🇯🇵 Japan: live cyber threat activity

Malicious IPs, malware and ransomware victims in Japan.

704Malicious IPs listed#17 of 182 countries · 1.06% of the world
88New in the last 24hfirst seen by any feed
102Reported by 2+ feedsindependent sources agree
15Ransomware victimsposted in the last 30 days

View Japan on the live map →All listed IPs in JapanRansomware victims in Japan

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

  1. C265
  2. Malware23
  3. Phishing0
  4. Attacker616

By state or region

  1. Tokyo608
  2. Osaka49
  3. Chiba23
  4. Aichi7
  5. Nagano3
  6. Kanagawa2
  7. Saitama2
  8. Okinawa2
  9. Saga1
  10. Shizuoka1
  11. Hiroshima1
  12. Nara1
  13. Ibaraki1
  14. Gifu1
  15. Tochigi1

By city

  1. Shibuya City504
  2. Chiyoda City65
  3. Osaka44
  4. Chiyoda16
  5. Inzai14
  6. Shinagawa13
  7. Chiba8
  8. Nagoya7
  9. Minoh4
  10. Minato3
  11. Yokohama2
  12. Tokyo2
  13. Shirahama2
  14. Nagano2
  15. Minato-ku2

Networks hosting the most

NetworkIPs
AS45102 Alibaba (US) Technology Co., Ltd. 383
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED 30
AS396982 Google LLC 19
AS31898 Oracle Corporation 18
AS63949 Akamai Technologies, Inc. 18
AS16509 Amazon.com, Inc. 17
AS132203 Shenzhen Tencent Computer Systems Company Limited 16
AS8075 Microsoft Corporation 16
AS206092 F.N.S. HOLDINGS LIMITED 14
AS152194 CTG Server Limited 13
AS4713 NTT Communications Corporation 11
AS2516 KDDI CORPORATION 10
AS63199 CDS Global Cloud Co., Ltd 9
AS26496 GoDaddy.com, LLC 8
AS20473 The Constant Company, LLC 7

Malware families served from Japan

  1. Cobalt Strike16
  2. AdaptixC212
  3. Brute Ratel C46
  4. PureRAT5
  5. Remcos3
  6. Jackskid3
  7. Emotet3
  8. AsyncRAT3
  9. VShell2
  10. Sliver2
  11. Havoc2
  12. Fsysna1
  13. W97m1
  14. Fragtor1
  15. Urelas1

