EudorIA Cyber Intelligence
EudorIA Threat Observatory

Internet sources observed on the perimeter

A transparent view of the technical sources linked to hostile or anomalous requests that EudorIA controls detected and blocked.

Continuous updateWAF, IPS and firewall
Evidence geography

Activity observed worldwide

70268 public technical events
World map showing the distribution of observed technical events

Hover for details. Click a country to zoom in, then drag the map to pan.

Colour represents the number of events associated with the source's estimated country, not a geographic attribution of the activity.
  1. No evidence
  2. 1-9
  3. 10-99
  4. 100-999
  5. 1.000-9.999
  6. 10.000+
US United States 18826 events
HK Hong Kong 6834 events
TR Turkey 6591 events
DE Germany 4819 events
GB United Kingdom 4430 events
BG Bulgaria 4311 events
View all observed countries (91)

USUnited States18826 events681 sources

HKHong Kong6834 events26 sources

TRTurkey6591 events33 sources

DEGermany4819 events76 sources

GBUnited Kingdom4430 events59 sources

BGBulgaria4311 events30 sources

NLNetherlands2666 events55 sources

RORomania2200 events9 sources

ITItaly1881 events38 sources

BRBrazil1805 events25 sources

ESSpain1738 events16 sources

BEBelgium1709 events11 sources

CACanada1567 events91 sources

SGSingapore1243 events16 sources

FRFrance1172 events29 sources

TWTaiwan1080 events9 sources

QAQatar1060 events5 sources

INIndia834 events20 sources

ARArgentina566 events195 sources

CLChile492 events25 sources

JPJapan438 events12 sources

CHSwitzerland364 events4 sources

VNVietnam364 events15 sources

SESweden333 events6 sources

IEIreland241 events6 sources

CNChina225 events40 sources

AUAustralia220 events5 sources

IDIndonesia213 events16 sources

IRIran, Islamic Republic of205 events14 sources

EEEstonia182 events2 sources

ISIceland180 events3 sources

RURussian Federation179 events30 sources

ATAustria119 events4 sources

PTPortugal79 events53 sources

MXMexico76 events23 sources

PKPakistan76 events11 sources

KRKorea, Republic of69 events8 sources

SASaudi Arabia58 events2 sources

COColombia57 events19 sources

CMCameroon56 events1 sources

LTLithuania49 events2 sources

UAUkraine44 events14 sources

KEKenya37 events3 sources

KNSaint Kitts and Nevis35 events5 sources

ZASouth Africa32 events11 sources

HRCroatia25 events2 sources

AEUnited Arab Emirates23 events3 sources

MYMalaysia23 events5 sources

ILIsrael21 events1 sources

THThailand19 events6 sources

SKSlovakia19 events1 sources

BDBangladesh17 events6 sources

NGNigeria15 events6 sources

SCSeychelles12 events3 sources

ZMZambia11 events1 sources

HUHungary10 events1 sources

MCMonaco10 events3 sources

MDMoldova, Republic of10 events2 sources

KZKazakhstan10 events1 sources

MMMyanmar9 events3 sources

FIFinland8 events3 sources

AZAzerbaijan7 events2 sources

TNTunisia7 events2 sources

VEVenezuela7 events2 sources

AOAngola7 events1 sources

CGCongo6 events2 sources

ALAlbania6 events1 sources

DODominican Republic6 events2 sources

GRGreece5 events1 sources

PHPhilippines5 events2 sources

SNSenegal5 events2 sources

GEGeorgia4 events1 sources

MTMalta4 events1 sources

TGTogo3 events1 sources

LBLebanon3 events2 sources

MAMorocco3 events1 sources

MZMozambique3 events1 sources

NPNP3 events1 sources

PAPanama3 events1 sources

PLPoland3 events1 sources

ECEcuador3 events1 sources

RSSerbia3 events1 sources

DZAlgeria3 events1 sources

CZCzech Republic3 events1 sources

CICote D'Ivoire3 events1 sources

BOBolivia3 events1 sources

SVEl Salvador2 events1 sources

GTGuatemala2 events1 sources

MUMauritius2 events1 sources

KPKorea, Democratic People's Republic of2 events1 sources

SISI1 events1 sources

Network context

Network operators / ASNs

444 network operators catalogued. The ASN holder describes the source network and does not identify who is responsible for the activity.

