Threat Atlas

Indicators

–

New in last 24 h

–

first reported by a source

Countries

–

Malware families

–

named by sources

Feed health

–

Indicators by country

Malware families

First reported per day

Recent indicators

Indicator	Role	Reported status	Categories	Family	Location (approx.)	ASN	First reported	Sources

Feed / source status

Source	State	Last download	Feed dated	Last refresh	Stored	Notes

Reading this page: every indicator is a report by a third-party feed, not something verified here; it may be outdated, offline, or a false positive. Threat Atlas is passive: it only downloads published feeds and never contacts reported infrastructure. Map locations are IP-geolocation estimates of reported infrastructure (for example a C2 server), not the location of attackers, operators or infected machines. Country density counts indicators, not infections or attack volume. Indicators with no geographic information (domains, URLs, CVEs, un-geolocatable IPs) are never plotted, and categories without a working source show “no data”, not zero. “Fresh” means the feed was downloaded recently, not that its indicators were observed recently. “Reported status” is the source’s own claim at its last update: a listed server may be long offline, taken down, or reassigned; claims without recent evidence are shown as “not confirmed”, and nothing here is confirmed as currently active.