — none seenNepal — 7 incursionsPakistan — 91 incursionsAfghanistan — none seenTajikistan — 1 incursionsKyrgyzstan — 3 incursionsTurkmenistan — none seenIran — 140 incursionsSyria — 3 incursionsArmenia — 26 incursionsSweden — 236 incursionsBelarus — 7 incursionsUkraine — 313 incursionsPoland — 40 incursionsAustria — 9 incursionsHungary — 691 incursionsMoldova — 24 incursionsRomania — 13 incursionsLithuania — 50 incursionsLatvia — 34 incursionsEstonia — 5 incursionsGermany — 3,553 incursionsBulgaria — 491 incursionsGreece — 11 incursionsTurkey — 590 incursionsAlbania — 2 incursionsCroatia — 3 incursionsSwitzerland — 90 incursionsLuxembourg — 5 incursionsBelgium — 3,266 incursionsNetherlands — 16,678 incursionsPortugal — 11 incursionsSpain — 43 incursionsIreland — 10 incursionsNew Caledonia — none seenSolomon Is. — none seenNew Zealand — 1 incursionsAustralia — 59 incursionsSri Lanka — 2 incursionsChina — 1,134 incursionsTaiwan — 1,516 incursionsItaly — 165 incursionsDenmark — 2 incursionsUnited Kingdom — 5,522 incursionsIceland — 108 incursionsAzerbaijan — 10 incursionsGeorgia — 15 incursionsPhilippines — 63 incursionsMalaysia — 25 incursionsBrunei — none seenSlovenia — 66 incursionsFinland — 58 incursionsSlovakia — 2 incursionsCzech Republic — 167 incursionsEritrea — none seenJapan — 852 incursionsParaguay — 4 incursionsYemen — none seenSaudi Arabia — 15 incursionsAntarctica — none seenN. Cyprus — none seenCyprus — 4 incursionsMorocco — 13 incursionsEgypt — 46 incursionsLibya — 2 incursionsEthiopia — 11 incursionsDjibouti — none seenSomaliland — none seenUganda — none seenRwanda — none seenBosnia and Herz. — none seenNorth Macedonia — 2 incursionsSerbia — 2 incursionsMontenegro — none seenKosovo — none seenTrinidad and Tobago — none seenS. Sudan — none seen
Incursions
none
1
2–4
5–9
10–24
25–49
50+

108 of 135 origins have a drawable border on the world topology. Ranked in full below, including Singapore, Hong Kong, Andorra, Seychelles….

Origin LeaderboardTOP 12 OF 135
01
France
42,033
02
Netherlands
16,678
03
United States
10,847
04
United Kingdom
5,522
05
Germany
3,553
06
Belgium
3,266
07
Singapore
3,132
08
Taiwan
1,516
09
China
1,134
10
Hong Kong
1,038
11
Japan
852
12
Andorra
813
SourceCountrySeverityCategoryClient familySensorSeen
35.203.210.xUnited Kingdom Medium Automated Scannergeneric decoy:15212026-10-17 09:57:01
210.89.37.xIndia Low Automated Scannergeneric decoy:232026-10-17 09:55:32
162.216.150.xUnited States Low Automated Scannergeneric decoy:212026-10-17 09:42:10
77.67.26.xHong Kong Medium Service Discoveryhttp redirect:802026-10-17 09:39:04
200.138.46.xBrazil Medium Service Discoveryhttp redirect:802026-10-17 09:39:04
77.67.26.xHong Kong Medium Service Discoveryhttp redirect:802026-10-17 09:39:04
64.205.72.xUnited States Medium Service Discoveryhttp redirect:802026-10-17 09:39:04
147.185.132.xUnited States Medium Automated Scannergeneric decoy:232026-10-17 09:35:45
176.65.132.xThe Netherlands Medium Automated Scannergeneric decoy:270172026-10-17 09:30:21
176.65.132.xThe Netherlands Medium Automated Scannergeneric decoy:270172026-10-17 09:30:08
176.65.132.xThe Netherlands Medium Automated Scannergeneric decoy:270172026-10-17 09:30:08
176.65.132.xThe Netherlands Medium Automated Scannergeneric decoy:270172026-10-17 09:30:04
176.65.132.xThe Netherlands Medium Automated Scannergeneric decoy:270172026-10-17 09:29:41
147.185.132.xUnited States Low Automated Scannergeneric decoy:232026-10-17 09:26:22
157.230.18.xGermany Medium Unclassified Probehttp redirect:802026-10-17 09:10:48
157.230.18.xGermany Medium Unclassified Probehttp redirect:802026-10-17 09:10:48
157.230.18.xGermany Medium Unclassified Probehttp redirect:802026-10-17 09:10:48
157.230.18.xGermany High Credential Harvestinghttp redirect:802026-10-17 09:09:29
64.89.163.xGermany Medium Automated Scannergeneric decoy:54322026-10-17 09:00:06
23.94.145.xUnited States Medium Unclassified Probehttp api:80002026-10-17 08:56:01
23.94.145.xUnited States Medium Unclassified Probehttp api:80002026-10-17 08:55:57
23.94.145.xUnited States Medium Unclassified Probehttp api:80002026-10-17 08:55:54
23.94.145.xUnited States Medium Unclassified Probehttp api:80002026-10-17 08:55:50
23.94.145.xUnited States Medium Service Discoveryhttp api:80002026-10-17 08:55:21
23.94.145.xUnited States Medium Unclassified Probehttp redirect:80802026-10-17 08:55:19
23.94.145.xUnited States Medium Unclassified Probehttp redirect:80802026-10-17 08:55:19
23.94.145.xUnited States Medium Unclassified Probehttp redirect:80802026-10-17 08:55:18
23.94.145.xUnited States Medium Unclassified Probehttp redirect:80802026-10-17 08:55:18
23.94.145.xUnited States Medium Unclassified Probehttp redirect:80802026-10-17 08:55:17
23.94.145.xUnited States Medium Service Discoveryhttp redirect:80802026-10-17 08:55:17
23.94.145.xUnited States Medium Unclassified Probehttp api:80002026-10-17 08:55:46
103.217.152.xIndia Medium Automated Scannergeneric decoy:4452026-10-17 08:53:55
31.56.58.xFrance Medium Unclassified Probehttp static:84432026-10-17 08:29:54
139.59.105.xSingapore Medium Unclassified Probehttp static:84432026-10-17 08:27:20
139.59.105.xSingapore Medium Unclassified Probehttp static:84432026-10-17 08:27:18
139.59.105.xSingapore Medium Unclassified Probehttp static:84432026-10-17 08:27:18
139.59.105.xSingapore Medium Unclassified Probehttp static:84432026-10-17 08:27:17
139.59.105.xSingapore Medium Unclassified Probehttp static:84432026-10-17 08:27:15
162.158.110.xGermany High Admin Surface Probehttp redirect:802026-10-17 08:26:53
87.236.176.xUnited Kingdom Medium Automated Scannergeneric decoy:33892026-10-17 08:26:07