  1. GOOGLE-CLOUD-PLATFORM - Google LLC, US AS396982 · 207 sources
    25571 25571
  2. OMEGATECH-AS - Omegatech LTD, SC AS202412 · 11 sources
    6763 6763
  3. ASKZ - Shereverov Marat Ahmedovich, KZ AS210006 · 4 sources
    5466 5466
  4. DMZHOST - TECHOFF SRV LIMITED, GB AS48090 · 32 sources
    3086 3086
  5. FPS12 - Feo Prest SRL, RO AS208137 · 4 sources
    2910 2910
  6. Mevspace - MEVSPACE sp. z o.o., PL AS201814 · 3 sources
    2596 2596
  7. IS-AS-1 - Interserver, Inc, US AS19318 · 4 sources
    2188 2188
  8. MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US AS8075 · 98 sources
    1869 1869
Published IPs1891Sources with sufficient evidence
Catalogued events70268Minimised technical observations
Active in the last 24 hours34Sources seen recently
Observed countries91Geographic estimate, not attribution
Public OSINT feed · Feodo Tracker

Botnet C2 history

IPv4 addresses reported over time by the Feodo Tracker feed; inclusion does not mean an attack was observed against our customers.

Recorded in history
1
In the latest feed
1
Reported IPFamilyFeed statusFirst activity reportedLast activity reportedLast seen in feed
50.16.16.211 QakBot Present (online) 30/12/2025 14:56 12/03/2026 01:00 26/09/2026 15:31

Showing the 40 most recently updated IPs. IPs may be reassigned and status reflects only the feed response; do not use it alone to attribute or block traffic.

We detectWAF, IPS and firewall produce the initial evidence.
We correlateRepeated events, rules and technical context are aggregated per IP.
We minimiseWe do not publish raw logs, internal backends or customer data.
We shareWe make browsable what can help collective defence.
Reset
Public evidence

739 sources in the result

Export CSV
IPS + WAF

199.119.137.157

AS53724 · EVM - EXTRAVM LLC, US

Prefix 199.119.137.0/24 · PTR 157.137.119.199.in-addr.arpa
Estimated origin Germany Location not published by the sources
Last evidence Blocked web request 26/09/2026 13:16
Events221 Confidence high
→
WAF

34.156.22.151

AS396982 · GOOGLE-CLOUD-PLATFORM - Google LLC, US

Prefix 34.156.0.0/17 · PTR 151.22.156.34.bc.googleusercontent.com
Estimated origin United States Brussels
Last evidence Exploit attempt 26/09/2026 12:38
Events77 Confidence high
→
FIREWALL + IPS + WAF

159.89.127.165

AS14061 · DIGITALOCEAN-ASN - DigitalOcean, LLC, US

Prefix 159.89.112.0/20 · PTR b4bcd7c472.scan.leakix.org
Estimated origin Canada Toronto
Last evidence Blocked web request 26/09/2026 10:51
Events11 Confidence high
→
IPS + WAF

142.93.143.8

AS14061 · DIGITALOCEAN-ASN - DigitalOcean, LLC, US

Prefix 142.93.128.0/20 · PTR a4ac419f3c.scan.leakix.org
Estimated origin Netherlands Amsterdam
Last evidence Contained session 26/09/2026 10:51
Events16 Confidence high
→
WAF

157.245.204.205

AS14061 · DIGITALOCEAN-ASN - DigitalOcean, LLC, US

Prefix 157.245.192.0/20 · PTR ca1b036c29.scan.leakix.org
Estimated origin Singapore Singapore
Last evidence Blocked web request 26/09/2026 10:51
Events8 Confidence high
→
WAF

139.59.132.8

AS14061 · DIGITALOCEAN-ASN - DigitalOcean, LLC, US

Prefix 139.59.128.0/19 · PTR a113ac0491.scan.leakix.org
Estimated origin Germany Frankfurt am Main
Last evidence Blocked web request 26/09/2026 10:51
Events8 Confidence high
→
WAF

130.12.180.117

AS202412 · OMEGATECH-AS - Omegatech LTD, SC

Prefix 130.12.180.0/24
Estimated origin NL Amsterdam
Last evidence Exploit attempt 26/09/2026 10:50
Events61 Confidence high
→
WAF

