🇮🇷 Iran: live cyber threat activity

Malicious IPs, malware and ransomware victims in Iran.

186Malicious IPs listed#35 of 182 countries · 0.28% of the world
32New in the last 24hfirst seen by any feed
56Reported by 2+ feedsindependent sources agree
2Ransomware victimsposted in the last 30 days

View Iran on the live map →All listed IPs in IranRansomware victims in Iran

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

  1. C22
  2. Malware64
  3. Phishing0
  4. Attacker120

By state or region

  1. Tehran118
  2. Fars13
  3. Razavi Khorasan8
  4. West Azerbaijan6
  5. Isfahan6
  6. Yazd Province6
  7. Kurdistan Province5
  8. Māzandarān4
  9. Kerman2
  10. Khuzestan2
  11. Qom2
  12. Gilan Province2
  13. Semnan2
  14. Qom Province2
  15. Sistan and Baluchestan1

By city

  1. Tehrān59
  2. Tehran53
  3. Shiraz12
  4. Mashhad7
  5. Urmia6
  6. Yazd6
  7. Sanandaj5
  8. Qom4
  9. Isfahan3
  10. Babol3
  11. Sedeh Lanjān2
  12. Rasht2
  13. Anār1
  14. Zarand1
  15. Āb‘alī1

Networks hosting the most

NetworkIPs
AS58224 Iran Telecommunication Company PJS 84
AS42337 Respina Networks & Beyond PJSC 9
AS49100 Pishgaman Toseeh Ertebatat Company (Private Joint Stock) 8
AS60077 Asre Dadeha Asiatech 7
AS44208 Farahoosh Dena PLC 4
AS202468 Noyan Abr Arvan Co. ( Private Joint Stock) 4
AS31549 Aria Shatel PJSC 4
AS9009 M247 Europe SRL 3
AS197207 Mobile Communication Company of Iran PLC 3
AS60631 Vandad Vira Hooman LLC 2
AS43754 Asiatech Data Transmission company 2
AS215708 Mobin Arvand Infrastructure Company LTD 2
AS48715 Sefroyek Pardaz Engineering PJSC 2
AS50810 Mobin Net Communication Company (Private Joint Stock) 2
AS39368 Mahdiar Rafiee 2

Malware families served from Iran

  1. Phorpiex12
  2. Gandcrab11
  3. Udochka2
  4. Hcfyq1
  5. Zitirezc1
  6. W97m1
  7. Shellcoderunner1
  8. Neshta1
  9. Cobalt Strike1
  10. Mozi1

