🇵🇹 Portugal: live cyber threat activity

Malicious IPs, malware and ransomware victims in Portugal.

43Malicious IPs listed#71 of 182 countries · 0.07% of the world

8New in the last 24hfirst seen by any feed

17Reported by 2+ feedsindependent sources agree

3Ransomware victimsposted in the last 30 days

View Portugal on the live map →All listed IPs in Portugal Ransomware victims in Portugal

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

By state or region

Lisbon19
Porto9
Setúbal4
Santarém2
Coimbra2
Azores2
Braga2
Leiria1
Viseu1
Aveiro1

By city

Lisbon16
Porto1
Marinha Grande1
Constância1
Jovim1
Tavarede1
Alfena1
Santa Maria de Avioso1
Noeda1
Póvoa de Varzim1
Póvoa de Santo Adrião1
Sernancelhe1
Lajes1
Maia1
Fátima1

Networks hosting the most

Network	IPs
AS2860 NOS COMUNICACOES, S.A.	13
AS12353 Vodafone Portugal - Communicacoes Pessoais S.A.	9
AS5533 Claranet Portugal S.A	6
AS3243 MEO - SERVICOS DE COMUNICACOES E MULTIMEDIA S.A.	5
AS1897 NOS COMUNICACOES, S.A.	3
AS16276 OVH SAS	2
AS39486 HostRoyale Technologies Pvt Ltd	1
AS24768 ALMOUROLTEC SERVICOS DE INFORMATICA E INTERNET LDA	1
AS212238 Datacamp Limited	1
AS20879 DIGI ROMANIA S.A.	1
AS47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal	1