45.138.12.30

AS218785 · TC-DATACENTER - TC DATACENTER LIMITED, HK

Prefix 45.138.12.0/24
Estimated origin United States Location not published by the sources
Last evidence Exploit attempt 26/09/2026 09:46
Events292 Confidence high
→
IPS

123.144.169.161

AS4837 · CHINA169-Backbone - CHINA UNICOM China169 Backbone, CN

Prefix 123.144.0.0/14
Estimated origin China Location not published by the sources
Last evidence IPS detection 26/09/2026 09:26
Events1 Confidence high
→
WAF

102.220.161.139

AS197769 · VPSDEDICATED-AS - VPS Dedicated LLC, US

Prefix 102.220.160.0/22
Estimated origin Nigeria Location not published by the sources
Last evidence Exploit attempt 26/09/2026 09:13
Events2 Confidence high
→
IPS

144.79.70.100

AS154402 · FREDYUN-AS-AP - Fredyun Network, CN

Prefix 144.79.70.0/24
Estimated origin SG Singapore
Last evidence IPS detection 26/09/2026 08:41
Events6 Confidence high
→
WAF

103.203.57.3

AS136180 · IPIP-CN - Beijing Tiantexin Tech. Co., Ltd., CN

Prefix 103.203.57.0/24 · PTR scan-57-3.security.ipip.net
Estimated origin China Location not published by the sources
Last evidence Blocked web request 26/09/2026 08:17
Events5 Confidence medium
→
IPS

50.3.76.6

AS49532 · SERVERHUB-NL - Eonix Corporation, US

Prefix 50.3.76.0/22 · PTR breakfirm.net
Estimated origin Germany Frankfurt am Main
Last evidence IPS detection 26/09/2026 07:06
Events2 Confidence high
→
IPS

1.80.3.152

AS4134 · CHINANET-BACKBONE - No.31,Jin-rong Street, CN

Prefix 1.80.0.0/13
Estimated origin China Xi'an
Last evidence IPS detection 26/09/2026 05:44
Events1 Confidence high
→
IPS

51.158.205.203

AS12876 · AS12876 - Scaleway SAS, FR

Prefix 51.158.128.0/17 · PTR 7934cbfb-536a-48fe-a6f0-009f98ceb9ac.nl-ams-1.baremetal.scw.cloud
Estimated origin France Haarlem
Last evidence IPS detection 26/09/2026 05:30
Events24 Confidence high
→
WAF

34.52.133.111

AS396982 · GOOGLE-CLOUD-PLATFORM - Google LLC, US

Prefix 34.52.128.0/17 · PTR 111.133.52.34.bc.googleusercontent.com
Estimated origin United States Brussels
Last evidence Exploit attempt 26/09/2026 05:08
Events73 Confidence high
→
WAF

94.154.43.135

AS219502 · STORMCLOUD-AS - Storm Industries LLC, US

Prefix 94.154.43.0/24
Estimated origin United Kingdom Amsterdam
Last evidence Exploit attempt 26/09/2026 02:48
Events3 Confidence high
→
FIREWALL + WAF

94.154.43.146

AS219502 · STORMCLOUD-AS - Storm Industries LLC, US

Prefix 94.154.43.0/24
Estimated origin United Kingdom Amsterdam
Last evidence Exploit attempt 26/09/2026 02:48
Events6 Confidence high
→
WAF

94.154.43.180

AS219502 · STORMCLOUD-AS - Storm Industries LLC, US

Prefix 94.154.43.0/24
Estimated origin United Kingdom Amsterdam
Last evidence Exploit attempt 26/09/2026 02:48
Events8 Confidence high
→
WAF

94.154.43.164

AS219502 · STORMCLOUD-AS - Storm Industries LLC, US

Prefix 94.154.43.0/24
Estimated origin United Kingdom Amsterdam
Last evidence Exploit attempt 26/09/2026 02:48
Events6 Confidence high
→
WAF

94.154.43.84

AS219502 · STORMCLOUD-AS - Storm Industries LLC, US

Prefix 94.154.43.0/24
Estimated origin United Kingdom Amsterdam
Last evidence Exploit attempt 26/09/2026 02:48
Events6 Confidence high
→
WAF