Most recently reported

IPRoleFamily / threatWhereNetworkReported byLast reported (UTC)
118.104.215[.]19AttackerAttacking hostNagoya, AichiAS18126 Chubu Telecommunications Company, Inc.1 feed2026-10-12 08:20
164.52.24[.]189AttackerAttacking hostOsaka, OsakaAS63199 CDS Global Cloud Co., Ltd1 feed2026-10-12 08:10
35.243.112[.]65AttackerAttacking hostShibuya City, TokyoAS396982 Google LLC1 feed2026-10-12 07:15
141.101.87[.]74AttackerAttacking hostOsaka, OsakaAS13335 Cloudflare, Inc.1 feed2026-10-12 06:41
2a09[:]bac5[:]4434[:]dc[:][:]16[:]20eAttackerAttacking hostNarita, ChibaAS13335 Cloudflare, Inc.1 feed2026-10-12 06:41
35.200.42[.]80AttackerAttacking hostShibuya City, TokyoAS396982 Google LLC1 feed2026-10-12 06:41
34.104.208[.]215AttackerAttacking hostShibuya City, TokyoAS396982 Google LLC1 feed2026-10-12 06:10
35.190.226[.]58AttackerAttacking hostShibuya City, TokyoAS396982 Google LLC1 feed2026-10-12 05:35
103.152.178[.]42AttackerMalicious IPChiyoda City, TokyoAS38074 Ayao Takata1 feed2026-10-12 04:35
114.188.74[.]76AttackerMalicious IPOsaka, OsakaAS4713 NTT Communications Corporation1 feed2026-10-12 04:35
121.2.77[.]166AttackerAttacking hostYokohama, KanagawaAS2527 Sony Network Communications Inc.2 feeds2026-10-12 04:35
133.242.208[.]45AttackerAttacking hostChiyoda City, TokyoAS7684 SAKURA Internet Inc.2 feeds2026-10-12 04:35
136.110.121[.]238AttackerAttacking hostShibuya City, TokyoAS396982 Google LLC2 feeds2026-10-12 04:35
136.110.70[.]58AttackerAttacking hostShibuya City, TokyoAS396982 Google LLC2 feeds2026-10-12 04:35
153.120.42[.]137AttackerMalicious IPOsaka, OsakaAS7684 SAKURA Internet Inc.1 feed · 1 sandbox sample2026-10-12 04:35
153.123.7[.]218AttackerAttacking hostChiyoda City, TokyoAS131921 GMO GlobalSign Holdings K.K.2 feeds2026-10-12 04:35
159.26.119[.]5AttackerAttacking hostFujimino, SaitamaAS208172 Proton AG2 feeds2026-10-12 04:35
160.249.17[.]136AttackerAttacking hostTsumori, OsakaAS9605 NTT DOCOMO, INC.2 feeds2026-10-12 04:35
160.251.172[.]208AttackerMalicious IPChiyoda, TokyoAS58791 GMO Internet,Inc1 feed2026-10-12 04:35
167.254.242[.]38AttackerAttacking hostShibuya City, TokyoAS63473 HostHatch, LLC2 feeds2026-10-12 04:35
177.3.92[.]13AttackerAttacking hostShibuya City, TokyoAS137535 JT TELECOM INTERNATIONAL PTE.LTD.3 feeds2026-10-12 04:35
2001[:]df4[:]1780[:]d000[:][:]2222AttackerMalicious IPChiyoda City, TokyoAS38074 Ayao Takata1 feed2026-10-12 04:35
23.81.44[.]113AttackerMalicious IPMinato-ku, TokyoAS134351 Leaseweb Japan K.K.1 feed · 1 sandbox sample2026-10-12 04:35
2400[:]8500[:]2002[:]3163[:]160[:]251[:]172[:]208AttackerMalicious IPChiyoda, Tokyo 1 feed2026-10-12 04:35
34.84.118[.]55AttackerAttacking hostShibuya City, TokyoAS396982 Google LLC2 feeds2026-10-12 04:35

See every listed IP in Japan →

Ransomware victims in Japan

15 posted in the last 30 days, 41 in 90.

Sectors hit (30 days)

Groups (30 days)

Posted (UTC)VictimGroupSector
2026-10-10 14:31KOIKE Sanso Kogoyo Co. Ltd.exitiumManufacturing
2026-10-09 19:13enTouchBlack XTechnology
2026-10-04 14:10Mutsumi GroupqilinManufacturing
2026-09-30 21:53The Japan TimesEclipseOther
2026-09-28 14:03SKLGqilin—
2026-09-28 08:59Nissho Electric Manufacturing Co., Ltd.qilinManufacturing
2026-09-25 15:33UNIRITAeverestTechnology
2026-09-21 22:14Astemo, Ltd.metaencryptorManufacturing
2026-09-21 08:01IKEGAMI TSUSHINKI COMPANY LIMITEDqilinManufacturing
2026-09-18 15:50kit-e.jpAuditTeamTechnology
2026-09-15 19:58Hashimoto JimukiVexy RansomwareManufacturing
2026-09-15 19:30ryomo.co.jpsafepay—
2026-09-15 11:59Nippon Steel CorporationmetaencryptorManufacturing
2026-09-15 07:12TentacthegentlemenTechnology
2026-09-15 07:09Wada FarmsthegentlemenAgriculture and Food Production

All ransomware victims in Japan →

Other countries

🇺🇸 United States 17,807🇨🇳 China 10,752🇩🇪 Germany 4,042🇬🇧 United Kingdom 3,668🇷🇺 Russia 3,582🇳🇱 Netherlands 2,247🇮🇳 India 2,068🇫🇷 France 1,538🇧🇷 Brazil 1,416🇸🇬 Singapore 1,330🇭🇰 Hong Kong 1,319🇰🇷 South Korea 1,306🇮🇩 Indonesia 1,189🇵🇰 Pakistan 880🇨🇦 Canada 867🇧🇪 Belgium 726🇺🇦 Ukraine 671🇵🇱 Poland 560🇿🇦 South Africa 557🇻🇳 Vietnam 546🇲🇾 Malaysia 523🇮🇹 Italy 405🇸🇪 Sweden 378🇵🇭 Philippines 351All countries →