Live threat map
Ransomware victim claims and phishing hosting, plotted from the feeds as the collectors publish them. Every ring is a record with a timestamp: a quiet hour is a quiet feed, not a quiet internet.
—
claims
—
phishing hosts
—
countries
—
newest event
Loading the live feed…
Feed: checking…
now
Recent events
What the layers are
- Victim claims — ransomware leak-site victims published in the last 72 hours, shown in the country the claim names (ransomware.live).
- Phishing hosting — hostnames in the current OpenPhish snapshot, resolved at collection time; the country is where the IP is registered, not where the attacker sits.
- No source-to-destination arcs. No publishable feed records attacker origin, so the map shows where events are recorded rather than inventing a path.
- IP geolocation: IP Geolocation by DB-IP, CC BY 4.0. Phishing hosts: OpenPhish.
| Country | Claims | Phishing hosts | Total | Top group | Latest event |
|---|