🇷🇴 Romania: live cyber threat activity

Malicious IPs, malware and ransomware victims in Romania.

97Malicious IPs listed#46 of 182 countries · 0.15% of the world
25New in the last 24hfirst seen by any feed
12Reported by 2+ feedsindependent sources agree
0Ransomware victimsposted in the last 30 days

View Romania on the live map →All listed IPs in RomaniaRansomware victims in Romania

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

  1. C226
  2. Malware20
  3. Phishing0
  4. Attacker51

By state or region

  1. Bucharest48
  2. Timiș County18
  3. Iași County5
  4. Botoșani County4
  5. București4
  6. Alba County2
  7. Bihor County2
  8. Arges2
  9. Bacău County1
  10. Cluj County1
  11. Satu Mare County1
  12. Hunedoara County1
  13. Ilfov1
  14. Dolj1
  15. Bucureşti1

By city

  1. Bucharest51
  2. Sânnicolau Mare11
  3. Timișoara7
  4. Iași5
  5. Bucuresti2
  6. Botoșani2
  7. Oradea2
  8. Slănic-Moldova1
  9. Cătămărești-Deal1
  10. Cluj-Napoca1
  11. Lucăceni1
  12. Bistra1
  13. Orăştie1
  14. Popeşti-Leordeni1
  15. Leu1

Networks hosting the most

NetworkIPs
AS8708 DIGI ROMANIA S.A. 14
AS200651 FlokiNET ehf 11
AS48874 HOSTMAZE INC SRL-D 11
AS9009 M247 Europe SRL 7
AS214209 Internet Magnate (Pty) Ltd 5
AS39798 MivoCloud SRL 5
AS12302 Vodafone Romania S.A. 5
AS9050 Orange Romania S.A. 4
AS49468 MAGIT'ST SRL 4
AS399629 BL Networks 4
AS210558 1337 Services GmbH 3
AS42397 Bunea TELECOM SRL 3
AS33911 TENNET TELECOM SRL 3
AS8953 Orange Romania S.A. 2
AS5483 Magyar Telekom plc. 2

Malware families served from Romania

  1. Potassium11
  2. Aisuru4
  3. Gandcrab3
  4. Havoc2
  5. Cobalt Strike2
  6. Remcos2
  7. Mokes1
  8. SmartLoader1
  9. Midie1
  10. Nymeria1
  11. PureRAT1
  12. Brsecmon1
  13. Genericfca1
  14. Phorpiex1
  15. Chaos1