Malware families served from Portugal

Most recently reported

IP	Role	Family / threat	Where	Network	Reported by	Last reported (UTC)
79.169.61[.]209	Attacker	Attacking host	Póvoa de Santo Adrião, Lisbon	AS2860 NOS COMUNICACOES, S.A.	1 feed	2026-10-12 08:20
103.192.205[.]13	Attacker	Attacking host	Porto, Porto	AS39486 HostRoyale Technologies Pvt Ltd	2 feeds	2026-10-12 04:35
158.173.244[.]2	Attacker	Attacking host	Lisbon, Lisbon	AS212238 Datacamp Limited	2 feeds	2026-10-12 04:35
188.83.9[.]79	Attacker	Malicious IP	Santa Maria de Avioso, Porto	AS3243 MEO - SERVICOS DE COMUNICACOES E MULTIMEDIA S.A.	1 feed	2026-10-12 04:35
80.172.216[.]15	Attacker	On multiple blocklists	Lisbon, Lisbon	AS5533 Claranet Portugal S.A	1 feed	2026-10-12 04:35
195.22.26[.]248	Malware	Agentb	Lisbon, Lisbon	AS5533 Claranet Portugal S.A	1 feed · 604 sandbox samples	2026-10-11 14:59
195.22.26[.]231	Malware	Contacted by malware	Lisbon, Lisbon	AS5533 Claranet Portugal S.A	1 feed · 26 sandbox samples	2026-10-11 14:09
195.22.26[.]254	Malware	Contacted by malware	Lisbon, Lisbon	AS5533 Claranet Portugal S.A	1 feed · 22 sandbox samples	2026-10-11 14:09
148.69.74[.]15	Attacker	Attacking host	Jovim, Porto	AS12353 Vodafone Portugal - Communicacoes Pessoais S.A.	2 feeds	2026-10-11 04:31
149.90.0[.]54	Attacker	Malicious IP	Lisbon, Lisbon	AS12353 Vodafone Portugal - Communicacoes Pessoais S.A.	1 feed	2026-10-11 04:31
178.166.116[.]105	Attacker	Attacking host	Alfena, Porto	AS12353 Vodafone Portugal - Communicacoes Pessoais S.A.	2 feeds	2026-10-11 04:31
2a01[:]11[:]221[:]10c0[:]fc49[:]564[:]d90f[:]ff22	Attacker	Attacking host	Noeda, Porto	AS2860 NOS COMUNICACOES, S.A.	2 feeds	2026-10-11 04:31
87.196.74[.]116	Attacker	Attacking host	Setúbal, Setúbal	AS2860 NOS COMUNICACOES, S.A.	2 feeds	2026-10-11 04:31
88.157.92[.]233	Attacker	Attacking host	Eiras, Coimbra	AS1897 NOS COMUNICACOES, S.A.	2 feeds	2026-10-11 04:31
195.22.26[.]232	Malware	Contacted by malware	Lisbon, Lisbon	AS5533 Claranet Portugal S.A	1 feed · 25 sandbox samples	2026-10-11 00:59
78.137.205[.]41	Attacker	Attacking host	Póvoa de Varzim, Porto	AS12353 Vodafone Portugal - Communicacoes Pessoais S.A.	2 feeds	2026-10-10 04:30
176.223.19[.]164	Attacker	Attacking host	Tavarede, Coimbra	AS20879 DIGI ROMANIA S.A.	1 feed	2026-10-09 15:10
93.108.115[.]33	Attacker	Attacking host	Ferreiros, Braga	AS12353 Vodafone Portugal - Communicacoes Pessoais S.A.	2 feeds	2026-10-09 04:27
94.60.193[.]98	Attacker	Attacking host	São Félix da Marinha, Porto	AS12353 Vodafone Portugal - Communicacoes Pessoais S.A.	2 feeds	2026-10-09 04:27
85.138.243[.]187	Attacker	Attacking host	Lisbon, Lisbon	AS2860 NOS COMUNICACOES, S.A.	1 feed	2026-10-09 04:27
95.136.95[.]193	Attacker	Attacking host	Montijo, Setúbal	AS12353 Vodafone Portugal - Communicacoes Pessoais S.A.	1 feed	2026-10-09 04:27
89.181.127[.]71	Attacker	On multiple blocklists	Ermidas, Setúbal	AS2860 NOS COMUNICACOES, S.A.	2 feeds	2026-10-09 04:27
195.22.28[.]196	Malware	Sality	Lisbon, Lisbon	AS5533 Claranet Portugal S.A	1 feed · 10 sandbox samples	2026-10-08 14:00
51.195.166[.]184	Malware	Loki	Lisbon, Lisbon	AS16276 OVH SAS	1 feed · 26 sandbox samples	2026-10-08 08:10
51.195.166[.]178	Malware	Coins	Lisbon, Lisbon	AS16276 OVH SAS	1 feed · 4 sandbox samples	2026-10-06 21:49

See every listed IP in Portugal →

Ransomware victims in Portugal

3 posted in the last 30 days, 15 in 90.

Sectors hit (30 days)

Groups (30 days)

Posted (UTC)	Victim	Group	Sector
2026-09-26 08:45	Brancoptica	thegentlemen	Other
2026-09-26 08:43	Ligue se Grupo	thegentlemen	Other
2026-09-23 17:44	Tomix / Grupo JOPER	spacebears	Manufacturing
2026-09-08 19:46	hbpro.pt	safepay	Professional Services
2026-09-07 21:54	Chip7	thegentlemen	Technology
2026-08-28 11:22	Directorate-General for Education	Panzer	Government & Defense
2026-08-24 13:53	www.ptesm.com	blackwater	—
2026-08-22 12:30	icnavais.com	lockbit5	—
2026-08-12 14:51	GRUPO STARFOODS	majinahanashi	Agriculture and Food Production
2026-07-26 11:27	createinfor.pt	m3rx	Professional Services
2026-07-23 15:14	GUERREIROS seguros	thegentlemen	Financial Services
2026-07-23 08:52	Sirl	thegentlemen	—
2026-07-21 15:09	Tèrra Aventura	nova	Hospitality
2026-07-16 12:59	Metro Mondego	thegentlemen	Transportation
2026-07-14 20:12	gemese.pt	arcusmedia	Professional Services

All ransomware victims in Portugal →