EudorIA Cyber Intelligence
EudorIA Threat Observatory

Internet sources observed on the perimeter

A transparent view of the technical sources linked to hostile or anomalous requests that EudorIA controls detected and blocked.

Continuous updateWAF, IPS and firewall
Evidence geography

Activity observed worldwide

70361 public technical events
World map showing the distribution of observed technical events

Hover for details. Click a country to zoom in, then drag the map to pan.

Colour represents the number of events associated with the source's estimated country, not a geographic attribution of the activity.
  1. No evidence
  2. 1-9
  3. 10-99
  4. 100-999
  5. 1.000-9.999
  6. 10.000+
US United States 18916 events
HK Hong Kong 6834 events
TR Turkey 6591 events
DE Germany 4820 events
GB United Kingdom 4430 events
BG Bulgaria 4311 events
View all observed countries (91)

USUnited States18916 events683 sources

HKHong Kong6834 events26 sources

TRTurkey6591 events33 sources

DEGermany4820 events76 sources

GBUnited Kingdom4430 events59 sources

BGBulgaria4311 events30 sources

NLNetherlands2666 events55 sources

RORomania2200 events9 sources

ITItaly1881 events38 sources

BRBrazil1805 events25 sources

ESSpain1738 events16 sources

BEBelgium1709 events11 sources

CACanada1567 events91 sources

SGSingapore1243 events16 sources

FRFrance1172 events29 sources

TWTaiwan1080 events9 sources

QAQatar1060 events5 sources

INIndia834 events20 sources

ARArgentina566 events195 sources

CLChile492 events25 sources

JPJapan438 events12 sources

CHSwitzerland364 events4 sources

VNVietnam364 events15 sources

SESweden333 events6 sources

IEIreland241 events6 sources

CNChina225 events40 sources

AUAustralia220 events5 sources

IDIndonesia213 events16 sources

IRIran, Islamic Republic of205 events14 sources

EEEstonia182 events2 sources

ISIceland180 events3 sources

RURussian Federation179 events30 sources

ATAustria119 events4 sources

PTPortugal79 events53 sources

MXMexico76 events23 sources

PKPakistan76 events11 sources

KRKorea, Republic of69 events8 sources

SASaudi Arabia58 events2 sources

COColombia57 events19 sources

CMCameroon56 events1 sources

LTLithuania49 events2 sources

UAUkraine44 events14 sources

KEKenya37 events3 sources

KNSaint Kitts and Nevis35 events5 sources

ZASouth Africa32 events11 sources

HRCroatia25 events2 sources

AEUnited Arab Emirates23 events3 sources

MYMalaysia23 events5 sources

ILIsrael21 events1 sources

THThailand19 events6 sources

SKSlovakia19 events1 sources

BDBangladesh17 events6 sources

NGNigeria17 events6 sources

SCSeychelles12 events3 sources

ZMZambia11 events1 sources

HUHungary10 events1 sources

MCMonaco10 events3 sources

MDMoldova, Republic of10 events2 sources

KZKazakhstan10 events1 sources

MMMyanmar9 events3 sources

FIFinland8 events3 sources

AZAzerbaijan7 events2 sources

TNTunisia7 events2 sources

VEVenezuela7 events2 sources

AOAngola7 events1 sources

CGCongo6 events2 sources

ALAlbania6 events1 sources

DODominican Republic6 events2 sources

GRGreece5 events1 sources

PHPhilippines5 events2 sources

SNSenegal5 events2 sources

GEGeorgia4 events1 sources

MTMalta4 events1 sources

TGTogo3 events1 sources

LBLebanon3 events2 sources

MAMorocco3 events1 sources

MZMozambique3 events1 sources

NPNP3 events1 sources

PAPanama3 events1 sources

PLPoland3 events1 sources

ECEcuador3 events1 sources

RSSerbia3 events1 sources

DZAlgeria3 events1 sources

CZCzech Republic3 events1 sources

CICote D'Ivoire3 events1 sources

BOBolivia3 events1 sources

SVEl Salvador2 events1 sources

GTGuatemala2 events1 sources

MUMauritius2 events1 sources

KPKorea, Democratic People's Republic of2 events1 sources

SISI1 events1 sources

Network context

Network operators / ASNs

444 network operators catalogued. The ASN holder describes the source network and does not identify who is responsible for the activity.

