🇵🇱 Poland: live cyber threat activity

Malicious IPs, malware and ransomware victims in Poland.

560Malicious IPs listed#19 of 182 countries · 0.85% of the world
202New in the last 24hfirst seen by any feed
252Reported by 2+ feedsindependent sources agree
1Ransomware victimsposted in the last 30 days

View Poland on the live map →All listed IPs in PolandRansomware victims in Poland

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

  1. C219
  2. Malware34
  3. Phishing0
  4. Attacker507

By state or region

  1. Mazovia378
  2. Lesser Poland31
  3. Lublin25
  4. Silesia20
  5. Lower Silesia12
  6. Opole Voivodeship11
  7. Greater Poland11
  8. Łódź Voivodeship11
  9. Warmia-Masuria9
  10. West Pomerania9
  11. Pomerania8
  12. Podlasie8
  13. Lubusz8
  14. Subcarpathia7
  15. Kujawsko-Pomorskie6

By city

  1. Warsaw368
  2. Zamość8
  3. Poznan7
  4. Lublin7
  5. Krakow6
  6. Kuźnica6
  7. Rozprza6
  8. Bierdzany6
  9. Goraj5
  10. Proszowice5
  11. Strzegom5
  12. Częstochowa5
  13. Gdansk5
  14. Dąbrowa4
  15. Chałupki4

Networks hosting the most

NetworkIPs
AS16276 OVH SAS 18
AS212835 Shesternin Vladimir Anatolievich 17
AS202425 IP Volume inc 17
AS5617 Orange Polska Spolka Akcyjna 14
AS201814 MEVSPACE sp. z o.o. 11
AS35745 KSU Provector Mariusz Dziakowicz 9
AS202520 SkyPass Solutions Sp. z.o.o. 9
AS9141 P4 Sp. z o.o. 8
AS198072 GTnet sp.j. Tomasz Gajewski Grzegorz Mazurek 8
AS60831 Arkadia Spolka Cywilna Krysztof Rozmus Barbara Rozmus 7
AS198133 AIRNET MARIUSZ KAJDAS, TOMASZ PYREK sp.j. 7
AS198766 Netsystem Sp. z o.o. 6
AS205608 SERVIRE Adam Kozlowski 6
AS39716 VIP AGENCJA REKLAMY sp. z o.o 6
AS29314 VECTRA S.A. 6

Malware families served from Poland

  1. AdaptixC24
  2. PureRAT4
  3. Potassium3
  4. pupy3
  5. Zard2
  6. Stealerc1
  7. Dcrat1
  8. Cerbu1
  9. Zeppelin1
  10. Sality1
  11. Remcos1
  12. Havoc1
  13. Tsundere1
  14. Midie1
  15. Tofsee1

