ONLINE
US · United States
QakBot command-and-control server
Last online 2026-03-12 · AMAZON-AESSOURCE DATA NEW POST DAILY
See what is being observed.
Understand what it actually means.
A continuously refreshed view of public threat intelligence, with the limitations explained instead of hidden.
5 MINMAP REFRESH
15 MINCISA REFRESH
2 SOURCESATTRIBUTED DATA
LIVE GLOBAL THREAT ACTIVITY
Recently observed botnet infrastructure
These markers represent online botnet command-and-control servers reported by Feodo Tracker. They show server infrastructure, not the proven identity or physical location of an attacker.
REFRESHES EVERY 5 MINUTES
What this map means: a botnet command-and-control server was recently confirmed online in this country. Compromised servers, proxies, VPNs, botnets, and cloud hosting can obscure the real operator.
RECENT OBSERVATIONS
What the map is showing
Each record identifies confirmed online botnet infrastructure, its country-level network location, malware family, and attributed source.
LIVE THREAT FEED
Actively exploited vulnerabilities
Current entries from CISA’s official Known Exploited Vulnerabilities catalog. These are confirmed weaknesses attackers have used, not simulated attack-map traffic.
REFRESHES EVERY 15 MINUTES
ACTIVE EXPLOITATION
CVE-2026-114713: UnrealIRCd UnrealIRCd
UnrealIRCd Improper Neutralization of Delimiters Vulnerability
UnrealIRCd UnrealIRCd contains an improper neutralization of delimiters vulnerability that allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.ACTIVE EXPLOITATION
CVE-2026-123039: Check Point Multiple Products
Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability
Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server contain an incorrect permissions assignment for critical resources vulnerability when the Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.ACTIVE EXPLOITATION
CVE-2026-124194: Microsoft Office
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.ACTIVE EXPLOITATION
CVE-2026-111793: Openwave Messaging Limited Webtop Media Transcoder
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.ACTIVE EXPLOITATION
CVE-2026-20320: Cisco BroadWorks
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.ACTIVE EXPLOITATION
CVE-2026-111560: Barracuda Networks Multiple Products
Barracuda Networks Multiple Products OS Command Injection Vulnerability
Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606“Live” means the feed updates from current public reporting. It does not identify every attack or prove the physical location of an attacker.