Global view
Attacks in progress
Campaigns ONYX is watching assemble right now, with where they come from and the community they land in. No dot is a person: each one is a link being spread.
Attacks in progressMAP-1222
LiveAttacks in progress
Credential theftSession theftFake giftIP loggerMalware distributionconnectorpublic list
Malware distributionGermany → Spainurlhaus
Malware distributionGermany → United Statesurlhaus
Malware distributionGermany → Brazilurlhaus
Session theftGermany → Spainurlhaus
Malware distributionUnited States → Germanyurlhaus
Malware distributionUnited States → Brazilurlhaus
Malware distributionUnited States → Spainurlhaus
Malware distributionChina → Germanyurlhaus
What it does not doGEO-1223
The map is drawn from what ONX-15 already knows: you do not need to know who posted a link to know it is being spread.
Positions come from the country of the connection, the only geographic thing that reaches us. No address, no city and no person behind any dot.
Dashed routes come from public lists of malicious URLs (abuse.ch). Solid ones were seen by ONYX connectors. Region the address block was allocated to, not an exact location.