🇬🇧 United Kingdom: live cyber threat activity

Malicious IPs, malware and ransomware victims in United Kingdom.

3,668Malicious IPs listed#4 of 182 countries · 5.55% of the world
489New in the last 24hfirst seen by any feed
1,080Reported by 2+ feedsindependent sources agree
29Ransomware victimsposted in the last 30 days

View United Kingdom on the live map →All listed IPs in United KingdomRansomware victims in United Kingdom

Newly listed, last 30 days

IPs by the day a feed first listed them. Feeds that publish no dates only count from when we started tracking them.

2026-09-13 – 2026-10-12 (UTC)

What it is

Listed IPs by role.

  1. C265
  2. Malware101
  3. Phishing0
  4. Attacker3,502

By state or region

  1. England3,656
  2. Scotland7
  3. Wales3
  4. Northern Ireland2

By city

  1. London2,871
  2. Leeds448
  3. Slough119
  4. Erith12
  5. Studley10
  6. Manchester7
  7. Worcester6
  8. Uppingham5
  9. Hounslow4
  10. Chelsfield4
  11. Acton4
  12. South Elmsall4
  13. Rushden4
  14. Maidenhead3
  15. Shadwell3

Networks hosting the most

NetworkIPs
AS25369 Hydra Communications Ltd 1,648
AS396982 Google LLC 502
AS211298 Driftnet Ltd 448
AS16276 OVH SAS 327
AS14061 DigitalOcean, LLC 201
AS13335 Cloudflare, Inc. 57
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED 42
AS51167 Contabo GmbH 41
AS212512 Detai Prosperous Technologies Limited 40
AS201738 UFO TECHNOLOGIES LIMITED 27
AS206092 F.N.S. HOLDINGS LIMITED 21
AS2856 British Telecommunications PLC 18
AS213790 Limited Network LTD 18
AS5089 Virgin Media Limited 16
AS215930 CIPHER OPERATIONS DOO BEOGRAD - NOVI BEOGRAD 16

Malware families served from United Kingdom

  1. Evilginx6
  2. DanaBot6
  3. W97m5
  4. AdaptixC25
  5. Remcos5
  6. Zeppelin5
  7. Dacic5
  8. AsyncRAT4
  9. PureRAT4
  10. Zard4
  11. Havoc4
  12. Aisuru3
  13. Mokes3
  14. Emotet3
  15. Amadey3

Most recently reported

IPRoleFamily / threatWhereNetworkReported byLast reported (UTC)
185.108.132[.]216AttackerAttacking hostManchester, EnglandAS204236 Daniel Ionita1 feed2026-10-12 08:20
185.108.135[.]126AttackerAttacking hostBirchwood, EnglandAS204236 Daniel Ionita1 feed2026-10-12 08:20
198.244.242[.]152AttackerAttacking hostLondon, EnglandAS16276 OVH SAS1 feed2026-10-12 08:20
2a01[:]4020[:]1[:]1[:]101[:][:]49AttackerAttacking hostLondon, EnglandAS25369 Hydra Communications Ltd1 feed2026-10-12 08:20
51.195.215[.]82AttackerAttacking hostLondon, EnglandAS16276 OVH SAS1 feed2026-10-12 08:20
138.68.167[.]17AttackerAttacking hostSlough, EnglandAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
138.68.180[.]110AttackerAttacking hostWorcester Park, EnglandAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
139.59.175[.]48AttackerAttacking hostSlough, EnglandAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
139.59.179[.]185AttackerAttacking hostSlough, EnglandAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
142.93.37[.]226AttackerAttacking hostHackney, EnglandAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
165.227.234[.]227AttackerAttacking hostChelsfield, EnglandAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
165.227.238[.]90AttackerAttacking hostSlough, EnglandAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
167.172.50[.]215AttackerAttacking hostSlough, EnglandAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
167.172.50[.]253AttackerAttacking hostSlough, EnglandAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
167.99.192[.]170AttackerAttacking hostWelling, EnglandAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
178.62.50[.]22AttackerAttacking hostSlough, EnglandAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
188.166.174[.]100AttackerAttacking hostWestminster, EnglandAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
46.101.77[.]221AttackerAttacking hostSlough, EnglandAS14061 DigitalOcean, LLC1 feed2026-10-12 08:10
51.145.123[.]29MalwareNeshtaLondon, EnglandAS8075 Microsoft Corporation1 feed · 9,870 sandbox samples2026-10-12 07:53
91.204.209[.]32:21C2Agent TeslaFareham, EnglandAS52148 Enix Ltd1 feed2026-10-12 07:53
198.244.183[.]218AttackerAttacking hostLondon, EnglandAS16276 OVH SAS1 feed2026-10-12 07:50
198.244.242[.]240AttackerAttacking hostLondon, EnglandAS16276 OVH SAS1 feed2026-10-12 07:50
149.154.167[.]99MalwareMokesLondon, EnglandAS62041 Telegram Messenger Inc1 feed · 5,471 sandbox samples2026-10-12 07:26
45.141.233[.]6MalwareGrenamLondon, EnglandAS201814 MEVSPACE sp. z o.o.1 feed · 52 sandbox samples2026-10-12 07:26
198.244.226[.]209AttackerAttacking hostLondon, EnglandAS16276 OVH SAS1 feed2026-10-12 07:15

See every listed IP in United Kingdom →

Ransomware victims in United Kingdom

29 posted in the last 30 days, 109 in 90.

Sectors hit (30 days)

Groups (30 days)

Posted (UTC)VictimGroupSector
2026-10-09 19:27AnyTech365thegentlemenTechnology
2026-10-09 19:27Greenbrook EngineeringthegentlemenManufacturing
2026-10-09 19:12lopayBlack XFinancial Services
2026-10-03 06:25Westrop Primary & Nursery SchoolthegentlemenEducation
2026-10-02 18:03Sports Events365qilinHospitality
2026-10-02 17:38hollypoultry.comsettraAgriculture and Food Production
2026-10-01 12:26parkdental.comchaosHealthcare
2026-10-01 09:04Dynamic Office SolutionsqilinProfessional Services
2026-09-30 03:40DefencebitthegentlemenGovernment & Defense
2026-09-30 03:37Williamson Dacar AssociatesthegentlemenProfessional Services
2026-09-29 15:20maxwell-group.comBrainCipherOther
2026-09-29 05:51Precision Facades LtdN0nManufacturing
2026-09-28 18:53safescaffolding.netthreeamManufacturing
2026-09-28 05:51Dediserve LtdN0nTechnology
2026-09-26 08:44Crystal GlassthegentlemenManufacturing

All ransomware victims in United Kingdom →

Other countries

🇺🇸 United States 17,807🇨🇳 China 10,752🇩🇪 Germany 4,042🇷🇺 Russia 3,582🇳🇱 Netherlands 2,247🇮🇳 India 2,068🇫🇷 France 1,538🇧🇷 Brazil 1,416🇸🇬 Singapore 1,330🇭🇰 Hong Kong 1,319🇰🇷 South Korea 1,306🇮🇩 Indonesia 1,189🇵🇰 Pakistan 880🇨🇦 Canada 867🇧🇪 Belgium 726🇯🇵 Japan 704🇺🇦 Ukraine 671🇵🇱 Poland 560🇿🇦 South Africa 557🇻🇳 Vietnam 546🇲🇾 Malaysia 523🇮🇹 Italy 405🇸🇪 Sweden 378🇵🇭 Philippines 351All countries →