🇸🇦 Saudi Arabia: live cyber threat activity

Malicious IPs, malware and ransomware victims in Saudi Arabia.

53Malicious IPs listed#63 of 182 countries · 0.08% of the world
17New in the last 24hfirst seen by any feed
18Reported by 2+ feedsindependent sources agree
2Ransomware victimsposted in the last 30 days

View Saudi Arabia on the live map →All listed IPs in Saudi ArabiaRansomware victims in Saudi Arabia

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

  1. C25
  2. Malware5
  3. Phishing0
  4. Attacker43

By state or region

  1. Riyadh Region30
  2. Mecca Region11
  3. Eastern Province7
  4. Medina Region2
  5. Al Bahah Region1
  6. Al-Qassim Region1
  7. 'Asir Region1

By city

  1. Riyadh26
  2. Jeddah8
  3. Jubail3
  4. Ad Dir‘īyah3
  5. Mecca2
  6. Dhahran1
  7. Al Bahah1
  8. Al Jumūm1
  9. Medina1
  10. Yanbu1
  11. Ra’s al Khafjī1
  12. Buraidah1
  13. Khamis Mushait1
  14. Sayhāt1
  15. Al Kharj1

Networks hosting the most

NetworkIPs
AS25019 Saudi Telecom Company JSC 33
AS35819 Etihad Etisalat, a joint stock company 10
AS31898 Oracle Corporation 5
AS154177 LIGHT NODE LIMITED 1
AS39891 Saudi Telecom Company JSC 1
AS45102 Alibaba (US) Technology Co., Ltd. 1
AS35753 Etihad Salam Telecom CJSC 1
AS43766 Mobile Telecommunication Company Saudi Arabia Joint-Stock company 1

Malware families served from Saudi Arabia

  1. Havoc4
  2. Zard1
  3. Convagent1

Most recently reported

IPRoleFamily / threatWhereNetworkReported byLast reported (UTC)
87.109.250[.]14AttackerAttacking hostAs Saffānīyah, Eastern ProvinceAS25019 Saudi Telecom Company JSC1 feed2026-10-12 06:41
188.48.77[.]172AttackerAttacking hostRiyadh, Riyadh RegionAS25019 Saudi Telecom Company JSC1 feed2026-10-12 06:10
141.179.79[.]87AttackerAttacking hostJubail, Eastern ProvinceAS25019 Saudi Telecom Company JSC2 feeds2026-10-12 04:35
143.92.171[.]245AttackerAttacking hostJubail, Eastern ProvinceAS25019 Saudi Telecom Company JSC2 feeds2026-10-12 04:35
159.0.99[.]133AttackerAttacking hostRiyadh, Riyadh RegionAS25019 Saudi Telecom Company JSC2 feeds2026-10-12 04:35
176.18.25[.]185AttackerAttacking hostRiyadh, Riyadh RegionAS35819 Etihad Etisalat, a joint stock company2 feeds2026-10-12 04:35
188.51.165[.]135AttackerAttacking hostRiyadh, Riyadh RegionAS25019 Saudi Telecom Company JSC2 feeds2026-10-12 04:35
188.54.103[.]20AttackerMalicious IPAd Dir‘īyah, Riyadh RegionAS25019 Saudi Telecom Company JSC1 feed2026-10-12 04:35
37.107.183[.]119AttackerAttacking hostRa’s al Khafjī, Eastern ProvinceAS25019 Saudi Telecom Company JSC2 feeds2026-10-12 04:35
46.153.100[.]230AttackerAttacking hostBuraidah, Al-Qassim RegionAS35819 Etihad Etisalat, a joint stock company2 feeds2026-10-12 04:35
5.111.207[.]4AttackerAttacking hostJeddah, Mecca RegionAS35819 Etihad Etisalat, a joint stock company2 feeds2026-10-12 04:35
51.211.87[.]150AttackerAttacking hostKhamis Mushait, 'Asir RegionAS25019 Saudi Telecom Company JSC2 feeds2026-10-12 04:35
82.167.212[.]123AttackerAttacking hostSayhāt, Eastern ProvinceAS35753 Etihad Salam Telecom CJSC2 feeds2026-10-12 04:35
142.154.126[.]143AttackerAttacking hostJeddah, Mecca RegionAS25019 Saudi Telecom Company JSC1 feed2026-10-12 04:35
145.241.107[.]14AttackerAttacking hostRiyadh, Riyadh RegionAS31898 Oracle Corporation2 feeds2026-10-12 04:35
178.73.119[.]44AttackerAttacking hostAl Jumūm, Mecca RegionAS35819 Etihad Etisalat, a joint stock company1 feed2026-10-11 23:40
2.91.144[.]164AttackerAttacking hostMedina, Medina RegionAS25019 Saudi Telecom Company JSC1 feed2026-10-11 21:55
188.48.122[.]114MalwareContacted by malwareRiyadh, Riyadh RegionAS25019 Saudi Telecom Company JSC1 feed · 43 sandbox samples2026-10-11 07:02
130.164.152[.]174AttackerAttacking hostRiyadh, Riyadh RegionAS25019 Saudi Telecom Company JSC2 feeds2026-10-11 04:31
130.164.165[.]9AttackerMalicious IPDhahran, Eastern ProvinceAS25019 Saudi Telecom Company JSC1 feed2026-10-11 04:31
188.50.115[.]249AttackerMalicious IPRiyadh, Riyadh RegionAS25019 Saudi Telecom Company JSC1 feed2026-10-11 04:31
2.89.136[.]254AttackerAttacking hostJubail, Eastern ProvinceAS25019 Saudi Telecom Company JSC2 feeds2026-10-11 04:31
2a02[:]9b0[:]4028[:]ba26[:]1c5a[:]6a6f[:]2cdc[:]2149AttackerMalicious IPJeddah, Mecca RegionAS35819 Etihad Etisalat, a joint stock company1 feed2026-10-11 04:31
31.166.73[.]86AttackerAttacking hostRiyadh, Riyadh RegionAS35819 Etihad Etisalat, a joint stock company3 feeds2026-10-11 04:31
5.156.51[.]123AttackerAttacking hostRiyadh, Riyadh RegionAS39891 Saudi Telecom Company JSC2 feeds2026-10-11 04:31

