🇺🇦 Ukraine: live cyber threat activity

Malicious IPs, malware and ransomware victims in Ukraine.

671Malicious IPs listed#18 of 182 countries · 1.01% of the world
130New in the last 24hfirst seen by any feed
185Reported by 2+ feedsindependent sources agree
1Ransomware victimsposted in the last 30 days

View Ukraine on the live map →All listed IPs in UkraineRansomware victims in Ukraine

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

  1. C221
  2. Malware54
  3. Phishing0
  4. Attacker596

By state or region

  1. Ivano-Frankivsk259
  2. Lviv115
  3. Kyiv City83
  4. Kharkiv74
  5. Odesa22
  6. Dnipropetrovsk17
  7. Chernivtsi17
  8. Poltava13
  9. Volyn12
  10. Ternopil11
  11. Vinnytsia8
  12. Zakarpattia7
  13. Zaporizhzhia5
  14. Kyiv Oblast5
  15. Kirovohrad4

By city

  1. Burshtyn256
  2. Lviv84
  3. Kyiv79
  4. Balakliia42
  5. Radekhiv18
  6. Slobozhanske13
  7. Dnipro11
  8. Kremenchuk10
  9. Odesa8
  10. Zhuravnyky8
  11. Hlyboka7
  12. Verbivka6
  13. Zaliztsi5
  14. Chernivtsi5
  15. Kharkiv4

Networks hosting the most

NetworkIPs
AS15895 "Kyivstar" PJSC 259
AS62384 Radio Service Ltd. 77
AS56812 CHP Zarko Alexandr Ivanovich 64
AS3255 LLC EKSINTECH 48
AS36680 Netiface LLC 22
AS197218 PP Dmutrashko Evgeny Vitalievich 15
AS6849 JSC "Ukrtelecom" 13
AS6698 Virtual Systems LLC 8
AS48693 Rices Privately owned enterprise 7
AS25082 Viner Telecom LLC 7
AS13188 CONTENT DELIVERY NETWORK LTD 6
AS30860 Virtual Systems LLC 5
AS16223 MAXNET TELECOM, LTD 5
AS50115 Lekol LLC 5
AS6876 TENET Scientific Production Enterprise LLC 4

Malware families served from Ukraine

  1. Jackskid6
  2. Remcos4
  3. Ftmn3
  4. Cobalt Strike3
  5. Krypt2
  6. PureRAT2
  7. Rugmi1
  8. Keylogger1
  9. Utorrent1
  10. Amadey1
  11. BianLian1
  12. Generickds1
  13. pupy1
  14. CECbot1
  15. Evilginx1