Most recently reported

IPRoleFamily / threatWhereNetworkReported byLast reported (UTC)
37.26.193[.]84AttackerAttacking hostBialystok, PodlasieAS34337 ELECTRONIC MECHANICAL COMPANY ELPOS SP Z O O1 feed2026-10-12 08:10
79.186.166[.]85AttackerAttacking hostZielona Góra, LubuszAS5617 Orange Polska Spolka Akcyjna1 feed2026-10-12 08:10
193.239.145[.]233AttackerAttacking hostŻory, SilesiaAS51310 Marcin Moczulski trading as Matronix1 feed2026-10-12 07:50
91.228.33[.]36AttackerAttacking hostRozprza, Łódź VoivodeshipAS56838 PUH Vatus Rafal Wejman1 feed2026-10-12 07:50
217.12.206[.]197MalwareZeppelinGdansk, PomeraniaAS204957 ROUTE 95 LLC1 feed · 12 sandbox samples2026-10-12 07:26
185.19.118[.]57AttackerAttacking hostGmina Przedbórz, Łódź VoivodeshipAS49528 MARCIN MALOLEPSZY @ALFANET1 feed2026-10-12 07:15
46.174.73[.]106AttackerAttacking hostCzęstochowa, SilesiaAS42832 PPHU 'VOIP PARTNERS' Tomasz Filak1 feed2026-10-12 06:10
185.16.39[.]123MalwareDcratWarsaw, MazoviaAS201814 MEVSPACE sp. z o.o.1 feed · 70 sandbox samples2026-10-12 06:08
195.205.4[.]147AttackerAttacking hostStrzegom, Lower SilesiaAS5617 Orange Polska Spolka Akcyjna1 feed2026-10-12 05:35
80.92.205[.]116MalwareDacicWarsaw, Mazovia 1 feed · 48 sandbox samples2026-10-12 05:00
91.240.44[.]102AttackerAttacking hostSulechów, LubuszAS198888 Adam Wojewoda trading as RNet1 feed2026-10-12 05:00
144.31.241[.]110AttackerAttacking hostWarsaw, MazoviaAS207957 SERV.HOST GROUP LTD2 feeds2026-10-12 04:35
152.233.43[.]20AttackerAttacking hostWarsaw, MazoviaAS60068 Datacamp Limited2 feeds2026-10-12 04:35
185.125.4[.]17AttackerAttacking hostGoraj, LublinAS203937 MAREK BZDZIUCH trading as CYFROTEL Sp. J.2 feeds2026-10-12 04:35
185.144.246[.]137AttackerAttacking hostWarsaw, MazoviaAS199980 IVENDO sp. z o.o.2 feeds2026-10-12 04:35
185.47.64[.]158AttackerMalicious IPRumia, PomeraniaAS60191 Nowatel Sp. z o.o.1 feed2026-10-12 04:35
193.239.205[.]90AttackerMalicious IPLodz, Łódź VoivodeshipAS197448 NT Group Systemy Informatyczne Sp. z o.o.1 feed2026-10-12 04:35
195.136.4[.]3AttackerAttacking hostKuźnica, PodlasieAS205608 SERVIRE Adam Kozlowski2 feeds2026-10-12 04:35
195.136.4[.]6AttackerAttacking hostKuźnica, PodlasieAS205608 SERVIRE Adam Kozlowski2 feeds2026-10-12 04:35
195.242.125[.]174AttackerAttacking hostLublin, LublinAS39716 VIP AGENCJA REKLAMY sp. z o.o2 feeds2026-10-12 04:35
200.138.46[.]103AttackerAttacking hostWarsaw, Mazovia 2 feeds2026-10-12 04:35
200.138.46[.]107AttackerAttacking hostWarsaw, Mazovia 2 feeds2026-10-12 04:35
200.138.46[.]134AttackerAttacking hostWarsaw, Mazovia 2 feeds2026-10-12 04:35
200.138.46[.]148AttackerAttacking hostWarsaw, Mazovia 2 feeds2026-10-12 04:35
200.138.46[.]161AttackerAttacking hostWarsaw, Mazovia 2 feeds2026-10-12 04:35

See every listed IP in Poland →

Ransomware victims in Poland

1 posted in the last 30 days, 12 in 90.

Sectors hit (30 days)

Groups (30 days)

Posted (UTC)VictimGroupSector
2026-09-29 20:30intense.plm3rxTechnology
2026-09-05 18:30ZdrowitthegentlemenHealthcare
2026-08-21 08:29LOG SystemsthegentlemenTechnology
2026-08-13 14:23GB Group S.AdragonforceFinancial Services
2026-08-07 08:07PontithegentlemenOther
2026-08-05 18:29Mera MetalqilinManufacturing
2026-07-31 18:26BaterthegentlemenOther
2026-07-31 18:23Paula FishthegentlemenOther
2026-07-25 17:55BioResearchDeadlockHealthcare
2026-07-23 15:10AgapitthegentlemenOther
2026-07-23 15:09Raben GroupthegentlemenTransportation
2026-07-16 12:57LsnthegentlemenTechnology

All ransomware victims in Poland →

Other countries

🇺🇸 United States 17,807🇨🇳 China 10,752🇩🇪 Germany 4,042🇬🇧 United Kingdom 3,668🇷🇺 Russia 3,582🇳🇱 Netherlands 2,247🇮🇳 India 2,068🇫🇷 France 1,538🇧🇷 Brazil 1,416🇸🇬 Singapore 1,330🇭🇰 Hong Kong 1,319🇰🇷 South Korea 1,306🇮🇩 Indonesia 1,189🇵🇰 Pakistan 880🇨🇦 Canada 867🇧🇪 Belgium 726🇯🇵 Japan 704🇺🇦 Ukraine 671🇿🇦 South Africa 557🇻🇳 Vietnam 546🇲🇾 Malaysia 523🇮🇹 Italy 405🇸🇪 Sweden 378🇵🇭 Philippines 351All countries →