🇱🇺 Luxembourg: live cyber threat activity

Malicious IPs, malware and ransomware victims in Luxembourg.

87Malicious IPs listed#49 of 182 countries · 0.13% of the world
17New in the last 24hfirst seen by any feed
26Reported by 2+ feedsindependent sources agree
1Ransomware victimsposted in the last 30 days

View Luxembourg on the live map →All listed IPs in LuxembourgRansomware victims in Luxembourg

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

  1. C27
  2. Malware15
  3. Phishing0
  4. Attacker65

By state or region

  1. Diekirch58
  2. Mersch19
  3. Luxembourg9
  4. Capellen1

By city

  1. Schieren58
  2. Bissen19
  3. Steinsel5
  4. Luxembourg4
  5. Hautcharage1

Networks hosting the most

NetworkIPs
AS36680 Netiface LLC 46
AS53667 FranTech Solutions 19
AS203020 HostRoyale Technologies Pvt Ltd 11
AS209854 Cyberzone S.A. 5
AS199524 G-Core Labs S.A. 2
AS6661 POST Luxembourg 2
AS203055 Datacenter Luxembourg S.A. 1
AS202422 G-Core Labs S.A. 1

Malware families served from Luxembourg

  1. DCRat2
  2. Loki1
  3. Cryptotab1
  4. Barys1
  5. Mardom1
  6. Agenttesla1
  7. AsyncRAT1
  8. Tsunami1
  9. Remcos1
  10. HypeAgent1
  11. PureRAT1
  12. Dump1

Most recently reported

IPRoleFamily / threatWhereNetworkReported byLast reported (UTC)
64.89.161[.]85AttackerAttacking hostSchieren, DiekirchAS36680 Netiface LLC1 feed2026-10-12 06:10
107.189.31[.]171MalwareBarysBissen, MerschAS53667 FranTech Solutions1 feed · 2 sandbox samples2026-10-12 06:08
145.223.8[.]13AttackerAttacking hostSteinsel, LuxembourgAS209854 Cyberzone S.A.2 feeds2026-10-12 04:35
185.153.151[.]152AttackerAttacking hostSchieren, DiekirchAS203020 HostRoyale Technologies Pvt Ltd2 feeds2026-10-12 04:35
185.153.151[.]160AttackerAttacking hostSchieren, DiekirchAS203020 HostRoyale Technologies Pvt Ltd2 feeds2026-10-12 04:35
185.153.151[.]165AttackerAttacking hostSchieren, DiekirchAS203020 HostRoyale Technologies Pvt Ltd2 feeds2026-10-12 04:35
185.153.151[.]182AttackerAttacking hostSchieren, DiekirchAS203020 HostRoyale Technologies Pvt Ltd2 feeds2026-10-12 04:35
64.89.160[.]96MalwareMalicious URLSchieren, DiekirchAS36680 Netiface LLCaggregated list2026-10-12 04:35
185.153.151[.]145AttackerAttacking hostSchieren, DiekirchAS203020 HostRoyale Technologies Pvt Ltd1 feed2026-10-12 04:35
64.89.161[.]184AttackerOn multiple blocklistsSchieren, DiekirchAS36680 Netiface LLCaggregated list2026-10-12 04:35
64.89.160[.]157AttackerAttacking hostSchieren, DiekirchAS36680 Netiface LLC1 feed2026-10-12 03:55
107.189.2[.]172AttackerOn multiple blocklistsBissen, MerschAS53667 FranTech Solutions1 feed2026-10-12 02:25
92.223.84[.]84MalwareDumpLuxembourg, LuxembourgAS199524 G-Core Labs S.A.1 feed · 18 sandbox samples2026-10-12 01:32
64.89.161[.]185AttackerAttacking hostSchieren, DiekirchAS36680 Netiface LLC1 feed2026-10-11 20:55
104.244.76[.]184MalwareLokiBissen, MerschAS53667 FranTech Solutions1 feed · 3 sandbox samples2026-10-11 14:09
107.189.6[.]214MalwareMardomBissen, MerschAS53667 FranTech Solutions1 feed · 33 sandbox samples2026-10-11 13:54
104.244.73[.]43AttackerTor exitBissen, MerschAS53667 FranTech Solutions2 feeds · 1 sandbox sample2026-10-11 09:36
31.216.145[.]5MalwareContacted by malwareSchieren, DiekirchAS203055 Datacenter Luxembourg S.A.1 feed · 70 sandbox samples2026-10-11 06:20
198.251.84[.]92MalwareContacted by malwareBissen, MerschAS53667 FranTech Solutions1 feed · 25 sandbox samples2026-10-11 04:58
145.223.8[.]11AttackerAttacking hostSteinsel, LuxembourgAS209854 Cyberzone S.A.2 feeds2026-10-11 04:31
145.223.8[.]18AttackerAttacking hostSteinsel, LuxembourgAS209854 Cyberzone S.A.2 feeds2026-10-11 04:31
145.223.8[.]6AttackerAttacking hostSteinsel, LuxembourgAS209854 Cyberzone S.A.2 feeds2026-10-11 04:31
145.223.8[.]8AttackerAttacking hostSteinsel, LuxembourgAS209854 Cyberzone S.A.2 feeds2026-10-11 04:31
185.153.151[.]137AttackerAttacking hostSchieren, DiekirchAS203020 HostRoyale Technologies Pvt Ltd2 feeds2026-10-11 04:31
185.153.151[.]140AttackerMalicious IPSchieren, DiekirchAS203020 HostRoyale Technologies Pvt Ltd1 feed2026-10-11 04:31

See every listed IP in Luxembourg →

Ransomware victims in Luxembourg

1 posted in the last 30 days, 2 in 90.

Sectors hit (30 days)

Groups (30 days)

Posted (UTC)VictimGroupSector
2026-09-18 15:25STOKR (digital securities platform)N0nFinancial Services
2026-08-07 08:42jean-petit.luL GroupRetail & E-Commerce

All ransomware victims in Luxembourg →

Other countries