What is real on this map, and what is not.

Every entry carries its source. Entries we write name an organization only with a primary source: its own statement, a regulator's record such as an SEC filing or a state attorney general's breach notice, or a court record. Without one, the entry is anonymized ("a US healthcare organization") and links that would reveal the name are not shown. News drafts are the exception: Claude writes their summary from the news report, so it can name what the report names. Ransomware entries are claims by a group, not confirmed attacks, and are worded that way.

Four kinds of entries go live without waiting for a person: anonymized ransomware claims from ransomware.live that include a country; breach notices from the SEC (8-K Item 1.05) and the California Attorney General, which name the organization because the regulator's record is the source; Have I Been Pwned breaches that link to the organization's own disclosure; and news drafts. Claude reads security headlines, writes a draft, looks on the web for a primary source, and the draft is published as written. They are marked "auto · unreviewed" until a person has reviewed them. If one turns out to be wrong, the correction is logged on the entry.

AI-era entries come two ways: entries we research and publish ourselves, each with its primary source, and news drafts that Claude finds in security headlines and that are published automatically. Drafts are marked "auto · unreviewed" until one of us has reviewed them.

Command-and-control servers and other malicious infrastructure listed by abuse.ch (Feodo Tracker, ThreatFox, URLhaus), placed by country with DB-IP geolocation. A dot means a malicious host was observed there in the last 24 hours, not that the country attacked anyone. A ring pulses when that host's event plays in the replay. Addresses are cut to a /24 and never shown.

Arcs are Cloudflare Radar's top origin-to-target country pairs over the last day: white for application-layer (L7) attacks, blue for network-layer DDoS. They are aggregates of traffic Cloudflare mitigated, weighted by share, not individual attacks.

"Live" replays the real events of the last hour at 60 times speed, with their real timestamps. New data arrives every 15 minutes. Nothing is invented to fill the gaps.

Each incident is tagged with the classes of tooling that work on its kind of problem. The companies listed under it come from the AI Security Startups Map (CC BY 4.0), which does not endorse this site. That is a taxonomy, not a claim that a product would have changed the incident. Paid placements are labelled "Sponsored". HeimWall builds and runs this site; its own product appears in its categories labelled "Operator".

No simulated traffic. No attacker IP addresses. No leak-site content. No links that would reveal an anonymized organization. No attribution stronger than the source supports.

If you represent an organization on this site and believe an entry is wrong, email founders@heimwall.ai. We answer within two business days and log corrections on the entry. How corrections and takedowns work.