🇫🇮 Finland: live cyber threat activity

Malicious IPs, malware and ransomware victims in Finland.

187Malicious IPs listed#34 of 182 countries · 0.28% of the world
39New in the last 24hfirst seen by any feed
23Reported by 2+ feedsindependent sources agree
7Ransomware victimsposted in the last 30 days

View Finland on the live map →All listed IPs in FinlandRansomware victims in Finland

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

  1. C226
  2. Malware106
  3. Phishing0
  4. Attacker55

By state or region

  1. Uusimaa178
  2. Tampere3
  3. North Ostrobothnia3
  4. South Karelia1
  5. Central Finland1
  6. Ostrobothnia1

By city

  1. Helsinki174
  2. Tampere3
  3. Kärsämäki2
  4. Espoo1
  5. Vantaa1
  6. Lappeenranta1
  7. Jyväskylä1
  8. Reisjärvi1
  9. East Helsinki1
  10. Ylästö1
  11. Vaasa1

Networks hosting the most

NetworkIPs
AS24940 Hetzner Online GmbH 84
AS204339 FIRST SERVER LIMITED 9
AS1759 Telia Finland Oyj 7
AS215730 H2NEXUS CLOUD SERVICES - FZCO 6
AS207569 IHOR HOSTING LTD 6
AS216024 ALEKSEI FEDOROV PR KRUSEVAC 5
AS212171 Local NCC Ltd. 5
AS218688 WULDI LLC 4
AS216473 Bashinskii Vadim Ruslanovich 4
AS201988 VPSPay Networks LTD 3
AS215439 PLAY2GO INTERNATIONAL LIMITED 3
AS51765 Oy Crea Nova Hosting Solution Ltd 3
AS218731 Andris Jakovlevs 3
AS57359 Pyhanet Oy 3
AS215590 DpkgSoft International Limited 2

Malware families served from Finland

  1. Zard7
  2. Dacic7
  3. PureRAT7
  4. Vidar7
  5. Themida3
  6. Privateloader3
  7. Loki3
  8. Fragtor2
  9. Dcrat2
  10. Mokes2
  11. Femato2
  12. Jalapeno2
  13. Disabler2
  14. Crifi1
  15. Cobalt Strike1

