🇨🇦 Canada: live cyber threat activity

Malicious IPs, malware and ransomware victims in Canada.

867Malicious IPs listed#15 of 182 countries · 1.31% of the world
394New in the last 24hfirst seen by any feed
136Reported by 2+ feedsindependent sources agree
26Ransomware victimsposted in the last 30 days

View Canada on the live map →All listed IPs in CanadaRansomware victims in Canada

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

  1. C234
  2. Malware73
  3. Phishing0
  4. Attacker760

By state or region

  1. Quebec527
  2. Ontario271
  3. British Columbia40
  4. Alberta17
  5. Manitoba6
  6. Saskatchewan3
  7. New Brunswick2
  8. Nova Scotia1

By city

  1. Beauharnois416
  2. Toronto180
  3. Montreal85
  4. Brampton35
  5. Vancouver14
  6. Cranbrook8
  7. Calgary6
  8. Vaughan5
  9. Québec5
  10. Winnipeg5
  11. London5
  12. Pointe-Claire4
  13. Edmonton4
  14. Caesarea4
  15. Lindsay4

Networks hosting the most

NetworkIPs
AS16276 OVH SAS 370
AS14061 DigitalOcean, LLC 90
AS209334 Modat B.V. 74
AS41564 Orion Network Limited 35
AS13335 Cloudflare, Inc. 23
AS852 TELUS Communications Inc. 21
AS7311 Frontier Networks 17
AS396982 Google LLC 16
AS577 Bell Canada 14
AS6327 Shaw Communications 14
AS26832 Rica Web Services 12
AS5769 Videotron Ltee 12
AS16509 Amazon.com, Inc. 10
AS63949 Akamai Technologies, Inc. 10
AS812 Rogers Communications Canada Inc. 10

Malware families served from Canada

  1. Cobalt Strike6
  2. PureRAT5
  3. Evilginx5
  4. AsyncRAT4
  5. Coinhelper3
  6. Opencandy2
  7. PoshC22
  8. Msilheracles2
  9. Sybici2
  10. Remcos2
  11. Sality2
  12. Havoc2
  13. Dacic1
  14. DCRat1
  15. Cerbu1

Most recently reported

IPRoleFamily / threatWhereNetworkReported byLast reported (UTC)
174.0.205[.]170AttackerAttacking hostCalgary, AlbertaAS6327 Shaw Communications2 feeds2026-10-12 08:20
96.125.137[.]54AttackerOn multiple blocklistsToronto, OntarioAS7311 Frontier Networks1 feed2026-10-12 08:20
137.184.172[.]134AttackerAttacking hostMilton, OntarioAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
138.197.143[.]55AttackerAttacking hostToronto, OntarioAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
142.93.154[.]115AttackerAttacking hostToronto, OntarioAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
143.110.209[.]198AttackerAttacking hostToronto, OntarioAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
143.110.213[.]194AttackerAttacking hostToronto, OntarioAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
146.190.245[.]102AttackerAttacking hostToronto, OntarioAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
159.203.27[.]11AttackerAttacking hostToronto, OntarioAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
159.203.27[.]154AttackerAttacking hostToronto, OntarioAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
159.203.28[.]134AttackerAttacking hostToronto, OntarioAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
159.203.60[.]181AttackerAttacking hostToronto, OntarioAS14061 DigitalOcean, LLC2 feeds2026-10-12 08:10
165.227.35[.]36AttackerAttacking hostAurora, OntarioAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
167.99.185[.]195AttackerAttacking hostCalgary, AlbertaAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
178.128.227[.]164AttackerAttacking hostToronto, OntarioAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
178.128.239[.]223AttackerAttacking hostWaterford, OntarioAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
15.235.96[.]231AttackerAttacking hostBeauharnois, QuebecAS16276 OVH SAS1 feed2026-10-12 07:50
15.235.98[.]214AttackerAttacking hostBeauharnois, QuebecAS16276 OVH SAS1 feed2026-10-12 07:50
15.235.98[.]97AttackerAttacking hostBeauharnois, QuebecAS16276 OVH SAS1 feed2026-10-12 07:50
35.203.112[.]169AttackerAttacking hostMontreal, QuebecAS396982 Google LLC1 feed2026-10-12 07:50
35.203.83[.]71AttackerAttacking hostMontreal, QuebecAS396982 Google LLC1 feed2026-10-12 07:50
51.161.37[.]56AttackerAttacking hostBeauharnois, QuebecAS16276 OVH SAS1 feed2026-10-12 07:50
54.39.0[.]49AttackerAttacking hostBeauharnois, QuebecAS16276 OVH SAS1 feed2026-10-12 07:50
104.247.81[.]99MalwareDacicWindsor, OntarioAS206834 Team Internet AG1 feed · 160 sandbox samples2026-10-12 07:26
13.248.169[.]48MalwareVoolsMontreal, QuebecAS16509 Amazon.com, Inc.1 feed · 1,329 sandbox samples2026-10-12 07:26

See every listed IP in Canada →

Ransomware victims in Canada

26 posted in the last 30 days, 91 in 90.

Sectors hit (30 days)

Groups (30 days)

Posted (UTC)VictimGroupSector
2026-10-11 18:53Company #14N0n—
2026-10-09 19:25Husky LteethegentlemenOther
2026-10-09 19:25Asessippi Ski ResortthegentlemenHospitality
2026-10-09 19:23Northwestern PolytechnicthegentlemenEducation
2026-10-09 13:30mblllparcusmedia—
2026-10-08 05:25Cooperative Des Techniciens Ambulanciers De La MonteStormHealthcare
2026-10-05 09:54Company #2N0nFinancial Services
2026-10-04 15:06Nipigon District Memorial HospitalStormHealthcare
2026-10-03 06:26RotamacthegentlemenManufacturing
2026-10-02 12:50Soni Medical CentreBooba ProjectHealthcare
2026-09-30 12:52MCAP — MortgageHub commercial lending platformN0nFinancial Services
2026-09-29 09:42cpacb.comm3rxProfessional Services
2026-09-28 10:59ATCO LtdmedusalockerEnergy & Utilities
2026-09-27 17:02IslandqilinTechnology
2026-09-26 08:48Metalware CorporationthegentlemenManufacturing

All ransomware victims in Canada →

Other countries

🇺🇸 United States 17,807🇨🇳 China 10,752🇩🇪 Germany 4,042🇬🇧 United Kingdom 3,668🇷🇺 Russia 3,582🇳🇱 Netherlands 2,247🇮🇳 India 2,068🇫🇷 France 1,538🇧🇷 Brazil 1,416🇸🇬 Singapore 1,330🇭🇰 Hong Kong 1,319🇰🇷 South Korea 1,306🇮🇩 Indonesia 1,189🇵🇰 Pakistan 880🇧🇪 Belgium 726🇯🇵 Japan 704🇺🇦 Ukraine 671🇵🇱 Poland 560🇿🇦 South Africa 557🇻🇳 Vietnam 546🇲🇾 Malaysia 523🇮🇹 Italy 405🇸🇪 Sweden 378🇵🇭 Philippines 351All countries →