🇩🇰 Denmark: live cyber threat activity

Malicious IPs, malware and ransomware victims in Denmark.

26Malicious IPs listed#85 of 182 countries · 0.04% of the world

6New in the last 24hfirst seen by any feed

7Reported by 2+ feedsindependent sources agree

3Ransomware victimsposted in the last 30 days

View Denmark on the live map →All listed IPs in Denmark Ransomware victims in Denmark

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

By state or region

Capital Region18
South Denmark3
North Denmark2
Central Jutland2
Zealand1

By city

Græsted8
Copenhagen7
Aalborg2
Christianshavn1
Snogebæk1
Nørre Nebel1
Marstal1
Ballerup Municipality1
Slagelse1
Tranebjerg1
Gråsten1
Viby J1

Networks hosting the most

Network	IPs
AS210731 Forening for DotSrc	9
AS39642 Sinal A/S	2
AS44034 Hi3G Access AB	1
AS9009 M247 Europe SRL	1
AS213954 Global Transit Systems LLC	1
AS212238 Datacamp Limited	1
AS24800 BornFiber Service Provider ApS	1
AS57860 Zencurity ApS	1
AS42541 Fiberby ApS	1
AS3308 Norlys Digital A/S	1
AS39351 31173 Services AB	1
AS44869 FIBIA P/S	1
AS42708 GleSYS AB	1
AS34705 Norlys Digital A/S	1
AS8075 Microsoft Corporation	1

Malware families served from Denmark

Most recently reported

IP	Role	Family / threat	Where	Network	Reported by	Last reported (UTC)
185.129.61[.]129	Attacker	Tor exit	Græsted, Capital Region	AS210731 Forening for DotSrc	2 feeds	2026-10-12 04:35
2001[:]67c[:]89c[:]666[:][:]1	Attacker	Malicious IP	Aalborg, North Denmark	AS210731 Forening for DotSrc	1 feed	2026-10-12 04:35
109.58.201[.]170	Attacker	Attacking host	Copenhagen, Capital Region	AS44034 Hi3G Access AB	1 feed	2026-10-12 04:35
185.129.61[.]4	Attacker	Tor exit	Græsted, Capital Region	AS210731 Forening for DotSrc	3 feeds · 1 sandbox sample	2026-10-12 04:35
9.205.105[.]97	Attacker	Attacking host	Copenhagen, Capital Region	AS8075 Microsoft Corporation	1 feed	2026-10-12 04:35
93.161.42[.]190	Attacker	On multiple blocklists	Viby J, Central Jutland	AS3292 TDC Holding A/S	aggregated list	2026-10-12 04:35
146.70.80[.]37	Malware	Gandcrab	Christianshavn, Capital Region	AS9009 M247 Europe SRL	1 feed · 5 sandbox samples	2026-10-11 08:34
157.22.101[.]123	Attacker	Malicious IP	Copenhagen, Capital Region	AS213954 Global Transit Systems LLC	1 feed	2026-10-11 04:31
158.173.46[.]144	Attacker	Attacking host	Copenhagen, Capital Region	AS212238 Datacamp Limited	2 feeds	2026-10-11 04:31
212.54.86[.]171	Malware	Malware download	Copenhagen, Capital Region	AS9158 Telenor A/S	aggregated list	2026-10-11 04:31
86.52.31[.]96	Attacker	Attacking host	Gråsten, South Denmark	AS39642 Sinal A/S	1 feed	2026-10-10 15:35
2001[:]67c[:]89c[:]702[:]1ce[:]1ce[:]babe[:]7	Attacker	Malicious IP	Aalborg, North Denmark	AS210731 Forening for DotSrc	1 feed	2026-10-09 04:27
185.129.61[.]1	Attacker	Tor exit	Græsted, Capital Region	AS210731 Forening for DotSrc	1 feed · 1 sandbox sample	2026-10-09 04:27
185.129.61[.]5	Attacker	Tor exit	Græsted, Capital Region	AS210731 Forening for DotSrc	2 feeds	2026-10-09 04:27
85.203.47[.]86	Attacker	Attacking host	Tranebjerg, Central Jutland	AS42708 GleSYS AB	1 feed	2026-10-09 04:27
194.255.8[.]116	Attacker	Attacking host	Nørre Nebel, South Denmark	AS3308 Norlys Digital A/S	1 feed	2026-10-09 04:27
45.129.56[.]153	Malware	Shortcut	Ballerup Municipality, Capital Region	AS39351 31173 Services AB	1 feed · 4 sandbox samples	2026-10-08 14:20
193.106.166[.]105	Malware	Themida	Copenhagen, Capital Region	AS42541 Fiberby ApS	1 feed · 9 sandbox samples	2026-10-08 06:58
185.129.61[.]2	Malware	Tor exit	Græsted, Capital Region	AS210731 Forening for DotSrc	2 feeds · 1 sandbox sample	2026-10-08 03:16
185.129.62[.]62	Malware	Generickdq	Græsted, Capital Region	AS57860 Zencurity ApS	2 feeds · 16 sandbox samples	2026-10-07 08:49
185.109.91[.]126	Malware	Coinhelper	Snogebæk, Capital Region	AS24800 BornFiber Service Provider ApS	1 feed · 6 sandbox samples	2026-10-07 02:18
185.129.61[.]7	Attacker	Tor exit	Græsted, Capital Region	AS210731 Forening for DotSrc	1 feed · 1 sandbox sample	—
185.129.61[.]8	Attacker	Tor exit	Græsted, Capital Region	AS210731 Forening for DotSrc	1 feed · 1 sandbox sample	—
212.112.133[.]91	Attacker	Attacking host	Marstal, South Denmark	AS39642 Sinal A/S	1 feed	—
80.209.7[.]29	Attacker	Attacking host	Slagelse, Zealand	AS44869 FIBIA P/S	1 feed	—

See every listed IP in Denmark →

Ransomware victims in Denmark

3 posted in the last 30 days, 7 in 90.

Sectors hit (30 days)

Groups (30 days)

Posted (UTC)	Victim	Group	Sector
2026-10-09 19:26	Refako Autodele	thegentlemen	Manufacturing
2026-10-05 11:26	Infomedia A/S	aurora	Technology
2026-10-02 11:55	Tronex A/S	Wallstreet	Manufacturing
2026-09-07 21:53	Domis	thegentlemen	Retail & E-Commerce
2026-08-21 02:24	Reviso Cloud Accounting Limited	direwolf	Financial Services
2026-08-14 08:32	3f	qilin	—
2026-07-30 21:26	Boyum IT Solutions (HOT!)	genesis	Technology

All ransomware victims in Denmark →