Derp.ca
Data by Hatching Triage opens in a new tab

Distribution Tracker

Distribution is the other half: the hosts that hand over the payload in the first place. They rarely sit on the same networks as the command-and-control addresses, and some families turn up here and nowhere else, so they are counted on their own rather than folded into the C2 figures.

3,659
Hostnames Tracked (7d)
1,077
IP Addresses Tracked (7d)

Infrastructure

Distribution Infrastructure Type (7d)

Hosting 76% (3,622)
ISP 23% (1,089)
Education 0% (14)
Business 0% (7)
Government 0% (2)
Unknown 0% (2)

Distribution Hosting Countries (7d)

Country Hosts
  1. 1 🇺🇸 US 1,987
  2. 2 🇨🇳 CN 642
  3. 3 🇩🇪 DE 250
  4. 4 🇫🇷 FR 188
  5. 5 🇧🇷 BR 108
  6. 6 🇳🇱 NL 103
  7. 7 🇪🇸 ES 101
  8. 8 🇬🇧 GB 101
  9. 9 🇮🇹 IT 97
  10. 10 🇵🇰 PK 97
  11. 11 Other 1,062

Distribution Hosting Providers (7d)

Provider Hosts
  1. 1 Cloudflare, Inc. 548
  2. 2 CHINA UNICOM China169 Backbone 535
  3. 3 Oracle Corporation 226
  4. 4 Cloudflare London, LLC 210
  5. 5 Hostinger International Limited 168
  6. 6 Namecheap, Inc. 154
  7. 7 IONOS SE 142
  8. 8 OVH SAS 132
  9. 9 Google LLC 99
  10. 10 National WiMAX/IMS environment 87
  11. 11 Other providers 2,435

Top Malware by Distribution Hosts (7d)

Family Trend Hosts
  1. 1 SocGholish trending down 951
  2. 2 Remcos trending down 103
  3. 3 XWorm stable 97
  4. 4 SessionSerpent trending up 83
  5. 5 Cobalt Strike stable 78
  6. 6 Phorpiex stable 73
  7. 7 EvilTokens trending up 62
  8. 8 Kongtuke trending down 62
  9. 9 Xred trending up 61
  10. 10 QuasarRAT trending up 56

Top Malware by Distribution Hosts (24h)

Family Trend Hosts
  1. 1 SessionSerpent trending up 27
  2. 2 SocGholish trending down 14
  3. 3 Kongtuke trending down 11
  4. 4 Remcos trending down 10
  5. 5 XLoader trending down 9
  6. 6 EvilTokens trending up 8
  7. 7 PhantomStealer trending up 8
  8. 8 XWorm stable 8
  9. 9 Agent Tesla trending up 6
  10. 10 Cobalt Strike stable 6

Distribution Ports (7d)

Ports observed across live distribution hosts

  1. 1 80 3
  2. 2 2404 2
  3. 3 7000 1
  4. 4 1470 1
  5. 5 443 1

Network Fronting (7d)

How live hosts are reached, counted once each. A host can carry more than one.

  1. 1 hosting 3,667
  2. 2 anycast 1,062
  3. 3 proxy 248
  4. 4 vpn 73
  5. 5 mobile 19
  6. 6 residential proxy 18

All Tracked Malware (7d)

1-25 of 115 families
SocGholish 951 hosts - Jul 24, 2026 Remcos 103 hosts - Jul 24, 2026 XWorm 97 hosts - Jul 24, 2026 SessionSerpent 83 hosts - Jul 24, 2026 Cobalt Strike 78 hosts - Jul 24, 2026 Phorpiex 73 hosts - Jul 24, 2026 EvilTokens 62 hosts - Jul 24, 2026 Kongtuke 62 hosts - Jul 24, 2026 Xred 61 hosts - Jul 24, 2026 QuasarRAT 56 hosts - Jul 24, 2026 njRAT 55 hosts - Jul 24, 2026 AnimateClipper 54 hosts - Jul 24, 2026 SharpHound 51 hosts - Jul 24, 2026 StealC 50 hosts - Jul 24, 2026 AsyncRAT 49 hosts - Jul 24, 2026 XLoader 48 hosts - Jul 24, 2026 gh0st RAT 44 hosts - Jul 24, 2026 Amadey 42 hosts - Jul 24, 2026 XMRig 42 hosts - Jul 24, 2026 Redosdru 41 hosts - Jul 24, 2026 SALATSTEALER 41 hosts - Jul 24, 2026 destinystealer 40 hosts - Jul 24, 2026 Metasploit 38 hosts - Jul 24, 2026 RatonRAT 38 hosts - Jul 24, 2026 Mimikatz 36 hosts - Jul 24, 2026

Recent Research

We appreciate you

Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.

Hatching Triage opens in new tab IPinfo opens in new tab urlscan.io opens in new tab Mallory opens in new tab eCrime.ch opens in new tab ransomware.live opens in new tab