Global view
Attacks in progress
Campaigns ONYX is watching assemble right now, with where they come from and the community they land in. No dot is a person: each one is a link being spread.
Attacks in progressMAP-0329
LiveAttacks in progress
Credential theftSession theftFake giftIP loggerMalware distribution
Malware distributionChina → Spainurlhaus
Malware distributionChina → Germanyurlhaus
Malware distributionGermany → United Statesurlhaus
Malware distributionGermany → Brazilurlhaus
Malware distributionUnited States → Spainurlhaus
Malware distributionUnited States → Germanyurlhaus
Malware distributionChina → Brazilurlhaus
Malware distributionGermany → Spainurlhaus
What it does not doGEO-0330
The map is drawn from what ONX-15 already knows: you do not need to know who posted a link to know it is being spread.
Positions come from the country of the connection, the only geographic thing that reaches us. No address, no city and no person behind any dot.
Dashed routes come from public lists of malicious URLs (abuse.ch). Solid ones were seen by ONYX connectors. Region the address block was allocated to, not an exact location.