A screenshot from the National Security Agency’s Boundless Informant visualization tool shows that the NSA was heavily focusing its network hacking efforts in 2013 on Iran and Pakistan. All the while, the NSA also had active “computer network exploits” within the United States. The new document, published by Der Spiegel, is part of 53 documents recently released from the Edward Snowden cache, which appears to be from the same set initially released a year ago in Glenn Greenwald’s first article on Boundless Informant from June 2013.

The new “heatmap” from Boundless Informant, which provides the NSA a way to analyze the volume of data and distribution of sources that it is being collected from, shows “computer network exploitation” activity over an unspecified 30-day period in 2013. During the displayed period, Pakistan appears to have been the target of most of the NSA’s network hacking activity, displaying red on the heat map of intelligence activity. Iran appears to be the second most active country for the period, appearing in orange.

But the NSA’s network exploits weren’t all overseas. The screenshot shows a number over the US for active computer network exploitations within the 30 day period: 289. The United States appears to be as active a location for network exploitation operations for the NSA as Russia, though it was more active in exploits against networks in China, Germany, and Yemen.

The hacking operations by the NSA in the US, based on other data in the Spiegel document dump, appeared to be focused on foreign-operated websites, embassies, and Internet exchange points for overseas cables. Another report from Boundless Informant details the NSA’s collection operations in the US.

The top data collection point for the period in the US was an IP address belonging to Hosting Services, Inc. in Providence, Utah. A Domain Name Service record for the address shows it was previously associated with a domain registered by a company based in Xiamen, China. Other top sources included another hosting server at the same Providence, Utah data center operated by Midphase and a server for the network provider nLayer Communications.