🇧🇬 Bulgaria: live cyber threat activity

Malicious IPs, malware and ransomware victims in Bulgaria.

203Malicious IPs listed#32 of 182 countries · 0.31% of the world
49New in the last 24hfirst seen by any feed
65Reported by 2+ feedsindependent sources agree
4Ransomware victimsposted in the last 30 days

View Bulgaria on the live map →All listed IPs in BulgariaRansomware victims in Bulgaria

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

  1. C225
  2. Malware51
  3. Phishing0
  4. Attacker127

By state or region

  1. Sofia-grad110
  2. Plovdiv36
  3. Burgas21
  4. Stara Zagora7
  5. Blagoevgrad5
  6. Haskovo5
  7. Montana4
  8. Pernik3
  9. Veliko Tarnovo2
  10. Sofia2
  11. Kyustendil2
  12. Sliven2
  13. Pleven1
  14. Vratsa1
  15. Yambol1

By city

  1. Sofia105
  2. Sopot30
  3. Karnobat14
  4. Blagoevgrad5
  5. Sredets5
  6. Enina5
  7. Montana4
  8. Dimitrovgrad4
  9. Plovdiv3
  10. Kokalyane3
  11. Chelopechene2
  12. Pernik2
  13. Topolovo2
  14. Klimentovo1
  15. Samokov1

Networks hosting the most

NetworkIPs
AS50360 Tamatiya EOOD 28
AS200475 ET VESELIN JELQZKOV 19
AS8866 Vivacom Bulgaria EAD 16
AS211443 SINO WORLDWIDE TRADING LIMITED 12
AS204428 SS-Net 10
AS213035 Des Capital B.V. 8
AS41313 "NOVATEL" EOOD 8
AS211619 MAXKO d.o.o. 6
AS209604 2E TELEKOMUNIKASYON LTD STI 5
AS42293 ET PAVLIN ILIEV - AVALA 5
AS202737 TRANSACT EUROPE EAD 5
AS208637 4 Vendeta Ltd 5
AS20911 Net-Surf.net Ltd. 4
AS8717 A1 Bulgaria EAD 4
AS57509 L&L Investment Ltd. 4

Malware families served from Bulgaria

  1. Remcos5
  2. Fragtor4
  3. PureRAT4
  4. AsyncRAT3
  5. Scar3
  6. Crifi2
  7. Zard2
  8. Privateloader2
  9. SupremeBot1
  10. Antiloadr1
  11. Nimplant1
  12. Gandcrab1
  13. LxBase RAT1
  14. Mirai1
  15. Mokes1

