🇱🇧 Lebanon: live cyber threat activity

Malicious IPs, malware and ransomware victims in Lebanon.

8Malicious IPs listed#125 of 182 countries · 0.01% of the world

2New in the last 24hfirst seen by any feed

3Reported by 2+ feedsindependent sources agree

0Ransomware victimsposted in the last 30 days

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

Listed IPs by role.

Network	IPs
AS9051 IncoNet Data Management sal	3
AS48847 WAVES S.A.L	1
AS24634 Transmog Inc S.A.L	1
AS51104 VIP GROUP (S.A.R.L)	1
AS34458 Smart Networks S.a.r.l	1
AS42003 LIBANTELECOM	1

No malware family attributed to IPs here.

IP	Role	Family / threat	Where	Network	Reported by	Last reported (UTC)
80.77.191[.]74	Attacker	Attacking host	Beirut, Beirut	AS9051 IncoNet Data Management sal	1 feed	2026-10-12 07:15
185.169.7[.]12	Attacker	Attacking host	Sidon, South Governorate	AS51104 VIP GROUP (S.A.R.L)	2 feeds	2026-10-12 04:35
193.227.179[.]227	Attacker	Attacking host	Baabda, Mont-Liban	AS9051 IncoNet Data Management sal	2 feeds	2026-10-11 04:31
217.150.82[.]137	Attacker	Attacking host	Brîtel, Baalbek-Hermel Governorate	AS34458 Smart Networks S.a.r.l	2 feeds	2026-10-11 04:31
141.105.81[.]218	Attacker	Attacking host	Beirut, Beirut	AS24634 Transmog Inc S.A.L	1 feed	2026-10-09 04:27
109.233.21[.]109	Attacker	Attacking host	Jdaidet el Matn, Mount Lebanon	AS48847 WAVES S.A.L	1 feed	—
193.227.160[.]130	Attacker	Malicious IP	Baabda, Mont-Liban	AS9051 IncoNet Data Management sal	1 feed	—
94.187.37[.]247	Attacker	On multiple blocklists	Beirut, Beyrouth	AS42003 LIBANTELECOM	aggregated list	—

No ransomware victims from Lebanon posted in the last 90 days.