  1. GOOGLE-CLOUD-PLATFORM - Google LLC, US AS396982 · 208 sources
    25647 25647
  2. OMEGATECH-AS - Omegatech LTD, SC AS202412 · 11 sources
    6763 6763
  3. ASKZ - Shereverov Marat Ahmedovich, KZ AS210006 · 4 sources
    5466 5466
  4. DMZHOST - TECHOFF SRV LIMITED, GB AS48090 · 32 sources
    3086 3086
  5. FPS12 - Feo Prest SRL, RO AS208137 · 4 sources
    2910 2910
  6. Mevspace - MEVSPACE sp. z o.o., PL AS201814 · 3 sources
    2596 2596
  7. IS-AS-1 - Interserver, Inc, US AS19318 · 4 sources
    2188 2188
  8. MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US AS8075 · 98 sources
    1869 1869
Published IPs1893Sources with sufficient evidence
Catalogued events70361Minimised technical observations
Active in the last 24 hours35Sources seen recently
Observed countries91Geographic estimate, not attribution
Public OSINT feed · Feodo Tracker

Botnet C2 history

IPv4 addresses reported over time by the Feodo Tracker feed; inclusion does not mean an attack was observed against our customers.

Recorded in history
1
In the latest feed
1
Reported IPFamilyFeed statusFirst activity reportedLast activity reportedLast seen in feed
50.16.16.211 QakBot Present (online) 30/12/2025 14:56 12/03/2026 01:00 26/09/2026 19:52

Showing the 40 most recently updated IPs. IPs may be reassigned and status reflects only the feed response; do not use it alone to attribute or block traffic.

We detectWAF, IPS and firewall produce the initial evidence.
We correlateRepeated events, rules and technical context are aggregated per IP.
We minimiseWe do not publish raw logs, internal backends or customer data.
We shareWe make browsable what can help collective defence.
Reset
Public evidence

732 sources in the result

Export CSV
FIREWALL

65.49.20.68

AS6939 · HURRICANE - Hurricane Electric LLC, US

Prefix 65.49.0.0/17 · PTR scan-19.shadowserver.io
Estimated origin United States Location not published by the sources
Last evidence Known IOC 04/09/2026 09:20
Events1 Confidence high
→
WAF

104.199.221.168

AS396982 · GOOGLE-CLOUD-PLATFORM - Google LLC, US

Prefix 104.199.192.0/19 · PTR 168.221.199.104.bc.googleusercontent.com
Estimated origin Taiwan Taipei
Last evidence Exploit attempt 04/09/2026 09:15
Events23 Confidence high
→
FIREWALL

64.62.197.48

AS6939 · HURRICANE - Hurricane Electric LLC, US

Prefix 64.62.128.0/17 · PTR scan-45b.shadowserver.io
Estimated origin United States Location not published by the sources
Last evidence Known IOC 04/09/2026 08:24
Events1 Confidence high
→
FIREWALL

176.65.148.96

AS51396 · PFCLOUD - Pfcloud UG (haftungsbeschrankt), DE

Prefix 176.65.148.0/24 · PTR 176.65.148.96.ptr.pfcloud.network
Estimated origin Germany Eygelshoven
Last evidence Known IOC 04/09/2026 07:53
Events14 Confidence high
→
WAF

34.106.195.129

AS396982 · GOOGLE-CLOUD-PLATFORM - Google LLC, US

Prefix 34.106.192.0/20 · PTR 129.195.106.34.bc.googleusercontent.com
Estimated origin United States Salt Lake City
Last evidence Exploit attempt 04/09/2026 06:32
Events15 Confidence high
→
WAF

136.117.3.87

AS396982 · GOOGLE-CLOUD-PLATFORM - Google LLC, US

Prefix 136.117.0.0/17 · PTR 87.3.117.136.bc.googleusercontent.com
Estimated origin United States The Dalles
Last evidence Exploit attempt 04/09/2026 06:21
Events16 Confidence high
→
IPS + WAF

80.89.199.242

AS34757 · SIBSET-NSK-AS - Sibirskie Seti Ltd., RU

Prefix 80.89.192.0/20 · PTR host-80-89-199-242.academ.org
Estimated origin Russian Federation Location not published by the sources
Last evidence Exploit attempt 04/09/2026 05:59 Exploit CVE-2017-9841
Events17 Confidence high
→
FIREWALL

