Tracker · updated 22 October 2026
Every day, researchers report thousands of new fake login pages and addresses that spread malware. This map shows how many there are per country, and which criminal sites police and prosecutors took down this year. We only show numbers. No addresses at all, so you can't accidentally click a bad link here.
Drag to spin the globe, scroll or pinch to zoom. Tap or click a country for details.
A selection of this year's major operations, each with a link to the press release. The number of sites is the figure the police or prosecutors gave themselves. On the map, we count how many of these operations each country took part in.
Seven domains seized that were used to scan networks and deliver malware through spear-phishing.
Source: U.S. Department of Justice
The leak site of ransomware group KillSec was seized; visitors now see a police banner. Police took control of five servers. The investigation was led by Germany.
Source: ERSOU (UK police)
Domains of the Sality botnet seized in the US and Europe.
Source: U.S. Department of Justice
142 domains and 326 servers that spread malware were taken down. Almost 15,000 infected websites were also cleaned up.
Source: Europol
25 domains of a money-laundering service and a criminal forum taken offline; the sites now show a seizure notice.
Source: Europol
Dutch police and the NCSC had 200 botnet servers taken offline at a Dutch hosting provider.
Source: Dutch police
A criminal VPN service was dismantled: three domains and their onion addresses seized, 33 servers taken offline.
Source: Europol
53 domains of DDoS-for-hire services taken offline during an action week involving 21 countries.
Source: Europol
The service's website was taken over and its infrastructure taken offline, in an operation led by the Limburg police in the Netherlands.
Source: Dutch police
More than 373,000 fraudulent dark web sites taken offline, all run by a single operator. Led by Germany, with 23 countries taking part.
Source: Europol
330 domains hosting fake login pages and admin panels taken offline. Tycoon 2FA was built to get around two-factor authentication.
Source: Europol
The forum's domain was seized; visitors now see a police page. The investigation was led by the Amsterdam police.
Source: Europol
We keep this list by hand and only add operations with a public press release. Missing one? Email info@webcontroleur.nl.
A fake page posing as your bank, your email provider or an online shop, built to steal your password or money. The country is where the server hosting that page is located. It says nothing about where the scammer lives.
An address where harmful software is waiting to be downloaded. Often it sits on an ordinary website that was hacked because its software hadn't been updated in years. We only show addresses that are still online, plus how many were added in the last 30 days.
Websites and domains that police or prosecutors seized or had taken offline. There's no tidy daily list of these, so we collect them ourselves from press releases.
To be fair: this isn't a complete count of the whole internet. These are the reports that reach two public databases. Countries with lots of data centres, such as the US, Germany and the Netherlands, score high because of that. Not because they're less safe, but because that's where many servers are. We count malware in 71 countries: all of Europe plus the biggest hosting countries elsewhere.
And your own site?
Many hacked websites were simply the site of a bakery, a sports club or a local installer. Built properly once, then never updated again. We check from the outside whether your site still runs on an old version with known holes. You get the report by email, in plain language. The check is run from the Netherlands and the request form is in Dutch.
Request the free check →Figures from 22 October 2026. The map is refreshed daily. If a source fails on a given day, the previous day's figures stay up.