🇦🇫 Afghanistan: live cyber threat activity

Malicious IPs, malware and ransomware victims in Afghanistan.

45Malicious IPs listed#69 of 182 countries · 0.07% of the world

11New in the last 24hfirst seen by any feed

25Reported by 2+ feedsindependent sources agree

0Ransomware victimsposted in the last 30 days

View Afghanistan on the live map →All listed IPs in Afghanistan

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

By state or region

Kandahar26
Kabul11
Paktia3
Balkh2
Herat1
Baghlan1
Jowzjan1

By city

Kandahar15
Kabul11
Spin Boldak11
Gardez3
Mazari Sharif2
Herat1
Pul-e Khumrī1
Darzab1

Networks hosting the most

Network	IPs
AS55330 Government Communications Network	39
AS58469 Ministry of Communication & IT	1
AS135376 Rahanet Internet Service Provider	1
AS133202 Afghanistan Faiz Satellite Communications	1
AS136479 Cyber Telecom ISP	1
AS133076 Unique Atlantic Telecommunication	1
AS45178 Telecom Development Company Afghanistan	1

Malware families served from Afghanistan

Phorpiex1
Gandcrab1

Most recently reported

IP	Role	Family / threat	Where	Network	Reported by	Last reported (UTC)
149.54.36[.]187	Attacker	Attacking host	Kabul, Kabul	AS55330 Government Communications Network	1 feed	2026-10-12 08:20
180.94.75[.]202	Attacker	Attacking host	Kandahar, Kandahar	AS55330 Government Communications Network	1 feed	2026-10-12 07:15
149.54.35[.]210	Malware	Phorpiex	Mazari Sharif, Balkh	AS55330 Government Communications Network	1 feed · 27 sandbox samples	2026-10-12 06:58
116.204.162[.]5	Attacker	Attacking host	Pul-e Khumrī, Baghlan	AS133076 Unique Atlantic Telecommunication	1 feed	2026-10-12 06:10
103.216.160[.]173	Attacker	Attacking host	Herat, Herat	AS135376 Rahanet Internet Service Provider	2 feeds	2026-10-12 04:35
149.54.28[.]242	Attacker	Attacking host	Darzab, Jowzjan	AS55330 Government Communications Network	2 feeds	2026-10-12 04:35
180.94.75[.]102	Attacker	Attacking host	Kandahar, Kandahar	AS55330 Government Communications Network	2 feeds	2026-10-12 04:35
103.227.17[.]10	Attacker	Attacking host	Kabul, Kabul	AS133202 Afghanistan Faiz Satellite Communications	2 feeds	2026-10-12 04:35
149.54.62[.]134	Attacker	Attacking host	Spin Boldak, Kandahar	AS55330 Government Communications Network	2 feeds	2026-10-12 04:35
149.54.62[.]158	Attacker	Attacking host	Spin Boldak, Kandahar	AS55330 Government Communications Network	2 feeds	2026-10-12 04:35
149.54.51[.]74	Attacker	Attacking host	Kandahar, Kandahar	AS55330 Government Communications Network	3 feeds	2026-10-11 23:35
149.54.62[.]114	Attacker	Attacking host	Spin Boldak, Kandahar	AS55330 Government Communications Network	2 feeds	2026-10-09 04:27
149.54.62[.]162	Attacker	Attacking host	Spin Boldak, Kandahar	AS55330 Government Communications Network	2 feeds	2026-10-09 04:27
149.54.62[.]254	Attacker	Attacking host	Spin Boldak, Kandahar	AS55330 Government Communications Network	2 feeds	2026-10-09 04:27
180.94.74[.]122	Attacker	Attacking host	Kabul, Kabul	AS55330 Government Communications Network	2 feeds	2026-10-09 04:27
180.94.75[.]114	Attacker	Attacking host	Kandahar, Kandahar	AS55330 Government Communications Network	2 feeds	2026-10-09 04:27
180.94.75[.]90	Attacker	Malicious IP	Kandahar, Kandahar	AS55330 Government Communications Network	1 feed	2026-10-09 04:27
180.94.76[.]126	Attacker	Attacking host	Kandahar, Kandahar	AS55330 Government Communications Network	2 feeds	2026-10-09 04:27
103.132.98[.]160	Attacker	Attacking host	Kabul, Kabul	AS58469 Ministry of Communication & IT	1 feed	2026-10-09 04:27
149.54.40[.]182	Attacker	Attacking host	Gardez, Paktia	AS55330 Government Communications Network	1 feed	2026-10-09 04:27
180.94.75[.]146	Attacker	On multiple blocklists	Kandahar, Kandahar	AS55330 Government Communications Network	1 feed	2026-10-09 04:27
180.94.82[.]94	Malware	Gandcrab	Kabul, Kabul	AS55330 Government Communications Network	1 feed · 2 sandbox samples	2026-10-07 05:28
103.89.153[.]26	Attacker	Attacking host	Kabul, Kabul	AS136479 Cyber Telecom ISP	2 feeds	—
149.54.15[.]162	Attacker	Attacking host	Kabul, Kabul	AS55330 Government Communications Network	2 feeds	—
149.54.17[.]122	Attacker	Attacking host	Kabul, Kabul	AS55330 Government Communications Network	1 feed	—

See every listed IP in Afghanistan →

Ransomware victims in Afghanistan

No ransomware victims from Afghanistan posted in the last 90 days.