🇨🇭 Switzerland: live cyber threat activity

Malicious IPs, malware and ransomware victims in Switzerland.

125Malicious IPs listed#40 of 182 countries · 0.19% of the world
28New in the last 24hfirst seen by any feed
33Reported by 2+ feedsindependent sources agree
13Ransomware victimsposted in the last 30 days

View Switzerland on the live map →All listed IPs in SwitzerlandRansomware victims in Switzerland

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

  1. C221
  2. Malware35
  3. Phishing0
  4. Attacker69

By state or region

  1. Zurich66
  2. Bern37
  3. Geneva8
  4. Basel-City6
  5. Zug4
  6. Basel-Landschaft2
  7. Valais1
  8. Aargau1

By city

  1. Zurich60
  2. Bern36
  3. Geneva8
  4. Basel6
  5. Hünenberg4
  6. Oberengstringen1
  7. Unterseen1
  8. Saas-Fee1
  9. Opfikon1
  10. Densbüren1
  11. Winterthur1
  12. Grellingen1
  13. Dübendorf1
  14. Rietgrabenhang1
  15. Rümlang1

Networks hosting the most

NetworkIPs
AS51852 Private Layer INC 32
AS212238 Datacamp Limited 11
AS209373 SWISSNET LLC 9
AS29222 Infomaniak Network SA 6
AS9009 M247 Europe SRL 5
AS211720 Datashield, Inc. 5
AS6775 Andreas Fink trading as Fink Telecom Services GmbH 5
AS8075 Microsoft Corporation 4
AS13030 Init7 (Switzerland) Ltd. 4
AS264617 GRUPO PANAGLOBAL 15 S.A 3
AS51395 Datasource AG 3
AS14956 RouterHosting LLC 3
AS402253 SKN Subnet & Telecom Ltd 2
AS209413 DEDIK SERVICES LIMITED 2
AS136787 PacketHub S.A. 2

Malware families served from Switzerland

  1. Cobalt Strike8
  2. Mokes3
  3. Zard3
  4. Loki3
  5. Vidar3
  6. Tsundere2
  7. Amadey2
  8. Isjgyzp1
  9. Wannacry1
  10. Cryp1
  11. Zapchast1
  12. Hrbt1
  13. Havoc1
  14. Themida1
  15. Ekstak1