94.154.43.125

AS219502 · STORMCLOUD-AS - Storm Industries LLC, US

Prefix 94.154.43.0/24
Estimated origin United Kingdom Amsterdam
Last evidence Exploit attempt 26/09/2026 02:26
Events5 Confidence high
→
IPS

147.185.132.120

AS396982 · GOOGLE-CLOUD-PLATFORM - Google LLC, US

Prefix 147.185.132.0/22
Estimated origin United States Location not published by the sources
Last evidence IPS detection 26/09/2026 02:10
Events1 Confidence high
→
WAF

34.77.137.207

AS396982 · GOOGLE-CLOUD-PLATFORM - Google LLC, US

Prefix 34.77.128.0/20 · PTR 207.137.77.34.bc.googleusercontent.com
Estimated origin Belgium Brussels
Last evidence Repeated web activity 26/09/2026 01:54
Events172 Confidence high
→
WAF

213.209.159.133

AS208137 · FPS12 - Feo Prest SRL, RO

Prefix 213.209.159.0/24
Estimated origin Germany Aachen
Last evidence Exploit attempt 26/09/2026 00:45
Events25 Confidence high
→
IPS

198.235.24.159

AS396982 · GOOGLE-CLOUD-PLATFORM - Google LLC, US

Prefix 198.235.24.0/24
Estimated origin United States Location not published by the sources
Last evidence IPS detection 25/09/2026 23:35
Events1 Confidence high
→
IPS

138.197.88.31

AS14061 · DIGITALOCEAN-ASN - DigitalOcean, LLC, US

Prefix 138.197.80.0/20
Estimated origin United States Clifton
Last evidence IPS detection 25/09/2026 22:17
Events1 Confidence high
→
WAF

109.205.176.10

AS51167 · CONTABO - Contabo GmbH, DE

Prefix 109.205.176.0/22 · PTR vmi3214355.contaboserver.net
Estimated origin Germany Lauterbourg
Last evidence Exploit attempt 25/09/2026 22:07
Events6 Confidence high
→
WAF

207.175.220.59

AS396982 · GOOGLE-CLOUD-PLATFORM - Google LLC, US

Prefix 207.175.128.0/17 · PTR 59.220.175.207.bc.googleusercontent.com
Estimated origin United States Location not published by the sources
Last evidence Exploit attempt 25/09/2026 21:24
Events73 Confidence high
→
IPS + WAF

185.177.72.64

AS211590 · BUCKLOG - Bucklog SARL, FR

Prefix 185.177.72.0/24
Estimated origin United Kingdom Location not published by the sources
Last evidence Exploit attempt 25/09/2026 21:24
Events199 Confidence high
→
WAF

216.81.200.23

AS11320 · LIGHTEDGE-AS-02 - LightEdge Solutions, US

Prefix 216.81.200.0/24 · PTR ip23.btslab.lightedge.com
Estimated origin United States Tonganoxie
Last evidence Exploit attempt 25/09/2026 21:19
Events6 Confidence high
→
IPS

40.124.171.189

AS8075 · MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US

Prefix 40.124.0.0/16 · PTR azpdssw8ltbt.stretchoid.com
Estimated origin United States San Antonio
Last evidence IPS detection 25/09/2026 18:40
Events1 Confidence high
→
WAF

194.180.48.253

AS201814 · Mevspace - MEVSPACE sp. z o.o., PL

Prefix 194.180.48.0/24
Estimated origin Netherlands Berngau
Last evidence Exploit attempt 25/09/2026 18:01
Events4 Confidence high
→
WAF

144.172.85.180

AS14956 · ROUTERHOSTING - RouterHosting LLC, US

Prefix 144.172.84.0/23
Estimated origin United States Singapore
Last evidence Exploit attempt 25/09/2026 17:57
Events7 Confidence high
→
WAF

172.105.196.91

AS63949 · AKAMAI-LINODE-AP - Akamai Connected Cloud, SG

Prefix 172.105.192.0/19 · PTR li1838-91.members.linode.com
Estimated origin Japan Tokyo
Last evidence Blocked web request 25/09/2026 15:25
Events10 Confidence medium
→
WAF

45.148.10.246

AS48090 · DMZHOST - TECHOFF SRV LIMITED, GB

Prefix 45.148.10.0/24
Estimated origin Netherlands Amsterdam
Last evidence Repeated web activity 25/09/2026 14:53
Events27 Confidence high
→
IPS

