ONLINE
US · United States
QakBot command-and-control server
Last online 2026-03-12 · AMAZON-AESSOURCE DATA NEW POST DAILY
See what is being observed.
Understand what it actually means.
A continuously refreshed view of public threat intelligence, with the limitations explained instead of hidden.
5 MINMAP REFRESH
15 MINCISA REFRESH
2 SOURCESATTRIBUTED DATA
LIVE GLOBAL THREAT ACTIVITY
Recently observed botnet infrastructure
These markers represent online botnet command-and-control servers reported by Feodo Tracker. They show server infrastructure, not the proven identity or physical location of an attacker.
REFRESHES EVERY 5 MINUTES
What this map means: a botnet command-and-control server was recently confirmed online in this country. Compromised servers, proxies, VPNs, botnets, and cloud hosting can obscure the real operator.
RECENT OBSERVATIONS
What the map is showing
Each record identifies confirmed online botnet infrastructure, its country-level network location, malware family, and attributed source.
LIVE THREAT FEED
Actively exploited vulnerabilities
Current entries from CISA’s official Known Exploited Vulnerabilities catalog. These are confirmed weaknesses attackers have used, not simulated attack-map traffic.
REFRESHES EVERY 15 MINUTES
ACTIVE EXPLOITATION
CVE-2026-118527: Ivanti Connect Secure
Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.ACTIVE EXPLOITATION
CVE-2026-111357: Ivanti Connect Secure
Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.ACTIVE EXPLOITATION
CVE-2026-97229: GitLab Community Edition and Enterprise Edition
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.ACTIVE EXPLOITATION
CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.ACTIVE EXPLOITATION
CVE-2026-41709: Broadcom VMware ESX
Broadcom VMWare ESX Insufficient Logging Vulnerability
Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.ACTIVE EXPLOITATION
CVE-2026-46300: Linux Kernel
Linux Kernel Missing Initialization of a Variable Vulnerability
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.“Live” means the feed updates from current public reporting. It does not identify every attack or prove the physical location of an attacker.