Most recently reported

IPRoleFamily / threatWhereNetworkReported byLast reported (UTC)
91.92.41[.]164:2404C2RemcosSofia, Sofia-gradAS211443 SINO WORLDWIDE TRADING LIMITED1 feed2026-10-12 08:05
111.90.156[.]58MalwareAntiloadrSofia, Sofia-gradAS45839 Shinjiru Technology Sdn Bhd1 feed · 335 sandbox samples2026-10-12 07:53
194.169.175[.]118MalwareGhomMontana, MontanaAS20911 Net-Surf.net Ltd.1 feed · 231 sandbox samples2026-10-12 07:53
194.49.94[.]72MalwareContacted by malwareSofia, Sofia-gradAS213035 Des Capital B.V.1 feed · 146 sandbox samples2026-10-12 07:53
194.49.94[.]77MalwareSmokeloaderSofia, Sofia-gradAS213035 Des Capital B.V.1 feed · 85 sandbox samples2026-10-12 07:53
91.92.68[.]86AttackerAttacking hostKotel, SlivenAS34295 Geo BG Net SPLtd.1 feed2026-10-12 07:50
185.216.70[.]222MalwareMokesSofia, Sofia-gradAS16509 Amazon.com, Inc.1 feed · 251 sandbox samples2026-10-12 06:58
185.255.215[.]36AttackerAttacking hostKarnobat, BurgasAS200475 ET VESELIN JELQZKOV1 feed2026-10-12 05:35
87.227.143[.]150AttackerAttacking hostSofia, Sofia-gradAS29580 A1 Bulgaria EAD1 feed2026-10-12 05:35
45.12.253[.]56MalwareFragtorSofia, Sofia-gradAS202737 TRANSACT EUROPE EAD1 feed · 942 sandbox samples2026-10-12 04:45
45.12.253[.]72MalwareFragtorSofia, Sofia-gradAS202737 TRANSACT EUROPE EAD1 feed · 241 sandbox samples2026-10-12 04:45
45.12.253[.]75MalwareFragtorSofia, Sofia-gradAS202737 TRANSACT EUROPE EAD1 feed · 179 sandbox samples2026-10-12 04:45
45.12.253[.]98MalwareFragtorSofia, Sofia-gradAS202737 TRANSACT EUROPE EAD1 feed · 206 sandbox samples2026-10-12 04:45
156.146.55[.]195AttackerAttacking hostSofia, Sofia-gradAS212238 Datacamp Limited2 feeds2026-10-12 04:35
158.173.89[.]63AttackerAttacking hostSofia, Sofia-gradAS212238 Datacamp Limited2 feeds2026-10-12 04:35
185.253.159[.]81AttackerAttacking hostBlagoevgrad, BlagoevgradAS42293 ET PAVLIN ILIEV - AVALA2 feeds2026-10-12 04:35
185.255.212[.]68AttackerAttacking hostKarnobat, BurgasAS200475 ET VESELIN JELQZKOV2 feeds2026-10-12 04:35
2a14[:]c380[:]90[:]5f[:][:]aAttackerMalicious IPSofia, Sofia-gradAS211507 Julian Achter1 feed2026-10-12 04:35
45.137.201[.]95AttackerMalicious IPSofia, Sofia-gradAS211507 Julian Achter1 feed2026-10-12 04:35
45.9.156[.]183AttackerAttacking hostSofia, Sofia-gradAS211619 MAXKO d.o.o.2 feeds2026-10-12 04:35
62.60.134[.]142AttackerAttacking hostEnina, Stara Zagora 3 feeds2026-10-12 04:35
77.85.171[.]68AttackerAttacking hostAsenovgrad, PlovdivAS207371 GEC BG Ltd.2 feeds2026-10-12 04:35
77.85.204[.]35AttackerAttacking hostSofia, Sofia-gradAS8866 Vivacom Bulgaria EAD2 feeds2026-10-12 04:35
80.94.95[.]114AttackerAttacking hostSofia, Sofia-gradAS204428 SS-Net2 feeds2026-10-12 04:35
80.94.95[.]115AttackerCompromised hostSofia, Sofia-gradAS204428 SS-Net3 feeds2026-10-12 04:35

See every listed IP in Bulgaria →

Ransomware victims in Bulgaria

4 posted in the last 30 days, 7 in 90.

Sectors hit (30 days)

Groups (30 days)

Posted (UTC)VictimGroupSector
2026-09-29 15:21wildmanbg.comBrainCipherOther
2026-09-23 07:39AbvmedusalockerOther
2026-09-15 07:15Balkan PolymersthegentlemenManufacturing
2026-09-15 07:08Apteki MareshkithegentlemenHealthcare
2026-09-11 10:53Konica Minolta BulgariaPanzerManufacturing
2026-07-19 18:03eurohold.bgkrybitFinancial Services
2026-07-18 16:26euroins.bgkrybitFinancial Services

All ransomware victims in Bulgaria →

Other countries

🇺🇸 United States 17,807🇨🇳 China 10,752🇩🇪 Germany 4,042🇬🇧 United Kingdom 3,668🇷🇺 Russia 3,582🇳🇱 Netherlands 2,247🇮🇳 India 2,068🇫🇷 France 1,538🇧🇷 Brazil 1,416🇸🇬 Singapore 1,330🇭🇰 Hong Kong 1,319🇰🇷 South Korea 1,306🇮🇩 Indonesia 1,189🇵🇰 Pakistan 880🇨🇦 Canada 867🇧🇪 Belgium 726🇯🇵 Japan 704🇺🇦 Ukraine 671🇵🇱 Poland 560🇿🇦 South Africa 557🇻🇳 Vietnam 546🇲🇾 Malaysia 523🇮🇹 Italy 405🇸🇪 Sweden 378All countries →