216.180.246.66

AS396982 · GOOGLE-CLOUD-PLATFORM - Google LLC, US

Prefix 216.180.246.0/24 · PTR crawler066.deepfield.net
Estimated origin United States Location not published by the sources
Last evidence IPS detection 25/09/2026 14:28
Events15 Confidence high
→
WAF

178.128.146.12

AS14061 · DIGITALOCEAN-ASN - DigitalOcean, LLC, US

Prefix 178.128.144.0/20
Estimated origin United States North Bergen
Last evidence Exploit attempt 25/09/2026 14:16
Events15 Confidence high
→
WAF

94.231.206.108

AS213412 · ONYPHE - ONYPHE SAS, FR

Prefix 94.231.206.0/24 · PTR murphy.probe.onyphe.net
Estimated origin France Shenzhen
Last evidence Blocked web request 25/09/2026 11:42
Events3 Confidence medium
→
IPS + WAF

49.143.129.24

AS38684 · CMBDAEJEON-AS-KR-KR - CMB Daejeon Broadcasting Co,.Ltd, KR

Prefix 49.143.128.0/18
Estimated origin Korea, Republic of Nonsan
Last evidence Exploit attempt 25/09/2026 10:38
Events2 Confidence high
→
WAF

20.51.250.231

AS8075 · MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US

Prefix 20.48.0.0/12 · PTR azpdeevh4pa3.stretchoid.com
Estimated origin United States Dulles
Last evidence Blocked web request 25/09/2026 10:15
Events5 Confidence medium
→
IPS

147.185.132.105

AS396982 · GOOGLE-CLOUD-PLATFORM - Google LLC, US

Prefix 147.185.132.0/22
Estimated origin United States Location not published by the sources
Last evidence IPS detection 25/09/2026 08:46
Events1 Confidence high
→
WAF

45.138.12.23

AS218785 · TC-DATACENTER - TC DATACENTER LIMITED, HK

Prefix 45.138.12.0/24
Estimated origin United States Location not published by the sources
Last evidence Blocked web request 25/09/2026 07:21
Events135 Confidence high
→
WAF

151.236.18.85

AS9009 · M247 - M247 Europe SRL, RO

Prefix 151.236.18.0/24 · PTR 85.18.236.151.static.edisglobal.com
Estimated origin Italy Milan
Last evidence Anomalous web request 25/09/2026 06:39
Events51 Confidence high
→
FIREWALL + WAF

45.79.207.111

AS63949 · AKAMAI-LINODE-AP - Akamai Connected Cloud, SG

Prefix 45.79.192.0/19 · PTR 45-79-207-111.ip.linodeusercontent.com
Estimated origin United States Atlanta
Last evidence Blocked web request 25/09/2026 06:36
Events4 Confidence medium
→
WAF

34.52.229.253

AS396982 · GOOGLE-CLOUD-PLATFORM - Google LLC, US

Prefix 34.52.128.0/17 · PTR 253.229.52.34.bc.googleusercontent.com
Estimated origin United States Brussels
Last evidence Exploit attempt 25/09/2026 06:33
Events281 Confidence high
→
WAF

154.54.100.185

AS6405 · AIN - American Information Network, US

Prefix 154.54.100.0/22
Estimated origin Finland Location not published by the sources
Last evidence Exploit attempt 25/09/2026 05:42
Events4 Confidence high
→
IPS + WAF

94.154.46.250

AS202412 · OMEGATECH-AS - Omegatech LTD, SC

Prefix 94.154.46.0/24
Estimated origin Turkey New York
Last evidence Exploit attempt 25/09/2026 04:58
Events1855 Confidence high
→
WAF

20.121.140.118

AS8075 · MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US

Prefix 20.64.0.0/10 · PTR azpdesm5idvp.stretchoid.com
Estimated origin United States Dulles
Last evidence Exchange / Autodiscover probe 25/09/2026 04:28
Events1 Confidence medium
→
WAF

72.62.11.230

AS47583 · AS-HOSTINGER - Hostinger International Limited, CY

Prefix 72.62.8.0/21 · PTR srv1169919.hstgr.cloud
Estimated origin United States São Paulo
Last evidence Exploit attempt 25/09/2026 01:58
Events1 Confidence high
→