86.54.31.38

AS12989 · BlackHOST - Black HOST Ltd, CA

Prefix 86.54.31.0/24 · PTR blue2.census.shodan.io
Estimated origin United Kingdom Location not published by the sources
Last evidence Known IOC 04/09/2026 05:56
Events67 Confidence high
→
FIREWALL

176.123.5.126

AS200019 · AlexHost - ALEXHOST SRL, MD

Prefix 176.123.0.0/21 · PTR server-pofid.site
Estimated origin Moldova, Republic of Chisinau
Last evidence Known IOC 04/09/2026 05:51
Events7 Confidence high
→
WAF

34.38.97.177

AS396982 · GOOGLE-CLOUD-PLATFORM - Google LLC, US

Prefix 34.38.0.0/16 · PTR 177.97.38.34.bc.googleusercontent.com
Estimated origin Belgium Brussels
Last evidence Blocked web request 04/09/2026 05:42
Events14 Confidence high
→
FIREWALL

89.248.167.131

AS202425 · INT-NETWORK - IP Volume inc, SC

Prefix 89.248.167.0/24 · PTR mason.census.shodan.io
Estimated origin Netherlands Location not published by the sources
Last evidence Known IOC 04/09/2026 05:22
Events69 Confidence high
→
FIREWALL

93.174.95.106

AS202425 · INT-NETWORK - IP Volume inc, SC

Prefix 93.174.95.0/24 · PTR battery.census.shodan.io
Estimated origin Netherlands Amsterdam
Last evidence Known IOC 04/09/2026 04:58
Events73 Confidence high
→
IPS + WAF

103.77.247.206

AS140810 · MEGACORE-AS-VN - Megacore Technology Company Limited, VN

Prefix 103.77.246.0/23
Estimated origin Vietnam Location not published by the sources
Last evidence Anomalous web request 04/09/2026 03:37 Exploit CVE-2018-20062 · CVE-2017-9841
Events58 Confidence high
→
FIREWALL

71.6.135.131

AS10439 · CARINET - CariNet, Inc., US

Prefix 71.6.128.0/17 · PTR soda.census.shodan.io
Estimated origin United States Location not published by the sources
Last evidence Known IOC 04/09/2026 03:25
Events95 Confidence high
→
IPS + WAF

103.91.187.83

AS132322 · GDRPL-IN - Good Domain Registry Private Limited, IN

Prefix 103.91.187.0/24 · PTR 103.91.187.83-static-reverse.gdr.net.in
Estimated origin India Location not published by the sources
Last evidence Anomalous web request 04/09/2026 03:23 Exploit CVE-2018-20062 · CVE-2017-9841
Events61 Confidence high
→
FIREWALL

152.32.243.98

AS135377 · UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK

Prefix 152.32.243.0/24
Estimated origin Korea, Republic of Seoul
Last evidence Known IOC 04/09/2026 03:01
Events1 Confidence high
→
WAF

34.53.140.137

AS396982 · GOOGLE-CLOUD-PLATFORM - Google LLC, US

Prefix 34.53.128.0/17 · PTR 137.140.53.34.bc.googleusercontent.com
Estimated origin United States Brussels
Last evidence Exploit attempt 04/09/2026 01:32
Events16 Confidence high
→
WAF

40.124.121.161

AS8075 · MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US

Prefix 40.124.0.0/16 · PTR azpdss99zny7.stretchoid.com
Estimated origin United States San Antonio
Last evidence Exchange / Autodiscover probe 04/09/2026 00:06
Events1 Confidence medium
→
WAF

91.92.33.29

AS207043 · DEDIK-IO - DEDIK SERVICES LIMITED, GB

Prefix 91.92.33.0/24
Estimated origin United Kingdom Frankfurt am Main
Last evidence Blocked web request 03/09/2026 23:42
Events5 Confidence high
→
IPS

205.210.31.206

AS396982 · GOOGLE-CLOUD-PLATFORM - Google LLC, US

Prefix 205.210.31.0/24
Estimated origin United States Location not published by the sources
Last evidence IPS detection 03/09/2026 23:38
Events1 Confidence high
→
FIREWALL