See every listed IP in Saudi Arabia →

Ransomware victims in Saudi Arabia

2 posted in the last 30 days, 9 in 90.

Sectors hit (30 days)

Groups (30 days)

Posted (UTC)VictimGroupSector
2026-10-03 11:54World Cup 2034WallstreetOther
2026-09-24 20:01efada.sakrybitOther
2026-09-06 12:22KHALED ALFAGIH ENGINEERING CONSULTANCYPanzerProfessional Services
2026-09-01 08:56meccahighfeed.blogspot.comkrybitAgriculture and Food Production
2026-08-31 12:04Saudi Consulting Services SAUD CONSULTthegentlemenProfessional Services
2026-08-01 09:53MTCO (Mahmoud Altaheni & Partners Trading Co)GammaxProfessional Services
2026-07-31 18:29Salem Saleh Babgithegentlemen—
2026-07-18 11:59NewNetdragonforceTechnology
2026-07-14 10:23L'azurdeblacknevasRetail & E-Commerce

All ransomware victims in Saudi Arabia →

Other countries

🇺🇸 United States 17,807🇨🇳 China 10,752🇩🇪 Germany 4,042🇬🇧 United Kingdom 3,668🇷🇺 Russia 3,582🇳🇱 Netherlands 2,247🇮🇳 India 2,068🇫🇷 France 1,538🇧🇷 Brazil 1,416🇸🇬 Singapore 1,330🇭🇰 Hong Kong 1,319🇰🇷 South Korea 1,306🇮🇩 Indonesia 1,189🇵🇰 Pakistan 880🇨🇦 Canada 867🇧🇪 Belgium 726🇯🇵 Japan 704🇺🇦 Ukraine 671🇵🇱 Poland 560🇿🇦 South Africa 557🇻🇳 Vietnam 546🇲🇾 Malaysia 523🇮🇹 Italy 405🇸🇪 Sweden 378All countries →