🇧🇷 Brazil: live cyber threat activity

Malicious IPs, malware and ransomware victims in Brazil.

1,416Malicious IPs listed#9 of 182 countries · 2.14% of the world
311New in the last 24hfirst seen by any feed
591Reported by 2+ feedsindependent sources agree
32Ransomware victimsposted in the last 30 days

View Brazil on the live map →All listed IPs in BrazilRansomware victims in Brazil

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

  1. C234
  2. Malware111
  3. Phishing0
  4. Attacker1,271

By state or region

  1. São Paulo527
  2. Minas Gerais257
  3. Rio Grande do Sul87
  4. Rio de Janeiro73
  5. Paraná73
  6. Goiás54
  7. Santa Catarina54
  8. Bahia50
  9. Pernambuco41
  10. Pará39
  11. Espírito Santo31
  12. Ceará27
  13. Paraíba16
  14. Federal District16
  15. Mato Grosso do Sul15

By city

  1. São Paulo165
  2. Divinópolis57
  3. São José do Rio Preto47
  4. Américo de Campos32
  5. Santa Rita do Sapucaí25
  6. Itajubá24
  7. Novo Progresso23
  8. Goiânia15
  9. Álvares Florence14
  10. Delfim Moreira13
  11. Guarulhos12
  12. Rio de Janeiro12
  13. Mateus Leme12
  14. Mogi das Cruzes11
  15. Hortolândia11

Networks hosting the most

NetworkIPs
AS28202 Rede Brasileira de Comunicacao S/A 148
AS28573 Claro NXT Telecomunicacoes Ltda 105
AS18881 TELEFÔNICA BRASIL S.A 56
AS270368 TR TELECOMUNICACOES LTDA 46
AS10429 TELEFÔNICA BRASIL S.A 43
AS27699 TELEFÔNICA BRASIL S.A 32
AS26599 TELEFÔNICA BRASIL S.A 32
AS7738 V tal 25
AS52626 NovaNet Provedor e Web Ltda 23
AS8167 V tal 20
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED 16
AS28343 UNIFIQUE TELECOMUNICACOES S/A 16
AS31898 Oracle Corporation 15
AS263579 ISUPER TELECOMUNICACOES INFO LTDA 13
AS396982 Google LLC 13

Malware families served from Brazil

  1. DanaBot7
  2. Jackskid7
  3. W97m6
  4. Remcos3
  5. Potassium3
  6. Blocker3
  7. Emotet3
  8. AdaptixC22
  9. Loki2
  10. Havoc2
  11. PureRAT2
  12. Sality2
  13. Utorrent2
  14. Danabot1
  15. DCRat1