165.154.36.245

AS135377 · UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK

Prefix 165.154.36.0/24
Estimated origin United States Los Angeles
Last evidence Known IOC 03/09/2026 22:10
Events3 Confidence high
→
FIREWALL

167.94.146.60

AS398705 · CENSYS-ARIN-02 - Censys, Inc., US

Prefix 167.94.146.0/24 · PTR 60.146.94.167.censys-scanner.com
Estimated origin United States Location not published by the sources
Last evidence Known IOC 03/09/2026 21:32
Events10 Confidence high
→
FIREWALL

64.62.156.108

AS6939 · HURRICANE - Hurricane Electric LLC, US

Prefix 64.62.128.0/17 · PTR scan-67-0.shadowserver.io
Estimated origin United States Minneapolis
Last evidence Known IOC 03/09/2026 19:33
Events2 Confidence high
→
IPS + WAF

34.74.135.191

AS396982 · GOOGLE-CLOUD-PLATFORM - Google LLC, US

Prefix 34.74.128.0/20 · PTR 191.135.74.34.bc.googleusercontent.com
Estimated origin United States North Charleston
Last evidence Repeated web activity 03/09/2026 19:04
Events897 Confidence high
→
WAF

195.178.110.102

AS48090 · DMZHOST - TECHOFF SRV LIMITED, GB

Prefix 195.178.110.0/24
Estimated origin Canada Location not published by the sources
Last evidence Known IOC 03/09/2026 18:58
Events248 Confidence high
→
IPS

85.217.140.50

AS209334 · MODAT-01 - Modat B.V., NL

Prefix 85.217.140.0/24 · PTR o349.scanner.modat.io
Estimated origin Bulgaria Gravelines
Last evidence IPS detection 03/09/2026 18:39
Events1 Confidence high
→
WAF

54.175.205.73

AS14618 · AMAZON-AES - Amazon.com, Inc., US

Prefix 54.174.0.0/15 · PTR ec2-54-175-205-73.compute-1.amazonaws.com
Estimated origin United States Ashburn
Last evidence Blocked web request 03/09/2026 15:14
Events5 Confidence medium
→
WAF

94.231.206.132

AS213412 · ONYPHE - ONYPHE SAS, FR

Prefix 94.231.206.0/24 · PTR krishan.probe.onyphe.net
Estimated origin France Shenzhen
Last evidence Blocked web request 03/09/2026 13:59
Events2 Confidence medium
→
FIREWALL

103.230.144.104

AS55720 · GIGABIT-MY - Gigabit Hosting Sdn Bhd, MY

Prefix 103.230.144.0/24
Estimated origin Hong Kong Taipei
Last evidence Known IOC 03/09/2026 12:44
Events1 Confidence high
→
FIREWALL

198.23.209.169

AS36352 · AS-COLOCROSSING - HostPapa, US

Prefix 198.23.209.0/24 · PTR 198-23-209-169-host.colocrossing.com
Estimated origin United States Buffalo
Last evidence Known IOC 03/09/2026 12:32
Events1 Confidence high
→
WAF

40.119.44.46

AS8075 · MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US

Prefix 40.112.0.0/13
Estimated origin United States San Antonio
Last evidence Exploit attempt 03/09/2026 12:31
Events1 Confidence high
→
FIREWALL

185.245.80.217

AS62240 · Clouvider - Clouvider Limited, GB

Prefix 185.245.80.0/24
Estimated origin United Kingdom Canary Wharf
Last evidence Known IOC 03/09/2026 11:33
Events20 Confidence high
→
WAF

195.178.110.31

AS48090 · DMZHOST - TECHOFF SRV LIMITED, GB

Prefix 195.178.110.0/24
Estimated origin Germany Location not published by the sources
Last evidence Blocked web request 03/09/2026 09:09
Events245 Confidence high
→
FIREWALL

60.191.137.103

AS58461 · CT-HangZhou-IDC - No.288,Fu-chun Road, CN

Prefix 60.191.137.0/24
Estimated origin China Location not published by the sources
Last evidence Known IOC 03/09/2026 08:54
Events1 Confidence high
→
WAF

20.84.164.199

AS8075 · MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US

Prefix 20.64.0.0/10 · PTR azpdcebj7f20.stretchoid.com
Estimated origin United States Des Moines
Last evidence Blocked web request 03/09/2026 08:41
Events2 Confidence medium
→
IPS

