🇸🇾 Syria: live cyber threat activity

Malicious IPs, malware and ransomware victims in Syria.

25Malicious IPs listed#88 of 182 countries · 0.04% of the world

7New in the last 24hfirst seen by any feed

9Reported by 2+ feedsindependent sources agree

0Ransomware victimsposted in the last 30 days

View Syria on the live map →All listed IPs in Syria

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

By state or region

Damascus Governorate7
Rif-dimashq7
Dimashq6
Al-Hasakah2
Hama1
Tartus1
Latakia1

By city

Damascus12
At Tall4
Maşyāf1
Tartus1
Latakia1
Yarmouk1
‘Āmūdā1
Al-Qamishli1
Dārayyā1
Al Quţayfah1
Qadsayyā1

Networks hosting the most

Network	IPs
AS29256 Syrian Telecom	22
AS214707 RCell LLC	2
AS14593 Space Exploration Technologies Corporation	1

Malware families served from Syria

Most recently reported

IP	Role	Family / threat	Where	Network	Reported by	Last reported (UTC)
82.137.218[.]134	Malware	Grenam	Damascus, Dimashq	AS29256 Syrian Telecom	1 feed · 21 sandbox samples	2026-10-12 07:26
91.144.21[.]210	Attacker	Attacking host	Damascus, Dimashq	AS29256 Syrian Telecom	1 feed	2026-10-12 07:15
82.137.244[.]65	Malware	Phorpiex	Damascus, Dimashq	AS29256 Syrian Telecom	1 feed · 25 sandbox samples	2026-10-12 06:58
185.225.41[.]236	Attacker	Attacking host	Tartus, Tartus	AS29256 Syrian Telecom	2 feeds	2026-10-12 04:35
193.43.140[.]174	Attacker	Attacking host	Latakia, Latakia	AS29256 Syrian Telecom	2 feeds	2026-10-12 04:35
9.246.91[.]74	Attacker	Attacking host	Damascus, Damascus Governorate	AS14593 Space Exploration Technologies Corporation	2 feeds	2026-10-12 04:35
31.9.50[.]79	Attacker	Attacking host	Dārayyā, Rif-dimashq	AS29256 Syrian Telecom	1 feed	2026-10-12 03:25
178.253.101[.]194	Malware	Phorpiex	Damascus, Damascus Governorate	AS29256 Syrian Telecom	1 feed · 4 sandbox samples	2026-10-11 06:41
185.150.143[.]158	Malware	Contacted by malware	Damascus, Dimashq	AS29256 Syrian Telecom	1 feed · 3 sandbox samples	2026-10-11 06:41
185.217.174[.]53	Attacker	Attacking host	Maşyāf, Hama	AS29256 Syrian Telecom	2 feeds	2026-10-11 04:31
185.235.16[.]12	Attacker	Attacking host	Damascus, Dimashq	AS29256 Syrian Telecom	2 feeds	2026-10-11 04:31
46.53.65[.]231	Attacker	Attacking host	Damascus, Damascus Governorate	AS29256 Syrian Telecom	2 feeds	2026-10-11 04:31
5.0.42[.]247	Attacker	Attacking host	Damascus, Damascus Governorate	AS29256 Syrian Telecom	2 feeds	2026-10-11 04:31
193.43.145[.]179	Attacker	Attacking host	Yarmouk, Damascus Governorate	AS29256 Syrian Telecom	1 feed	2026-10-09 08:30
205.209.65[.]70	Attacker	On multiple blocklists	‘Āmūdā, Al-Hasakah	AS214707 RCell LLC	2 feeds	2026-10-09 04:27
205.209.67[.]3	Attacker	On multiple blocklists	Al-Qamishli, Al-Hasakah	AS214707 RCell LLC	2 feeds	2026-10-09 04:27
37.48.148[.]108	Malware	Malware download	At Tall, Rif-dimashq	AS29256 Syrian Telecom	aggregated list	2026-10-09 04:02
37.48.146[.]38	Malware	Malware download	At Tall, Rif-dimashq	AS29256 Syrian Telecom	aggregated list	2026-10-08 17:32
185.194.125[.]197	Malware	Gandcrab	Damascus, Damascus Governorate	AS29256 Syrian Telecom	1 feed · 4 sandbox samples	2026-10-07 05:28
37.48.179[.]81	Malware	Malware download	At Tall, Rif-dimashq	AS29256 Syrian Telecom	aggregated list	2026-10-03 04:32
37.48.157[.]4	Malware	Malware download	At Tall, Rif-dimashq	AS29256 Syrian Telecom	aggregated list	2026-09-23 07:47
90.153.190[.]250	Malware	Malware download	Qadsayyā, Rif-dimashq	AS29256 Syrian Telecom	aggregated list	2026-09-23 04:01
178.253.99[.]184	Attacker	Attacking host	Damascus, Damascus Governorate	AS29256 Syrian Telecom	1 feed	—
91.144.18[.]230	Attacker	Attacking host	Damascus, Dimashq	AS29256 Syrian Telecom	1 feed	—
91.144.32[.]178	Attacker	Attacking host	Al Quţayfah, Rif-dimashq	AS29256 Syrian Telecom	1 feed	—

See every listed IP in Syria →

Ransomware victims in Syria

No ransomware victims from Syria posted in the last 90 days.