🇸🇪 Sweden: live cyber threat activity

Malicious IPs, malware and ransomware victims in Sweden.

378Malicious IPs listed#24 of 182 countries · 0.57% of the world
55New in the last 24hfirst seen by any feed
88Reported by 2+ feedsindependent sources agree
10Ransomware victimsposted in the last 30 days

View Sweden on the live map →All listed IPs in SwedenRansomware victims in Sweden

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

  1. C245
  2. Malware68
  3. Phishing0
  4. Attacker265

By state or region

  1. Stockholm230
  2. Värmland55
  3. Västra Götaland16
  4. Skåne16
  5. Östergötland9
  6. Västerbotten9
  7. Västmanland8
  8. Kronoberg5
  9. Gävleborg5
  10. Uppsala5
  11. Halland5
  12. Jönköping3
  13. Norrbotten3
  14. Örebro3
  15. Jämtland2

By city

  1. Stockholm182
  2. Hägersten27
  3. Karlstad17
  4. Skåre6
  5. Årjäng6
  6. Hörnefors6
  7. Malmö5
  8. Arvika5
  9. Solna5
  10. Västerås4
  11. Åmål4
  12. Vaxjo4
  13. Säffle4
  14. Gothenburg3
  15. Lindö3

Networks hosting the most

NetworkIPs
AS3301 Telia Company AB 50
AS12552 GlobalConnect AB 42
AS29518 Bredband2 AB 40
AS215925 VPSVAULT.HOST LTD 29
AS8473 Bahnhof AB 28
AS42708 GleSYS AB 26
AS1257 Tele2 Sverige AB 15
AS198093 Foreningen for digitala fri- och rattigheter 15
AS42237 w1n ltd 11
AS41281 KeFF Networks Ltd 10
AS8434 Telenor Sverige AB 10
AS212238 Datacamp Limited 8
AS16509 Amazon.com, Inc. 6
AS198550 NODE HOST LIMITED 6
AS39351 31173 Services AB 5

Malware families served from Sweden

  1. AsyncRAT11
  2. Remcos10
  3. DCRat6
  4. Havoc3
  5. Coinhelper3
  6. Potassium2
  7. Themida2
  8. AdaptixC22
  9. Vidar2
  10. DanaBot2
  11. DeimosC22
  12. Wannacry1
  13. Bingoml1
  14. Jackskid1
  15. Jatif1