Most recently reported

IPRoleFamily / threatWhereNetworkReported byLast reported (UTC)
188.27.241[.]122AttackerAttacking hostLucăceni, Satu Mare CountyAS8708 DIGI ROMANIA S.A.1 feed2026-10-12 07:50
109.98.58[.]98MalwareMokesCătămărești-Deal, Botoșani CountyAS9050 Orange Romania S.A.1 feed · 2,477 sandbox samples2026-10-12 07:26
62.231.103[.]202AttackerAttacking hostBucharest, BucharestAS8708 DIGI ROMANIA S.A.1 feed2026-10-12 06:55
185.10.68[.]110:80C2SmartLoaderBucharest, BucharestAS200651 FlokiNET ehf1 feed2026-10-12 06:49
31.46.22[.]138AttackerAttacking hostBucharest, BucharestAS5483 Magyar Telekom plc.1 feed2026-10-12 05:00
109.97.45[.]66MalwareMalicious IPSlănic-Moldova, Bacău CountyAS9050 Orange Romania S.A.1 feed2026-10-12 04:35
185.225.19[.]159AttackerMalicious IPIași, Iași CountyAS39798 MivoCloud SRL1 feed2026-10-12 04:35
2a02[:]2f0d[:]940e[:]3d00[:]4d63[:]ad02[:]c40a[:]f5AttackerAttacking hostBotoșani, Botoșani CountyAS8708 DIGI ROMANIA S.A.2 feeds2026-10-12 04:35
2a06[:]1700[:]0[:]8f7[:][:]56[:]d8f3AttackerMalicious IPBucharest, BucharestAS200651 FlokiNET ehf1 feed2026-10-12 04:35
31.46.22[.]133AttackerAttacking hostBucharest, BucharestAS5483 Magyar Telekom plc.2 feeds2026-10-12 04:35
5.12.138[.]85AttackerAttacking hostPopeşti-Leordeni, IlfovAS8708 DIGI ROMANIA S.A.2 feeds2026-10-12 04:35
72.5.42[.]37AttackerMalicious IPBucharest, BucharestAS399629 BL Networks1 feed2026-10-12 04:35
86.120.48[.]79AttackerAttacking hostAlexandria, Teleorman CountyAS8708 DIGI ROMANIA S.A.2 feeds2026-10-12 04:35
95.133.166[.]48AttackerMalicious IPBucharest, BucharestAS200651 FlokiNET ehf1 feed2026-10-12 04:35
93.113.203[.]91AttackerAttacking hostBucharest, BucureștiAS208949 HBING LIMITED1 feed2026-10-12 04:35
185.10.68[.]220MalwareContacted by malwareBucharest, BucharestAS200651 FlokiNET ehf1 feed · 1 sandbox sample2026-10-12 04:30
79.119.5[.]212AttackerAttacking hostOradea, Bihor CountyAS8708 DIGI ROMANIA S.A.1 feed2026-10-12 00:15
2a02[:]2f07[:]3907[:]9300[:]7d1b[:]f19d[:]40ca[:]d625AttackerAttacking hostBistra, Alba CountyAS8708 DIGI ROMANIA S.A.1 feed2026-10-11 22:00
82.79.225[.]217AttackerAttacking hostAlba Iulia, Alba CountyAS8708 DIGI ROMANIA S.A.1 feed2026-10-11 22:00
169.150.199[.]170AttackerAttacking hostBucharest, BucharestAS212238 Datacamp Limited1 feed2026-10-11 20:20
89.136.75[.]114AttackerAttacking hostFălticeni, SuceavaAS12302 Vodafone Romania S.A.1 feed2026-10-11 17:15
86.120.101[.]13AttackerAttacking hostSfantu Gheorghe, Covasna CountyAS8708 DIGI ROMANIA S.A.1 feed2026-10-11 16:11
89.42.39[.]160MalwareSalityBucharest, BucharestAS215014 DENIRO MEDIA SRL1 feed · 11 sandbox samples2026-10-11 15:16
89.41.177[.]33MalwareJaikOradea, Bihor CountyAS33911 TENNET TELECOM SRL1 feed · 61 sandbox samples2026-10-11 14:43
5.183.171[.]209MalwareAcecrypterBucharest, BucharestAS39383 Annarsy SRL1 feed · 49 sandbox samples2026-10-11 14:09

See every listed IP in Romania →

Ransomware victims in Romania

0 posted in the last 30 days, 6 in 90.

Sectors hit (30 days)

    Groups (30 days)

      Posted (UTC)VictimGroupSector
      2026-08-25 19:00SC PaderTeG Cabluri ElectriceqilinManufacturing
      2026-08-25 11:57AGROLAND S.A.qilinAgriculture and Food Production
      2026-08-09 14:32Harplast SRLqilinManufacturing
      2026-08-03 19:55Universitatea De Vest Vasile Goldi Din AradqilinEducation
      2026-08-03 05:08sms-sme.comlockbit5Professional Services
      2026-07-26 14:29Universitatea de Vest „Vasile Goldiș” din AradqilinEducation

      All ransomware victims in Romania →

      Other countries

      🇺🇸 United States 17,807🇨🇳 China 10,752🇩🇪 Germany 4,042🇬🇧 United Kingdom 3,668🇷🇺 Russia 3,582🇳🇱 Netherlands 2,247🇮🇳 India 2,068🇫🇷 France 1,538🇧🇷 Brazil 1,416🇸🇬 Singapore 1,330🇭🇰 Hong Kong 1,319🇰🇷 South Korea 1,306🇮🇩 Indonesia 1,189🇵🇰 Pakistan 880🇨🇦 Canada 867🇧🇪 Belgium 726🇯🇵 Japan 704🇺🇦 Ukraine 671🇵🇱 Poland 560🇿🇦 South Africa 557🇻🇳 Vietnam 546🇲🇾 Malaysia 523🇮🇹 Italy 405🇸🇪 Sweden 378All countries →