The world is online.
So are the threats.
Explore the live cyber threat map, compare observed source-IP activity and targeted services, follow cyber attack reports, track exploited vulnerabilities, and check real 30-day exploit probabilities — all in one beautifully connected security dashboard.
Not observed attack locations
Cyber Attacks Today — Situation Room
Explore current reported cyber incidents and separately observed network-source activity. Inspect reported actor associations, countries mentioned, affected technologies and impact signals — with linked evidence rather than invented attack routes.
Connecting to evidence feeds…
Select a reported incident or observed network source to inspect details.
Cyber Attack Today — Live Network Activity
Explore recent observed network-source reports from SANS Internet Storm Center/DShield sensors: country-level bars where location data is available, publicly reported source IPs, and the services targeted by scanning traffic. Only countries with observed records in this sample appear. IP location does not establish an attacker’s identity or nationality.
Observed activity by country
Ranked by reported packets from geolocated source IPs in the available SANS top-source sample. Bars represent observed reporting volume, not probabilities or the location of an attacker.
Targeted technologies & services
Destination ports reveal protocol or service categories, not a confirmed device brand or platform. Examples: SSH, Windows SMB, HTTPS, RDP.
Latest observed source IP reports
IP addresses appear because DShield sensors reported their traffic. Some sources may be legitimate research scanners or benign traffic. A report does not by itself prove malicious intent.
| Source IP | Approx. network origin | Reported packets | Target IPs |
|---|---|---|---|
| Connecting to reported source telemetry… | |||
Live threat intelligence overview
A one-minute browser refresh does not mean a new attack occurred. Intelligence source updates vary.
Cyber attack news & reports
Connecting to global news sources…
Known exploited vulnerabilities
Freshly listed CISA KEV entries with FIRST exploitation probability scores where available. These are documented CVEs, not simulated attacks.
CVE exploit probability checker
See a real, published prediction for a vulnerability — never a made-up percentage for your individual security.
How likely is this vulnerability to be exploited?
Enter a public CVE identifier. FIRST EPSS estimates the probability of exploitation in the wild over the next 30 days. We'll also check CISA's Known Exploited Vulnerabilities catalogue.
The EPSS number is about the CVE, not an individual website, company or country. Percentile is a relative ranking, not an additional probability.
Reduce your online attack exposure
Use this interactive self-check to identify easy protective steps. Your answers stay in the browser and are not uploaded.
What does a live cyber attack map show?
Learn what cyber threat tracking can and cannot tell you, before interpreting any animations or risk scores.
A cyber attack map is a visualization of cybersecurity activity. Some maps use actual telemetry from participating networks; others use samples, reports, aggregated statistics or illustrative trajectories. On NextWatch AI, the moving globe is a decorative visualization, while the data panels independently display public, source-attributed threat intelligence.
Cyber attack today: Our observed telemetry section shows recent DShield source IP reports and targeted network services; the news section separately monitors cyberattacks, ransomware and data breaches. Headlines do not prove a successful attack occurred, and publisher location is not the attack location. To independently confirm an incident, review an original advisory or affected organisation's disclosure.
Cyber threat tracker: CISA KEV entries are documented vulnerabilities known to have been exploited. FIRST EPSS gives an estimated 30-day exploitation probability for a specific CVE. An EPSS score does not estimate whether your own machine is compromised. These sources refresh on their own publication schedules rather than every minute.
Need an immediate security response? If you believe you've experienced an actual compromise, disconnect affected systems where appropriate, preserve evidence and follow your organisation's incident response procedure. For Australia, consult Australian Cyber Security Centre guidance.
Live cyber threat map FAQ
Is this a real-time cyber attack map?
The Cyber Radar page refreshes its intelligence feed every 60 seconds, but upstream providers publish at different intervals. The animated globe and connection trails are illustrative, not verified geolocated attacks.
Where does the cyber threat intelligence come from?
The dashboard displays observed network reports from SANS Internet Storm Center/DShield, known exploited vulnerabilities from US CISA KEV, 30-day CVE exploitation scores from FIRST EPSS, and media coverage from independent cybersecurity publishers and GDELT when available. Each source is identified and availability is shown.
What does a CVE exploit probability mean?
FIRST EPSS estimates the probability that a particular published CVE will be exploited in the wild during the next 30 days. It is not the probability that your device or business will be compromised.
Does a reported cyberattack mean it has been confirmed?
Not necessarily. News headlines are third-party media reports and should not be treated as verified incidents until corroborated. CISA KEV entries separately identify vulnerabilities with evidence of known exploitation.
How do I see where a cyber attack came from?
Select a source-backed incident in the Situation Room. The page shows any reported actor association, countries mentioned, headline-level sector and technology details, and a direct publisher link. The originating country of an attack is not shown as confirmed unless the evidence establishes it. DShield source-IP location is only an approximate network location and is not attacker attribution.
How often does the cyber threat map update?
Your browser requests fresh data every minute while the page is visible. The Netlify backend caches news and vulnerability feeds for about five minutes and SANS sensor data for at least one hour; upstream providers may update less often. We show the actual retrieval and publication times.
Can I check a vulnerability by CVE number?
Yes. Enter a CVE ID to retrieve the current FIRST EPSS 30-day exploitation estimate and check whether the identifier appears in the CISA Known Exploited Vulnerabilities catalogue.
NextWatch AI Cyber Radar is an independent information tool. Not affiliated with SANS ISC, CISA, FIRST, GDELT or any security vendor. Figures and availability vary with published source feeds; this is not a personal cyber-risk assessment.