Most recently reported

IPRoleFamily / threatWhereNetworkReported byLast reported (UTC)
176.103.4[.]19AttackerAttacking hostBalakliia, KharkivAS56812 CHP Zarko Alexandr Ivanovich1 feed2026-10-12 08:20
188.191.67[.]59AttackerAttacking hostLviv, LvivAS43258 Centr Servisnogo Oblslugovuvannya Ltd1 feed2026-10-12 08:10
176.103.5[.]205AttackerAttacking hostBalakliia, KharkivAS56812 CHP Zarko Alexandr Ivanovich1 feed2026-10-12 07:50
194.44.140[.]59AttackerAttacking hostLviv, LvivAS3255 LLC EKSINTECH1 feed2026-10-12 07:50
194.44.140[.]88AttackerAttacking hostLviv, LvivAS3255 LLC EKSINTECH1 feed2026-10-12 07:50
176.103.3[.]245AttackerAttacking hostBalakliia, KharkivAS56812 CHP Zarko Alexandr Ivanovich1 feed2026-10-12 07:15
176.103.7[.]80AttackerAttacking hostSlobozhanske, KharkivAS56812 CHP Zarko Alexandr Ivanovich1 feed2026-10-12 07:15
37.221.144[.]111AttackerAttacking hostLiskovets, ZakarpattiaAS62384 Radio Service Ltd.1 feed2026-10-12 07:15
37.221.149[.]162AttackerAttacking hostLviv, LvivAS62384 Radio Service Ltd.1 feed2026-10-12 07:15
185.183.94[.]223AttackerAttacking hostBoratyn, VolynAS35586 VOLYN OPTICAL NETWORKS LLC1 feed2026-10-12 06:41
176.241.106[.]166AttackerAttacking hostKyiv, Kyiv CityAS3326 PRIVATE JOINT STOCK COMPANY "DATAGROUP"1 feed2026-10-12 06:10
77.239.165[.]56AttackerAttacking hostSlobozhanske, DnipropetrovskAS21497 PrJSC "VF UKRAINE"1 feed2026-10-12 06:10
37.221.132[.]134AttackerAttacking hostLviv, LvivAS62384 Radio Service Ltd.1 feed2026-10-12 05:35
130.0.52[.]180AttackerAttacking hostOdesa, OdesaAS6876 TENET Scientific Production Enterprise LLC2 feeds2026-10-12 04:35
145.224.122[.]222AttackerAttacking hostKyiv, Kyiv CityAS14593 Space Exploration Technologies Corporation2 feeds2026-10-12 04:35
146.120.161[.]69AttackerAttacking hostZaporizhzhya, ZaporizhzhiaAS60754 Dianet Ltd.2 feeds2026-10-12 04:35
176.103.0[.]138AttackerAttacking hostBalakliia, KharkivAS56812 CHP Zarko Alexandr Ivanovich2 feeds2026-10-12 04:35
176.103.0[.]207AttackerAttacking hostBalakliia, KharkivAS56812 CHP Zarko Alexandr Ivanovich2 feeds2026-10-12 04:35
176.103.0[.]241AttackerAttacking hostBalakliia, KharkivAS56812 CHP Zarko Alexandr Ivanovich2 feeds2026-10-12 04:35
176.103.11[.]134AttackerAttacking hostAndreyevka, KharkivAS56812 CHP Zarko Alexandr Ivanovich2 feeds2026-10-12 04:35
176.103.11[.]64AttackerAttacking hostAndreyevka, KharkivAS56812 CHP Zarko Alexandr Ivanovich2 feeds2026-10-12 04:35
176.103.2[.]158AttackerAttacking hostBalakliia, KharkivAS56812 CHP Zarko Alexandr Ivanovich2 feeds2026-10-12 04:35
176.103.2[.]178AttackerAttacking hostBalakliia, KharkivAS56812 CHP Zarko Alexandr Ivanovich2 feeds2026-10-12 04:35
176.103.2[.]52AttackerAttacking hostBalakliia, KharkivAS56812 CHP Zarko Alexandr Ivanovich2 feeds2026-10-12 04:35
176.103.3[.]100AttackerAttacking hostBalakliia, KharkivAS56812 CHP Zarko Alexandr Ivanovich2 feeds2026-10-12 04:35

See every listed IP in Ukraine →

Ransomware victims in Ukraine

1 posted in the last 30 days, 2 in 90.

Sectors hit (30 days)

Groups (30 days)

Posted (UTC)VictimGroupSector
2026-09-16 18:22Wise ITAuditTeamTechnology
2026-09-08 11:20Wi***ITAuditTeamTechnology

All ransomware victims in Ukraine →

Other countries

🇺🇸 United States 17,807🇨🇳 China 10,752🇩🇪 Germany 4,042🇬🇧 United Kingdom 3,668🇷🇺 Russia 3,582🇳🇱 Netherlands 2,247🇮🇳 India 2,068🇫🇷 France 1,538🇧🇷 Brazil 1,416🇸🇬 Singapore 1,330🇭🇰 Hong Kong 1,319🇰🇷 South Korea 1,306🇮🇩 Indonesia 1,189🇵🇰 Pakistan 880🇨🇦 Canada 867🇧🇪 Belgium 726🇯🇵 Japan 704🇵🇱 Poland 560🇿🇦 South Africa 557🇻🇳 Vietnam 546🇲🇾 Malaysia 523🇮🇹 Italy 405🇸🇪 Sweden 378🇵🇭 Philippines 351All countries →