Most recently reported

IPRoleFamily / threatWhereNetworkReported byLast reported (UTC)
93.158.90[.]144AttackerAttacking hostStockholm, StockholmAS12552 GlobalConnect AB1 feed2026-10-12 08:10
185.76.9[.]35AttackerAttacking hostStockholm, StockholmAS60068 Datacamp Limited1 feed2026-10-12 07:50
45.198.224[.]34MalwareCompromised hostStockholm, StockholmAS215925 VPSVAULT.HOST LTD1 feed2026-10-12 07:21
2.27.14[.]196MalwareMalicious IPStockholm, StockholmAS198550 NODE HOST LIMITED1 feed2026-10-12 07:20
46.236.65[.]235MalwareMalware downloadHörnefors, VästerbottenAS29518 Bredband2 ABaggregated list2026-10-12 07:12
185.65.135[.]234MalwareDacicHägersten, StockholmAS39351 31173 Services AB1 feed · 416 sandbox samples2026-10-12 06:08
170.62.100[.]186AttackerAttacking hostStockholm, StockholmAS212238 Datacamp Limited2 feeds2026-10-12 04:35
170.62.100[.]244AttackerMalicious IPStockholm, StockholmAS212238 Datacamp Limited1 feed2026-10-12 04:35
191.44.114[.]74MalwareMalicious IPStockholm, StockholmAS198550 NODE HOST LIMITED1 feed2026-10-12 04:35
193.105.134[.]18AttackerMalicious IPStockholm, StockholmAS42237 w1n ltd1 feed · 1 sandbox sample2026-10-12 04:35
193.27.200[.]200AttackerAttacking hostTidaholm, Västra GötalandAS30880 SpaceDump IT AB2 feeds2026-10-12 04:35
194.195.91[.]33AttackerAttacking hostStockholm, StockholmAS206092 F.N.S. HOLDINGS LIMITED2 feeds2026-10-12 04:35
194.195.91[.]34AttackerAttacking hostStockholm, StockholmAS206092 F.N.S. HOLDINGS LIMITED2 feeds2026-10-12 04:35
194.195.91[.]36AttackerAttacking hostStockholm, StockholmAS206092 F.N.S. HOLDINGS LIMITED2 feeds2026-10-12 04:35
198.167.206[.]222AttackerMalicious IPMalmö, SkåneAS39287 Materialism s.r.l.1 feed2026-10-12 04:35
198.167.206[.]251AttackerTor exitMalmö, SkåneAS39287 Materialism s.r.l.2 feeds2026-10-12 04:35
212.147.244[.]162:443C2VidarStockholm, StockholmAS202053 UpCloud Ltd1 feed2026-10-12 04:35
213.66.16[.]204AttackerMalicious IPBergsviken, NorrbottenAS3301 Telia Company AB1 feed2026-10-12 04:35
213.67.210[.]12AttackerAttacking hostÅs, JämtlandAS3301 Telia Company AB2 feeds2026-10-12 04:35
45.130.200[.]133AttackerAttacking hostBorensberg, ÖstergötlandAS197854 Eisenia AB2 feeds2026-10-12 04:35
45.198.224[.]48AttackerAttacking hostStockholm, StockholmAS215925 VPSVAULT.HOST LTD2 feeds2026-10-12 04:35
45.91.171[.]113AttackerAttacking hostStockholm, StockholmAS36007 Kamatera, Inc.2 feeds2026-10-12 04:35
46.162.102[.]80AttackerAttacking hostStockholm, StockholmAS29518 Bredband2 AB2 feeds2026-10-12 04:35
81.225.186[.]125AttackerMalicious IPUpphärad, Västra GötalandAS3301 Telia Company AB1 feed2026-10-12 04:35
81.227.62[.]126AttackerAttacking hostBorlänge, DalarnaAS3301 Telia Company AB2 feeds2026-10-12 04:35

See every listed IP in Sweden →

Ransomware victims in Sweden

10 posted in the last 30 days, 26 in 90.

Sectors hit (30 days)

Groups (30 days)

Posted (UTC)VictimGroupSector
2026-10-09 20:08Vadeto Groupqilin—
2026-10-02 18:04Electro Heat Sweden ABrhysidaEnergy & Utilities
2026-09-28 19:30bakemyday.seincransomRetail & E-Commerce
2026-09-28 02:51Electrolux 2...emperadorManufacturing
2026-09-26 08:46MarkisolthegentlemenManufacturing
2026-09-25 16:29Securitas GroupeverestProfessional Services
2026-09-19 15:50ElectroluxemperadorManufacturing
2026-09-18 15:27PayPal support operations (Transcom WorldWide)N0nFinancial Services
2026-09-16 04:01AarsleffqilinManufacturing
2026-09-15 07:16Goteborgsregionens Tekniska GymnasiumthegentlemenEducation
2026-09-11 12:29Dustin GroupfulcrumsecTechnology
2026-09-07 13:26Semper LaserdirewolfManufacturing
2026-08-30 14:54THQ NordicdirewolfTechnology
2026-08-28 22:57Elekta ABshinyhuntersHealthcare
2026-08-21 05:50avkvalves.comsettraManufacturing

All ransomware victims in Sweden →

Other countries

🇺🇸 United States 17,807🇨🇳 China 10,752🇩🇪 Germany 4,042🇬🇧 United Kingdom 3,668🇷🇺 Russia 3,582🇳🇱 Netherlands 2,247🇮🇳 India 2,068🇫🇷 France 1,538🇧🇷 Brazil 1,416🇸🇬 Singapore 1,330🇭🇰 Hong Kong 1,319🇰🇷 South Korea 1,306🇮🇩 Indonesia 1,189🇵🇰 Pakistan 880🇨🇦 Canada 867🇧🇪 Belgium 726🇯🇵 Japan 704🇺🇦 Ukraine 671🇵🇱 Poland 560🇿🇦 South Africa 557🇻🇳 Vietnam 546🇲🇾 Malaysia 523🇮🇹 Italy 405🇵🇭 Philippines 351All countries →