🇳🇴 Norway: live cyber threat activity

Malicious IPs, malware and ransomware victims in Norway.

43Malicious IPs listed#72 of 182 countries · 0.07% of the world

10New in the last 24hfirst seen by any feed

6Reported by 2+ feedsindependent sources agree

1Ransomware victimsposted in the last 30 days

View Norway on the live map →All listed IPs in Norway Ransomware victims in Norway

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

By state or region

Vestfold16
Oslo12
Trøndelag5
Vestland3
Akershus2
Rogaland2
Buskerud1
Møre og Romsdal1
Nordland1

By city

Sandefjord16
Oslo12
Steinkjer2
Trondheim2
Stavanger2
Kleppestø2
Drammen1
Jessheim1
Ålesund1
Bodø1
Brekstad1
Askvoll1
Røyken1

Networks hosting the most

Network	IPs
AS56655 Gigahost AS	10
AS2116 GLOBALCONNECT AS	5
AS149020 WebHorizon Internet Services	3
AS8075 Microsoft Corporation	3
AS29695 Lyse Tele AS	3
AS34087 NTE TELEKOM AS	2
AS25400 Telia Norge AS	2
AS50304 Blix Solutions AS	2
AS211443 SINO WORLDWIDE TRADING LIMITED	2
AS2119 Telenor Norge AS	2
AS224 SIKT - KUNNSKAPSSEKTORENS TJENESTELEVERANDOR	1
AS208686 Nordic Servers AS	1
AS20741 Administrator Systems AS	1
AS8542 Eviny Fiber AS	1
AS9009 M247 Europe SRL	1

Malware families served from Norway

Most recently reported

IP	Role	Family / threat	Where	Network	Reported by	Last reported (UTC)
81.191.17[.]94	Attacker	Attacking host	Oslo, Oslo	AS2116 GLOBALCONNECT AS	1 feed	2026-10-12 08:10
151.240.121[.]146	Attacker	Attacking host	Sandefjord, Vestfold	AS208686 Nordic Servers AS	1 feed	2026-10-12 05:00
185.243.218[.]233	Attacker	Tor exit	Sandefjord, Vestfold	AS56655 Gigahost AS	3 feeds	2026-10-12 04:35
194.32.107[.]206	Attacker	Malicious IP	Sandefjord, Vestfold	AS56655 Gigahost AS	1 feed · 2 sandbox samples	2026-10-12 04:35
2a03[:]94e0[:]ffff[:]194[:]32[:]107[:]0[:]206	Attacker	Malicious IP	Sandefjord, Vestfold	AS56655 Gigahost AS	1 feed	2026-10-12 04:35
84.48.53[.]185	Attacker	On multiple blocklists	Kleppestø, Vestland	AS15659 NextGenTel AS	1 feed	2026-10-12 04:35
88.88.191[.]25	Malware	Malicious URL	Røyken, Akershus	AS2119 Telenor Norge AS	aggregated list	2026-10-12 04:35
185.181.61[.]203	Attacker	Tor exit	Sandefjord, Vestfold	AS56655 Gigahost AS	2 feeds	2026-10-11 09:36
195.16.73[.]86:29284	C2	Antidot	Sandefjord, Vestfold	AS56655 Gigahost AS	1 feed	2026-10-11 08:59
194.110.207[.]202:17310	C2	Antidot	Sandefjord, Vestfold	AS56655 Gigahost AS	1 feed	2026-10-11 08:59
194.5.98[.]11	Malware	Contacted by malware	Sandefjord, Vestfold	AS149020 WebHorizon Internet Services	1 feed · 3 sandbox samples	2026-10-11 07:45
148.252.101[.]130	Attacker	Malicious IP	Steinkjer, Trøndelag	AS34087 NTE TELEKOM AS	1 feed	2026-10-11 04:31
185.181.60[.]128	Attacker	Malicious IP	Sandefjord, Vestfold	AS56655 Gigahost AS	1 feed	2026-10-11 04:31
193.90.12[.]62	Attacker	Compromised host	Trondheim, Trøndelag	AS2116 GLOBALCONNECT AS	3 feeds	2026-10-11 04:31
2a01[:]563[:]db[:]dffd[:]feed[:]face[:]0[:]10	Attacker	Malicious IP	Steinkjer, Trøndelag	AS34087 NTE TELEKOM AS	1 feed	2026-10-11 04:31
194.5.98[.]26	Malware	Nanocore	Sandefjord, Vestfold	AS149020 WebHorizon Internet Services	1 feed · 2 sandbox samples	2026-10-11 03:00
185.11.180[.]67	Malware	Wannacry	Ålesund, Møre og Romsdal	AS20741 Administrator Systems AS	1 feed · 4 sandbox samples	2026-10-10 14:26
20.251.56[.]24	Attacker	Attacking host	Oslo, Oslo	AS8075 Microsoft Corporation	1 feed	2026-10-10 11:25
20.251.52[.]36	Attacker	Attacking host	Oslo, Oslo	AS8075 Microsoft Corporation	1 feed	2026-10-10 10:20
92.221.47[.]139	Attacker	Attacking host	Stavanger, Rogaland	AS29695 Lyse Tele AS	1 feed	2026-10-10 04:30
85.31.46[.]167	Malware	Contacted by malware	Oslo, Oslo	AS34989 ServeTheWorld AS	1 feed · 73 sandbox samples	2026-10-09 15:55
194.5.98[.]212	Malware	Contacted by malware	Sandefjord, Vestfold	AS149020 WebHorizon Internet Services	1 feed · 6 sandbox samples	2026-10-09 15:37
213.52.95[.]15	Attacker	Attacking host	Oslo, Oslo	AS2116 GLOBALCONNECT AS	1 feed	2026-10-09 14:10
194.19.7[.]82	Attacker	Attacking host	Oslo, Oslo	AS2116 GLOBALCONNECT AS	2 feeds	2026-10-09 04:27
185.243.218[.]229	Attacker	Tor exit	Sandefjord, Vestfold	AS56655 Gigahost AS	1 feed	2026-10-09 04:27