SYSMarshal Threat Intelligence

What this data shows

As of 6 November 2026, Windows servers and PCs protected by SYSMarshal have blacklisted 7,372 distinct attacking IP addresses from 126 countries, with 6 new reports so far today and 216 in the last seven days. The most frequent sources are United States (7,410 reports), The Netherlands (1,015) and China (1,008). The most targeted service is port 443 (HTTPS), and the most common attack type is Port Scanning.

How this data is collected

• Source. When SYSMarshal blacklists an address on a protected machine — automatically, after it crosses that machine’s threat threshold, or by an analyst — the address is reported to the SYSMarshal cloud. This page aggregates that shared blacklist: the same community data behind SYSMarshal’s Global data view and Auto-Inoculation.
• Attack type comes from the Windows event that triggered the block (for example event 4625, a failed logon) or, for network events, from the targeted port (3389 for RDP, 22 for SSH, 80/443 for web).
• Country is resolved from the IP address with a geolocation database. It shows where the address is registered, which for VPNs, proxies and cloud servers is not necessarily where the attacker is.
• Counts. “IPs blacklisted” counts distinct addresses. Country, port, attack-type and per-IP figures count reports, so an address reported by several machines is counted once per report. In the recent-activity table, an address is Critical above 100 reports, High above 50 and Medium above 10.
• Privacy. Only the attacking address and its derived details are published. Which customer or machine reported an address is never shown — see the Privacy Notice.
• Freshness. Headline figures refresh hourly, the recent-activity feed and 7-day timeline every 30 minutes, and the country, port, attack-type and map aggregates daily. Headline figures were last updated 6 Nov 2026, 16:36 UTC.

Want these attackers blocked on your own servers before they reach you? Start a 30-day trial or read how SYSMarshal works.