Most recently reported

IPRoleFamily / threatWhereNetworkReported byLast reported (UTC)
179.43.155[.]247MalwareMokesZurich, ZurichAS51852 Private Layer INC1 feed · 42 sandbox samples2026-10-12 07:26
46.19.141[.]122MalwareMedusaZurich, ZurichAS51852 Private Layer INC1 feed · 4 sandbox samples2026-10-12 07:26
179.43.142[.]201MalwareMokesZurich, ZurichAS51852 Private Layer INC1 feed · 68 sandbox samples2026-10-12 06:58
156.146.62[.]55AttackerAttacking hostZurich, ZurichAS212238 Datacamp Limited2 feeds2026-10-12 04:35
169.150.197[.]13AttackerAttacking hostZurich, ZurichAS212238 Datacamp Limited2 feeds2026-10-12 04:35
169.150.197[.]43AttackerAttacking hostZurich, ZurichAS212238 Datacamp Limited2 feeds2026-10-12 04:35
169.150.197[.]45AttackerAttacking hostZurich, ZurichAS212238 Datacamp Limited2 feeds2026-10-12 04:35
169.150.197[.]8AttackerAttacking hostZurich, ZurichAS212238 Datacamp Limited2 feeds2026-10-12 04:35
170.231.236[.]98AttackerOn multiple blocklistsZurich, ZurichAS264617 GRUPO PANAGLOBAL 15 S.A3 feeds2026-10-12 04:35
194.230.146[.]134AttackerAttacking hostGeneva, GenevaAS6730 Sunrise GmbH2 feeds2026-10-12 04:35
195.15.254[.]177AttackerAttacking hostGeneva, GenevaAS29222 Infomaniak Network SA2 feeds2026-10-12 04:35
2001[:]1600[:]18[:]208[:][:]220AttackerMalicious IPGeneva, GenevaAS29222 Infomaniak Network SA1 feed2026-10-12 04:35
213.144.157[.]231AttackerMalicious IPDensbüren, AargauAS13030 Init7 (Switzerland) Ltd.1 feed2026-10-12 04:35
34.65.90[.]88AttackerAttacking hostZurich, ZurichAS396982 Google LLC2 feeds2026-10-12 04:35
83.228.241[.]212AttackerMalicious IPGeneva, GenevaAS29222 Infomaniak Network SA1 feed2026-10-12 04:35
83.228.247[.]113AttackerMalicious IPGeneva, GenevaAS29222 Infomaniak Network SA1 feed2026-10-12 04:35
89.222.97[.]195AttackerAttacking hostZurich, ZurichAS212238 Datacamp Limited2 feeds2026-10-12 04:35
89.222.97[.]212AttackerAttacking hostZurich, ZurichAS212238 Datacamp Limited2 feeds2026-10-12 04:35
104.251.180[.]9AttackerOn multiple blocklistsZurich, ZurichAS402253 SKN Subnet & Telecom Ltdaggregated list2026-10-12 04:35
169.150.197[.]38AttackerAttacking hostZurich, ZurichAS212238 Datacamp Limited1 feed2026-10-12 04:35
89.37.173[.]32AttackerAttacking hostZurich, ZurichAS25369 Hydra Communications Ltd1 feed2026-10-12 03:55
81.17.29[.]147MalwareZardZurich, ZurichAS51852 Private Layer INC1 feed · 38 sandbox samples2026-10-12 03:45
187.15.169[.]251AttackerAttacking hostZurich, ZurichAS136787 PacketHub S.A.1 feed2026-10-11 20:55
187.15.169[.]7AttackerAttacking hostZurich, ZurichAS136787 PacketHub S.A.1 feed2026-10-11 20:55
34.65.152[.]217AttackerAttacking hostZurich, ZurichAS396982 Google LLC1 feed2026-10-11 19:50

See every listed IP in Switzerland →

Ransomware victims in Switzerland

13 posted in the last 30 days, 37 in 90.

Sectors hit (30 days)

Groups (30 days)

Posted (UTC)VictimGroupSector
2026-10-09 22:10hoteldelfinolugano.chsafepayHospitality
2026-10-08 19:33Boullard MusiquepayloadRetail & E-Commerce
2026-10-05 19:39dd-automation.chsafepayTechnology
2026-10-05 19:37stuecheli.chsafepayRetail & E-Commerce
2026-10-05 11:07Rueegseggeragmedusalocker—
2026-09-28 16:59Netech (Neeser Technik AG)payloadManufacturing
2026-09-28 08:34manno.chsafepayOther
2026-09-28 07:33lfgholding.comsafepayOther
2026-09-28 07:32bio-strath.comsafepayHealthcare
2026-09-20 12:13Touring Club SuisseqilinTransportation
2026-09-15 19:30stoecklin-kuechen.chsafepayRetail & E-Commerce
2026-09-15 19:29ara-lyss.chsafepayProfessional Services
2026-09-15 07:13Neff DrexelthegentlemenManufacturing
2026-09-07 01:32Medela.comshinyhuntersHealthcare
2026-09-02 13:52Algra GroupakiraOther

All ransomware victims in Switzerland →

Other countries

🇺🇸 United States 17,807🇨🇳 China 10,752🇩🇪 Germany 4,042🇬🇧 United Kingdom 3,668🇷🇺 Russia 3,582🇳🇱 Netherlands 2,247🇮🇳 India 2,068🇫🇷 France 1,538🇧🇷 Brazil 1,416🇸🇬 Singapore 1,330🇭🇰 Hong Kong 1,319🇰🇷 South Korea 1,306🇮🇩 Indonesia 1,189🇵🇰 Pakistan 880🇨🇦 Canada 867🇧🇪 Belgium 726🇯🇵 Japan 704🇺🇦 Ukraine 671🇵🇱 Poland 560🇿🇦 South Africa 557🇻🇳 Vietnam 546🇲🇾 Malaysia 523🇮🇹 Italy 405🇸🇪 Sweden 378All countries →