🇳🇱 Netherlands: live cyber threat activity

Malicious IPs, malware and ransomware victims in Netherlands.

2,247Malicious IPs listed#6 of 182 countries · 3.4% of the world
406New in the last 24hfirst seen by any feed
558Reported by 2+ feedsindependent sources agree
3Ransomware victimsposted in the last 30 days

View Netherlands on the live map →All listed IPs in NetherlandsRansomware victims in Netherlands

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

  1. C2259
  2. Malware345
  3. Phishing0
  4. Attacker1,643

By state or region

  1. North Holland1,851
  2. Limburg192
  3. Zeeland61
  4. South Holland50
  5. Groningen25
  6. Flevoland23
  7. North Brabant19
  8. Overijssel8
  9. Utrecht7
  10. Drenthe7
  11. Gelderland4

By city

  1. Amsterdam1,761
  2. Eygelshoven190
  3. Lammerenburg61
  4. Haarlem45
  5. Groningen22
  6. Naaldwijk16
  7. Lelystad12
  8. Schoorl11
  9. Dronten10
  10. Alblasserdam9
  11. Schiphol-Rijk9
  12. Rotterdam7
  13. Alkmaar7
  14. Maasdijk5
  15. Veghel5

Networks hosting the most

NetworkIPs
AS25369 Hydra Communications Ltd 327
AS197170 TechTies Inc. 162
AS14061 DigitalOcean, LLC 138
AS211680 NSEC - Sistemas Informaticos, S.A. 110
AS219502 Storm Industries LLC 107
AS202425 IP Volume inc 100
AS215125 Church of Cyberology 87
AS47890 UNMANAGED LTD 74
AS199457 SolidCore Hosting LTD 73
AS202412 Omegatech LTD 71
AS21859 Zenlayer Inc 65
AS13335 Cloudflare, Inc. 53
AS49870 Alsycon B.V. 48
AS33915 Vodafone Libertel B.V. 46
AS209373 SWISSNET LLC 45

Malware families served from Netherlands

  1. PureRAT40
  2. Evilginx29
  3. AsyncRAT27
  4. Mirai18
  5. AdaptixC217
  6. Remcos15
  7. Kimwolf10
  8. Themida9
  9. Cobalt Strike8
  10. Sliver8
  11. Amadey7
  12. Loki7
  13. Vidar7
  14. XWorm6
  15. Utorrent5

Most recently reported

IPRoleFamily / threatWhereNetworkReported byLast reported (UTC)
84.38.133[.]187:3270C2XWormAmsterdam, North HollandAS203557 SIA RixHost1 feed2026-10-12 08:25
2a01[:]4020[:]2[:]b[:]102[:][:]242AttackerAttacking hostAmsterdam, North HollandAS25369 Hydra Communications Ltd1 feed2026-10-12 08:20
2a01[:]4020[:]2[:]b[:]102[:][:]479AttackerAttacking hostAmsterdam, North HollandAS25369 Hydra Communications Ltd1 feed2026-10-12 08:20
2a01[:]4020[:]2[:]b[:]102[:][:]687AttackerAttacking hostAmsterdam, North HollandAS25369 Hydra Communications Ltd1 feed2026-10-12 08:20
2a01[:]4020[:]2[:]b[:]102[:][:]79aAttackerAttacking hostAmsterdam, North HollandAS25369 Hydra Communications Ltd1 feed2026-10-12 08:20
23.132.164[.]72:8000C2AsyncRATAmsterdam, North HollandAS401626 Netiface America, Inc.1 feed2026-10-12 08:19
104.248.192[.]7AttackerAttacking hostAmsterdam, North HollandAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
152.42.138[.]189AttackerAttacking hostAmsterdam, North HollandAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
157.245.73[.]143AttackerAttacking hostAmsterdam, North HollandAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
161.35.94[.]154AttackerAttacking hostAmsterdam, North HollandAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
164.92.219[.]13AttackerAttacking hostAmsterdam, North HollandAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
174.138.3[.]141AttackerAttacking hostAmsterdam, North HollandAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
178.128.255[.]217AttackerAttacking hostAmsterdam, North HollandAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
213.152.161[.]130AttackerAttacking hostOudenbosch, North BrabantAS49453 Global Layer B.V.1 feed2026-10-12 07:55
45.156.128[.]71AttackerAttacking hostAmsterdam, North HollandAS211680 NSEC - Sistemas Informaticos, S.A.2 feeds2026-10-12 07:55
45.133.1[.]107MalwareDacicAlkmaar, North HollandAS203320 Turien en Co. Assuradeuren B.V.1 feed · 1,135 sandbox samples2026-10-12 07:53
45.133.1[.]182MalwareDacicAlkmaar, North HollandAS203320 Turien en Co. Assuradeuren B.V.1 feed · 871 sandbox samples2026-10-12 07:53
79.137.198[.]102MalwareContacted by malwareAmsterdam, North HollandAS210644 AEZA INTERNATIONAL LTD1 feed · 16 sandbox samples2026-10-12 07:53
130.49.79[.]161AttackerAttacking hostAmsterdam, North HollandAS35830 Fast Servers (Pty) Ltd1 feed2026-10-12 07:50
206.54.181[.]21AttackerAttacking hostAmsterdam, North HollandAS35415 Webzilla B.V.1 feed2026-10-12 07:50
34.13.197[.]159AttackerAttacking hostGroningen, GroningenAS396982 Google LLC1 feed2026-10-12 07:50
31.56.209[.]73MalwareMalware downloadEygelshoven, LimburgAS209373 SWISSNET LLCaggregated list2026-10-12 07:46
31.56.209[.]86MalwareMalware downloadEygelshoven, LimburgAS209373 SWISSNET LLCaggregated list2026-10-12 07:46
178.23.190[.]242MalwareContacted by malwareAmsterdam, North Holland 1 feed · 17 sandbox samples2026-10-12 07:26
178.237.33[.]50MalwareModiloaderAmsterdam, North HollandAS8455 atom86 BV1 feed · 1,159 sandbox samples2026-10-12 07:26

See every listed IP in Netherlands →

Ransomware victims in Netherlands

3 posted in the last 30 days, 23 in 90.

Posted (UTC)VictimGroupSector
2026-10-06 16:17B-accountantseverestProfessional Services
2026-10-05 18:26sterrer.netsafepayTechnology
2026-09-18 12:42www.roancampingholidays.comincransomHospitality
2026-09-08 15:36fdcputman.nllockbit5Other
2026-09-04 20:56huisartsencentrumkleiniterson.nllockbit5Healthcare
2026-09-03 11:59buroboot.nlsettraRetail & E-Commerce
2026-08-31 19:53Adviesbureau De Beuckelaer BVBrainCipherProfessional Services
2026-08-31 09:31bartelsbv.nllockbit5Manufacturing
2026-08-31 09:31vkj.nllockbit5Other
2026-08-31 09:30allsteelproducts.nllockbit5Manufacturing
2026-08-27 17:53fpmanagement.nllockbit5Professional Services
2026-08-25 19:24parkderochie.comchaosOther
2026-08-21 02:28ProSim Aviation ResearchdirewolfTechnology
2026-08-20 08:57ProviteqilinTechnology
2026-08-14 08:31Urban WorldwideqilinOther

All ransomware victims in Netherlands →

Other countries