Transparency Report

Where malware originates

Safe Browsing scans billions of websites to identify malicious sites. We discover these sites by searching thousands of autonomous systems (AS) across the Internet. Each AS is controlled by an organization that in turn is associated with a geographic location.

This is an archived version of the Safe Browsing Malware page. Due to an evolving threat landscape and shift in Malware behavior, the data in these charts is no longer representative.

For more granular reports about a specific site, visit our site status page. These charts were last updated on Apr 8, 2020.

Malware detected by autonomous system

This table lists malware distribution among autonomous systems scanned by Safe Browsing within a selected country/region for a given time period. Because Safe Browsing’s scanners are designed to seek out malware, they may only scan a small percentage of each AS, which we show in the far right column. An AS often carries the name of the entity that manages it, which is why you may see some familiar names on the AS lists below.

AS and scanned sites

search
System IDAutonomous systemNumber of sites scannedScanned sites hosting malware% of AS scanned
12824HOMEPL-AS PL755600%
12876Online SAS FR3,64090%
12989HWNG NL2,10302%
132203TENCENT-NET-AP-CN Tencent Building Kejizhongyi Avenue CN1,116110%
13335CLOUDFLARENET US92,4181450%
133774CHINATELECOM-FUJIAN-FUZHOU-IDC1 Fuzhou CN70571%
13768COGECO-PEER1 CA87160%
14061DIGITALOCEAN-ASN US8,119380%
14340SALESFORCE US1,50504%
14618AMAZON-AES US44,355111%

Filter by size to see all or only large autonomous systems. Both attack sites and compromised sites are displayed by default.

Autonomous system scan history

This chart depicts malware distribution based on the percentage of the AS our systems scan over time. The percentage of sites that we scan is affected by changes to our sampling algorithms, so we also provide a view of the number of scanned sites where we detect malware. You may see spikes in these charts because the efficacy of various malware techniques can change very quickly.

Malware distribution over time: HOMEPL-AS PL

Attack sitesCompromised sitesFeb 01, 2020Apr 01, 2020Feb 10, 2020Feb 24, 2020Mar 09, 2020Mar 23, 20200%2%4%6%8%10%12%14%16%18%
WeekAttack sitesCompromised sites
Jan 19, 20202%11%
Jan 26, 20200%13%
Feb 2, 20201%10%
Feb 9, 20201%14%
Feb 16, 20200%17%
Feb 23, 20200%14%
Mar 1, 20200%13%
Mar 8, 20201%17%
Mar 15, 20200%11%
Mar 22, 20201%11%
Mar 29, 20200%10%
Apr 5, 20200%7%