Most recently reported

IPRoleFamily / threatWhereNetworkReported byLast reported (UTC)
188.75.78[.]51AttackerAttacking hostTehran, TehranAS51431 Rasaneh Avabarid Private Joint Stock Company1 feed2026-10-12 08:10
80.210.55[.]162AttackerAttacking hostVaḩīdīyeh, TehranAS58224 Iran Telecommunication Company PJS1 feed2026-10-12 08:10
2.180.10[.]7MalwareZitirezcMashhad, Razavi KhorasanAS58224 Iran Telecommunication Company PJS1 feed · 563 sandbox samples2026-10-12 07:53
176.46.157[.]47MalwarePhorpiexShiraz, FarsAS44208 Farahoosh Dena PLC1 feed · 10 sandbox samples2026-10-12 06:58
94.184.17[.]101AttackerAttacking hostTehrān, TehranAS205536 Tejarat Electronic Nojhan Pardazesh LLC1 feed2026-10-12 06:41
151.233.145[.]221MalwareMalicious IPShiraz, FarsAS58224 Iran Telecommunication Company PJS1 feed2026-10-12 04:35
151.235.128[.]212AttackerAttacking hostShiraz, FarsAS58224 Iran Telecommunication Company PJS2 feeds2026-10-12 04:35
178.239.151[.]31AttackerAttacking hostTehrān, TehranAS60631 Vandad Vira Hooman LLC2 feeds2026-10-12 04:35
185.126.5[.]217AttackerAttacking hostTehran, TehranAS34918 Pishgaman Toseeh Ertebatat Company (Private Joint Stock)2 feeds2026-10-12 04:35
188.211.82[.]154AttackerMalicious IPQods, TehranAS58224 Iran Telecommunication Company PJS1 feed2026-10-12 04:35
2.181.120[.]245AttackerMalicious IPZahedan, Sistan and BaluchestanAS58224 Iran Telecommunication Company PJS1 feed2026-10-12 04:35
2.57.3[.]98AttackerAttacking hostTehran, TehranAS44090 Enteghal Dadeh Mahan Co. PJSC2 feeds2026-10-12 04:35
217.219.81[.]218AttackerAttacking hostTehran, TehranAS58224 Iran Telecommunication Company PJS2 feeds2026-10-12 04:35
37.202.246[.]113AttackerMalicious IPKaraj, Alborz ProvinceAS213807 Fanavaran Mehr Vatan Tehran Server Group LLC1 feed2026-10-12 04:35
46.100.248[.]130AttackerAttacking hostYazd, Yazd ProvinceAS58224 Iran Telecommunication Company PJS3 feeds2026-10-12 04:35
5.182.44[.]168AttackerAttacking hostMashhad, Razavi KhorasanAS61173 Green Web Samaneh Novin PJSC2 feeds2026-10-12 04:35
78.38.146[.]149AttackerAttacking hostAḩmadābād, Razavi KhorasanAS58224 Iran Telecommunication Company PJS2 feeds2026-10-12 04:35
86.55.199[.]159AttackerAttacking hostTehran, TehranAS197207 Mobile Communication Company of Iran PLC2 feeds2026-10-12 04:35
89.219.104[.]100AttackerAttacking hostTehrān, TehranAS58224 Iran Telecommunication Company PJS2 feeds2026-10-12 04:35
92.114.23[.]233AttackerAttacking hostTehran, TehranAS50810 Mobin Net Communication Company (Private Joint Stock)2 feeds2026-10-12 04:35
151.234.36[.]221MalwareMalware downloadShiraz, FarsAS58224 Iran Telecommunication Company PJSaggregated list2026-10-12 04:35
78.38.123[.]220MalwareMalicious URLBirjand, South Khorasan ProvinceAS58224 Iran Telecommunication Company PJSaggregated list2026-10-12 04:35
85.185.55[.]80MalwareMalware downloadSanandaj, Kurdistan ProvinceAS58224 Iran Telecommunication Company PJSaggregated list2026-10-12 04:35
62.133.46[.]9AttackerOn multiple blocklistsTehran, TehranAS9009 M247 Europe SRL1 feed2026-10-12 04:35
185.129.216[.]63AttackerMalicious IPTehrān, TehranAS49100 Pishgaman Toseeh Ertebatat Company (Private Joint Stock)1 feed2026-10-12 04:35

See every listed IP in Iran →

Ransomware victims in Iran

2 posted in the last 30 days, 3 in 90.

Sectors hit (30 days)

Groups (30 days)

Posted (UTC)VictimGroupSector
2026-10-04 13:00daralteb.comkrybitHealthcare
2026-09-16 16:22Roshd SanatWallstreetManufacturing
2026-08-12 15:29IRCO.COMclop—

All ransomware victims in Iran →

Other countries

🇺🇸 United States 17,807🇨🇳 China 10,752🇩🇪 Germany 4,042🇬🇧 United Kingdom 3,668🇷🇺 Russia 3,582🇳🇱 Netherlands 2,247🇮🇳 India 2,068🇫🇷 France 1,538🇧🇷 Brazil 1,416🇸🇬 Singapore 1,330🇭🇰 Hong Kong 1,319🇰🇷 South Korea 1,306🇮🇩 Indonesia 1,189🇵🇰 Pakistan 880🇨🇦 Canada 867🇧🇪 Belgium 726🇯🇵 Japan 704🇺🇦 Ukraine 671🇵🇱 Poland 560🇿🇦 South Africa 557🇻🇳 Vietnam 546🇲🇾 Malaysia 523🇮🇹 Italy 405🇸🇪 Sweden 378All countries →