Most recently reported

IPRoleFamily / threatWhereNetworkReported byLast reported (UTC)
170.245.250[.]151AttackerAttacking hostGoiânia, GoiásAS266032 T.A.LUIZ ELETRONICO LTDA - ME1 feed2026-10-12 08:20
177.23.208[.]121AttackerAttacking hostPantano Grande, Rio Grande do SulAS262903 Tubaron Telecom1 feed2026-10-12 08:20
34.95.246[.]208AttackerAttacking hostSão Paulo, São PauloAS396982 Google LLC1 feed2026-10-12 08:20
34.95.255[.]126AttackerAttacking hostSão Paulo, São PauloAS396982 Google LLC1 feed2026-10-12 08:20
147.45.116[.]134MalwareMalware downloadSão Paulo, São PauloAS215540 GLOBAL CONNECTIVITY SOLUTIONS LLPaggregated list2026-10-12 08:14
16.5.0[.]224AttackerAttacking hostSão Paulo, São PauloAS401661 EMBNEX, LLC1 feed2026-10-12 08:10
16.5.0[.]240AttackerAttacking hostSão Paulo, São PauloAS401661 EMBNEX, LLC1 feed2026-10-12 08:10
179.109.151[.]130AttackerAttacking hostGuaçuí, Espírito SantoAS263585 DIGITAL NET RJ TELECOM EIRELI1 feed2026-10-12 08:10
189.29.145[.]117AttackerAttacking hostSão Bernardo do Campo, São PauloAS28573 Claro NXT Telecomunicacoes Ltda1 feed2026-10-12 07:55
95.214.26[.]28MalwareGhomSão Paulo, São PauloAS212238 Datacamp Limited1 feed · 209 sandbox samples2026-10-12 07:53
35.198.46[.]37AttackerAttacking hostSão Paulo, São PauloAS396982 Google LLC1 feed2026-10-12 07:50
35.198.46[.]50AttackerAttacking hostSão Paulo, São PauloAS396982 Google LLC1 feed2026-10-12 07:50
170.84.181[.]70MalwareChapakItamaraju, BahiaAS265015 R&R Virtual Informatica1 feed · 75 sandbox samples2026-10-12 07:26
177.126.216[.]227AttackerAttacking hostItaporanga, ParaíbaAS263522 LGNET SERVICOS DE TELECOMUNICACOES LTDA1 feed2026-10-12 07:15
177.44.96[.]132AttackerAttacking hostSanta Rita do Sapucaí, Minas GeraisAS28202 Rede Brasileira de Comunicacao S/A1 feed2026-10-12 07:15
45.184.48[.]247AttackerAttacking hostTapejara, ParanáAS269314 GIACOMETTI & GIACOMETTI LTDA ME1 feed2026-10-12 07:15
177.22.87[.]128AttackerAttacking hostIbirubá, Rio Grande do SulAS52892 COPREL TELECOM LTDA1 feed2026-10-12 06:41
80.75.221[.]167AttackerAttacking hostSão Paulo, São PauloAS48925 VibeGAMES B.V.1 feed2026-10-12 06:41
177.188.141[.]53AttackerAttacking hostSão Paulo, São PauloAS27699 TELEFÔNICA BRASIL S.A1 feed2026-10-12 06:10
179.104.1[.]120AttackerAttacking hostPrata, Minas GeraisAS53006 ALGAR TELECOM S/A1 feed2026-10-12 06:10
179.104.179[.]57AttackerAttacking hostUberlândia, Minas GeraisAS53006 ALGAR TELECOM S/A1 feed2026-10-12 06:10
189.18.97[.]134AttackerAttacking hostSão Paulo, São PauloAS27699 TELEFÔNICA BRASIL S.A1 feed2026-10-12 06:10
189.51.216[.]208AttackerAttacking hostTatuí, São PauloAS28580 Cilnet Comunicação e Informática S.A.1 feed2026-10-12 06:10
201.94.147[.]172AttackerAttacking hostJaru, RondôniaAS271487 FIBRACONN SERVIÇOS DE TELECOMUNICACOES LTDA1 feed2026-10-12 06:10
45.183.19[.]219AttackerAttacking hostItapevi, São PauloAS269254 Sol Telecomunicações1 feed2026-10-12 06:10

See every listed IP in Brazil →

Ransomware victims in Brazil

32 posted in the last 30 days, 83 in 90.

Posted (UTC)VictimGroupSector
2026-10-09 13:31AETHOSarcusmedia—
2026-10-09 12:59iDentalSofttermiteHealthcare
2026-10-08 21:36SOCOCOUmBraTechnology
2026-10-08 21:21dipecarr.com.brEclipseManufacturing
2026-10-08 14:22DIPECARREclipseOther
2026-10-07 23:29Petrosul Distribuidora, Transportadora e Comércio de Combustíveis Ltda.dragonforceEnergy & Utilities
2026-10-05 11:08MillensysmedusalockerTechnology
2026-10-04 14:30SoftruckdirewolfTechnology
2026-10-02 18:25PaessolucoesPanzerOther
2026-10-02 14:59Jampac AlimentosakiraAgriculture and Food Production
2026-10-01 14:50FUNAP - Fundação "Prof. Dr. Manoel Pedro Pimentel"Booba ProjectGovernment & Defense
2026-10-01 14:30TercaransomhouseOther
2026-09-29 15:51latitudesubro.comBrainCipherManufacturing
2026-09-29 10:36somasolucoes.comm3rxProfessional Services
2026-09-29 06:00camorim.com.brlockbit5Retail & E-Commerce

All ransomware victims in Brazil →

Other countries