46.150.20.3

AS47513 · SKYLINE-UA-AS - FOP Zubenko Volodimir Oleksandrovich, UA

Prefix 46.150.0.0/19
Estimated origin Ukraine Kharkiv
Last evidence IPS detection 03/09/2026 07:43
Events1 Confidence high
→
FIREWALL

47.84.138.195

AS45102 · ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd., CN

Prefix 47.84.128.0/17
Estimated origin United States Location not published by the sources
Last evidence Known IOC 03/09/2026 07:32
Events2 Confidence high
→
IPS

198.235.24.77

AS396982 · GOOGLE-CLOUD-PLATFORM - Google LLC, US

Prefix 198.235.24.0/24
Estimated origin United States Location not published by the sources
Last evidence IPS detection 03/09/2026 06:34
Events1 Confidence high
→
FIREWALL

47.253.5.130

AS45102 · ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd., CN

Prefix 47.253.0.0/17
Estimated origin United States Location not published by the sources
Last evidence Known IOC 03/09/2026 06:24
Events7 Confidence high
→
FIREWALL

176.65.132.131

AS197170 · TECHTIES-AS - TechTies Inc., SC

Prefix 176.65.132.0/24
Estimated origin Germany Amsterdam
Last evidence Known IOC 03/09/2026 06:19
Events32 Confidence high
→
FIREWALL

165.154.59.168

AS135377 · UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK

Prefix 165.154.59.0/24
Estimated origin Philippines Manila
Last evidence Known IOC 03/09/2026 04:23
Events1 Confidence high
→
WAF

40.119.43.218

AS8075 · MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US

Prefix 40.112.0.0/13 · PTR azpdse8awllk.stretchoid.com
Estimated origin United States San Antonio
Last evidence Blocked web request 03/09/2026 02:30
Events2 Confidence medium
→
IPS

199.195.248.205

AS53667 · PONYNET - FranTech Solutions, US

Prefix 199.195.248.0/21 · PTR benign.internet.survey.scan
Estimated origin United States Staten Island
Last evidence IPS detection 03/09/2026 02:07
Events1 Confidence high
→
WAF

47.91.125.252

AS45102 · ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd., CN

Prefix 47.91.96.0/19 · PTR measurements.ki3.org.cn
Estimated origin United Arab Emirates Dubai
Last evidence Repeated web activity 02/09/2026 23:34
Events17 Confidence high
→
FIREWALL

86.54.31.34

AS12989 · BlackHOST - Black HOST Ltd, CA

Prefix 86.54.31.0/24 · PTR wine.census.shodan.io
Estimated origin United Kingdom Location not published by the sources
Last evidence Known IOC 02/09/2026 21:04
Events69 Confidence high
→
IPS

147.185.132.114

AS396982 · GOOGLE-CLOUD-PLATFORM - Google LLC, US

Prefix 147.185.132.0/22
Estimated origin United States Location not published by the sources
Last evidence IPS detection 02/09/2026 20:31
Events1 Confidence high
→
FIREWALL

66.132.172.136

AS398324 · CENSYS-ARIN-01 - Censys, Inc., US

Prefix 66.132.172.0/24 · PTR 136.172.132.66.censys-scanner.com
Estimated origin Canada Location not published by the sources
Last evidence Known IOC 02/09/2026 19:58
Events18 Confidence high
→
FIREWALL

71.6.232.24

AS10439 · CARINET - CariNet, Inc., US

Prefix 71.6.128.0/17
Estimated origin United States Location not published by the sources
Last evidence Known IOC 02/09/2026 19:33
Events24 Confidence high
→
WAF

20.169.50.119

AS8075 · MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US

Prefix 20.160.0.0/12
Estimated origin United States Phoenix
Last evidence Blocked web request 02/09/2026 18:07
Events2 Confidence medium
→
IPS + WAF

160.119.76.10

AS7489 · HOSTUS-GLOBAL-AS - HostUS, HK

Prefix 160.119.64.0/20 · PTR 160-119-76-10.ptr.as49870.net
Estimated origin Seychelles Location not published by the sources
Last evidence Anomalous web request 02/09/2026 17:51
Events5 Confidence high
→