🇷🇸 Serbia: live cyber threat activity

Malicious IPs, malware and ransomware victims in Serbia.

52Malicious IPs listed#64 of 182 countries · 0.08% of the world

12New in the last 24hfirst seen by any feed

15Reported by 2+ feedsindependent sources agree

0Ransomware victimsposted in the last 30 days

View Serbia on the live map →All listed IPs in Serbia Ransomware victims in Serbia

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

By state or region

Central Serbia39
Vojvodina13

By city

Belgrade23
Kruševac3
Voždovac2
Temerin2
Novi Sad2
New Belgrade1
Niš1
Šajkaš1
Mladenovac1
Požarevac1
Zaječar1
Kraljevo1
Vlasotince1
Vršac1
Zrenjanin1

Networks hosting the most

Network	IPs
AS52026 TRUF d.o.o.	15
AS31042 Yettel d.o.o.	12
AS8400 TELEKOM SRBIJA a.d.	11
AS15958 CETIN Ltd. Belgrade	2
AS44143 A1 Srbija d.o.o. Beograd	2
AS41897 Sat-Trakt D.O.O.	2
AS211619 MAXKO d.o.o.	1
AS9009 M247 Europe SRL	1
AS51002 ASTRA TELEKOM DOO BEOGRAD	1
AS35779 mCloud doo	1
AS197423 Jotel d.o.o.	1
AS9125 Drustvo za telekomunikacije Orion telekom doo Beograd-Zemun	1
AS13092 Akademska mreza Republike Srbije - AMRES	1
AS200923 SAMOSTALNA RADNJA ZA TELEKOMUNIKACIJE EWIRELESS IGOR STOJKOVIC PR INDIJA	1

Malware families served from Serbia

Emotet2

Most recently reported

IP	Role	Family / threat	Where	Network	Reported by	Last reported (UTC)
87.116.176[.]18	Attacker	Attacking host	Novi Sad, Vojvodina	AS31042 Yettel d.o.o.	1 feed	2026-10-12 06:55
212.200.181[.]150	Attacker	Attacking host	Kruševac, Central Serbia	AS8400 TELEKOM SRBIJA a.d.	1 feed	2026-10-12 06:10
79.101.120[.]76	Attacker	Attacking host	Ratkovo, Vojvodina	AS8400 TELEKOM SRBIJA a.d.	2 feeds	2026-10-12 05:55
109.207.33[.]253	Attacker	Attacking host	Belgrade, Central Serbia	AS52026 TRUF d.o.o.	2 feeds	2026-10-12 04:35
109.207.43[.]94	Attacker	Attacking host	Voždovac, Central Serbia	AS52026 TRUF d.o.o.	2 feeds	2026-10-12 04:35
185.37.27[.]4	Attacker	Attacking host	Kraljevo, Central Serbia	AS44143 A1 Srbija d.o.o. Beograd	2 feeds	2026-10-12 04:35
188.120.118[.]240	Attacker	Attacking host	Vlasotince, Central Serbia	AS44143 A1 Srbija d.o.o. Beograd	2 feeds	2026-10-12 04:35
217.17.108[.]140	Attacker	Attacking host	Temerin, Vojvodina	AS41897 Sat-Trakt D.O.O.	2 feeds	2026-10-12 04:35
150.40.126[.]53	Attacker	On multiple blocklists	Belgrade, Central Serbia	AS211619 MAXKO d.o.o.	1 feed	2026-10-12 04:35
217.17.108[.]90	Attacker	Attacking host	Temerin, Vojvodina	AS41897 Sat-Trakt D.O.O.	1 feed	2026-10-12 04:30
2a06[:]63c0[:]820c[:]d300[:]4c4b[:]b3a5[:]dd96[:]440a	Attacker	Attacking host	Belgrade, Central Serbia	AS8400 TELEKOM SRBIJA a.d.	1 feed	2026-10-12 00:45
109.207.33[.]248	Attacker	Attacking host	Belgrade, Central Serbia	AS52026 TRUF d.o.o.	1 feed	2026-10-11 20:55
188.2.217[.]94	Malware	Emotet	Vršac, Vojvodina	AS31042 Yettel d.o.o.	1 feed · 294 sandbox samples	2026-10-11 08:34
109.206.102[.]74	Attacker	Malicious IP	Belgrade, Central Serbia	AS52026 TRUF d.o.o.	1 feed	2026-10-11 04:31
109.206.113[.]185	Attacker	Malicious IP	New Belgrade, Central Serbia	AS52026 TRUF d.o.o.	1 feed	2026-10-11 04:31
109.206.115[.]23	Attacker	On multiple blocklists	Belgrade, Central Serbia	AS52026 TRUF d.o.o.	1 feed	2026-10-11 04:31
109.245.35[.]176	Attacker	Malicious IP	Niš, Central Serbia	AS15958 CETIN Ltd. Belgrade	1 feed	2026-10-11 04:31
109.245.95[.]219	Attacker	Attacking host	Kruševac, Central Serbia	AS15958 CETIN Ltd. Belgrade	2 feeds	2026-10-11 04:31
178.148.165[.]113	Attacker	Malicious IP	Belgrade, Central Serbia	AS31042 Yettel d.o.o.	1 feed	2026-10-11 04:31
212.200.181[.]152	Attacker	Malicious IP	Kruševac, Central Serbia	AS8400 TELEKOM SRBIJA a.d.	1 feed	2026-10-11 04:31
91.234.132[.]142	Attacker	Malicious IP	Belgrade, Central Serbia	AS52026 TRUF d.o.o.	1 feed	2026-10-11 04:31
93.87.35[.]213	Attacker	Malicious IP	Belgrade, Central Serbia	AS8400 TELEKOM SRBIJA a.d.	1 feed	2026-10-11 04:31
95.140.123[.]4	Attacker	Attacking host	Indjija, Vojvodina	AS200923 SAMOSTALNA RADNJA ZA TELEKOMUNIKACIJE EWIRELESS IGOR STOJKOVIC PR INDIJA	2 feeds	2026-10-11 04:31
95.180.61[.]103	Attacker	Attacking host	Vrbas, Vojvodina	AS31042 Yettel d.o.o.	2 feeds	2026-10-11 04:31
89.216.75[.]80	Attacker	Malicious IP	Dolovo, Vojvodina	AS31042 Yettel d.o.o.	1 feed	2026-10-11 04:30

See every listed IP in Serbia →

Ransomware victims in Serbia

0 posted in the last 30 days, 2 in 90.

Sectors hit (30 days)

Groups (30 days)

Posted (UTC)	Victim	Group	Sector
2026-09-08 20:46	Red Star Oil	play	Energy & Utilities
2026-08-24 14:22	Government of Vojvodina	Panzer	Government & Defense

All ransomware victims in Serbia →