Most recently reported

IPRoleFamily / threatWhereNetworkReported byLast reported (UTC)
185.229.66[.]214MalwareContacted by malwareHelsinki, UusimaaAS207569 IHOR HOSTING LTD1 feed · 18 sandbox samples2026-10-12 07:53
65.108.20[.]195MalwareDacicHelsinki, UusimaaAS24940 Hetzner Online GmbH1 feed · 409 sandbox samples2026-10-12 07:53
193.166.255[.]171MalwareSalityEspoo, UusimaaAS1741 CSC - Tieteen tietotekniikan keskus Oy1 feed · 865 sandbox samples2026-10-12 07:26
45.9.74[.]80MalwareMokesHelsinki, UusimaaAS207569 IHOR HOSTING LTD1 feed · 461 sandbox samples2026-10-12 07:26
95.217.209[.]65MalwareContacted by malwareHelsinki, UusimaaAS24940 Hetzner Online GmbH1 feed · 28 sandbox samples2026-10-12 07:26
138.124.59[.]179MalwareMalware downloadHelsinki, UusimaaAS210644 AEZA INTERNATIONAL LTDaggregated list2026-10-12 07:20
95.216.186[.]40MalwareLokiHelsinki, UusimaaAS24940 Hetzner Online GmbH1 feed · 427 sandbox samples2026-10-12 06:58
45.138.74[.]121MalwareZardHelsinki, UusimaaAS204339 FIRST SERVER LIMITED1 feed · 314 sandbox samples2026-10-12 05:15
13.143.132[.]229AttackerAttacking hostHelsinki, UusimaaAS201988 VPSPay Networks LTD2 feeds2026-10-12 04:35
185.67.82[.]114AttackerTor exitTampere, TampereAS20904 Cinia Oy3 feeds2026-10-12 04:35
193.138.7[.]202AttackerAttacking hostHelsinki, UusimaaAS50304 Blix Solutions AS2 feeds2026-10-12 04:35
2.29.38[.]132AttackerCompromised hostHelsinki, UusimaaAS24940 Hetzner Online GmbH3 feeds2026-10-12 04:35
2a09[:]bac5[:]31c0[:]2db9[:][:]48e[:]80AttackerAttacking hostVantaa, UusimaaAS13335 Cloudflare, Inc.2 feeds2026-10-12 04:35
77.42.10[.]33:443C2VidarHelsinki, UusimaaAS24940 Hetzner Online GmbH1 feed2026-10-12 04:35
78.27.120[.]208AttackerMalicious IPEast Helsinki, UusimaaAS16086 DNA Oyj1 feed2026-10-12 04:35
94.237.14[.]115:443C2VidarHelsinki, UusimaaAS202053 UpCloud Ltd1 feed2026-10-12 04:35
144.31.132[.]58AttackerAttacking hostHelsinki, UusimaaAS210546 CHSL ONE LTD2 feeds2026-10-12 04:35
80.66.83[.]80AttackerOn multiple blocklistsHelsinki, UusimaaAS216473 Bashinskii Vadim Ruslanovichaggregated list2026-10-12 04:35
95.217.25[.]51MalwareDacicHelsinki, UusimaaAS24940 Hetzner Online GmbH1 feed · 199 sandbox samples2026-10-12 04:00
135.181.129[.]119MalwareDacicHelsinki, UusimaaAS24940 Hetzner Online GmbH1 feed · 842 sandbox samples2026-10-12 03:15
95.216.183[.]78MalwareContacted by malwareHelsinki, UusimaaAS24940 Hetzner Online GmbH1 feed · 7 sandbox samples2026-10-12 03:15
109.107.182[.]2MalwareContacted by malwareHelsinki, UusimaaAS216024 ALEKSEI FEDOROV PR KRUSEVAC1 feed · 8 sandbox samples2026-10-12 02:02
109.107.182[.]3MalwareThemidaHelsinki, UusimaaAS216024 ALEKSEI FEDOROV PR KRUSEVAC1 feed · 248 sandbox samples2026-10-12 02:02
185.112.83[.]8MalwareDacicHelsinki, UusimaaAS207569 IHOR HOSTING LTD1 feed · 80 sandbox samples2026-10-12 02:02
65.108.80[.]190MalwareDacicHelsinki, UusimaaAS24940 Hetzner Online GmbH1 feed · 606 sandbox samples2026-10-12 02:02

See every listed IP in Finland →

Ransomware victims in Finland

7 posted in the last 30 days, 15 in 90.

Sectors hit (30 days)

Groups (30 days)

Posted (UTC)VictimGroupSector
2026-10-09 18:05TepcompqilinTechnology
2026-10-06 09:02Delta MarineqilinTransportation
2026-09-26 08:44PajulahtithegentlemenManufacturing
2026-09-23 14:41SUUNTO.CN(SUUNTO.COM)clopRetail & E-Commerce
2026-09-21 19:23kyyba.comunsafeTechnology
2026-09-15 07:09SomitthegentlemenTechnology
2026-09-14 14:03httoy.filockbit5—
2026-08-28 13:06TramigoqilinTransportation
2026-08-12 15:35SUUNTO.CN (SUUNTO.COM)clopRetail & E-Commerce
2026-08-11 14:26www.kilpi-koskinen.fikrybitOther
2026-08-09 13:31Naval Interior TeamqilinGovernment & Defense
2026-07-26 18:14Prism TelecomGlobal Secret GroupTechnology
2026-07-25 17:54Enedo PowerDeadlockEnergy & Utilities
2026-07-16 13:00GallantthegentlemenTechnology
2026-07-14 19:31THLqilin—

All ransomware victims in Finland →

Other countries

🇺🇸 United States 17,807🇨🇳 China 10,752🇩🇪 Germany 4,042🇬🇧 United Kingdom 3,668🇷🇺 Russia 3,582🇳🇱 Netherlands 2,247🇮🇳 India 2,068🇫🇷 France 1,538🇧🇷 Brazil 1,416🇸🇬 Singapore 1,330🇭🇰 Hong Kong 1,319🇰🇷 South Korea 1,306🇮🇩 Indonesia 1,189🇵🇰 Pakistan 880🇨🇦 Canada 867🇧🇪 Belgium 726🇯🇵 Japan 704🇺🇦 Ukraine 671🇵🇱 Poland 560🇿🇦 South Africa 557🇻🇳 Vietnam 546🇲🇾 Malaysia 523🇮🇹 Italy 405🇸🇪 Sweden 378All countries →