Malicious IPs in Spain

IPv4 networks located in Spain that are currently flagged for malicious activity, aggregated from multiple external and internal threat intelligence sources. Snapshot of (UTC), updated daily.

Flagged IPv4 networks
106
#33 of 179 countries
Per million allocated IPv4
3.29
#70 of 78 countries
Flagged IPv4 addresses
705
ranges count at most as a /24
Allocated IPv4 addresses
32,240,256
RIR delegation statistics

Spain at a glance

Spain had 106 flagged IPv4 networks in the snapshot of 2026-10-09, rank #33 of 179 countries by absolute count. Relative to its allocated IPv4 space that is 3.29 flagged networks per million addresses, rank #70 of 78, well below the median of 10.2 across all rated countries. The largest category is brute force sources with 57% of the flagged networks, followed by other malicious networks (22%). The three networks (ASNs) with the most flagged IPs hold 27% of them, led by Telefonica_de_EspaNa TELEFONICA DE ESPANA S.A.U. (AS3352). Another 2 flagged IPv6 networks are located in Spain.

Malicious activity in Spain by category

A network listed in several categories counts once, in the most specific one. Also flagged: 2 IPv6 networks.

  • Brute force sources in Spain

    60 (57%)

    60 flagged networks, #33 of 162 countries for brute force sources. Sources of password guessing against SSH, mail, FTP and web logins. Brute Force Sources by Country

  • Other malicious networks in Spain

    23 (22%)

    23 flagged networks, #28 of 148 countries for other malicious networks. Addresses and ranges reported as malicious without a more specific category. Other Malicious Networks by Country

  • Botnet hosts in Spain

    16 (15%)

    16 flagged networks, #22 of 129 countries for botnet hosts. Infected hosts taking part in a botnet. Botnet Hosts by Country

  • Spam sources in Spain

    4 (4%)

    4 flagged networks, #32 of 90 countries for spam sources. Sources of email spam. Spam Sources by Country

  • C2 servers in Spain

    2 (2%)

    2 flagged networks, #30 of 52 countries for C2 servers. Command-and-control servers, payload hosts and other attacker-run infrastructure. C2 Servers by Country

  • Scanners in Spain

    1 (1%)

    1 flagged network, #28 of 44 countries for scanners. Hosts scanning or probing services on the internet. Scanners by Country

Networks with the most flagged IPs in Spain

Autonomous systems announcing the flagged networks located in Spain.

#NetworkFlagged networks
1AS3352Telefonica_de_EspaNa TELEFONICA DE ESPANA S.A.U.15
2AS200845AVATEL-AS AVATEL TELECOM, SA8
3AS57269DIGI-ES DIGI SPAIN TELECOM S.A6
4AS12479UNI2-AS Orange Espagne SA6
5AS15704AS15704 XTRA TELECOM S.A.6
6AS41368TVALMANSA-ASN Spotting Brands Technologies S.L.5
7AS212238CDNEXT Datacamp Limited5
8AS9009M247 M247 Europe SRL4
9AS203183FOBOSTELECOM ARNOLD CALLE TELECOM, S.L.3
10AS12430VODAFONE_ES VODAFONE ESPANA S.A.U.3

Compare Spain with other countries

Ranked by flagged networks per million allocated IPv4 addresses.

Countries ranked next to Spain by rate

#CountryNetworksPer million
68France2953.59
69Greece203.49
70Spain1063.29
71Australia1513.12
72Italy1562.88
73Morocco332.69

Other countries in the RIPE NCC region

#CountryNetworksPer million
1Iraq63138
2Uzbekistan44131
7Albania2753.4
10Jordan2538.6
12Armenia2131.0
13Qatar2529.2
15Oman2728.4
17Azerbaijan2126.3

Questions about Spain

How many malicious IP addresses are there in Spain?
On 2026-10-09, 106 IPv4 networks (/24 blocks) located in Spain were flagged for malicious activity, with 705 listed IPv4 addresses and 2 IPv6 networks. Each /24 counts once, however many of its addresses are listed.
Which networks in Spain host the most flagged IPs?
Telefonica_de_EspaNa TELEFONICA DE ESPANA S.A.U. (AS3352, 15 networks), AVATEL-AS AVATEL TELECOM, SA (AS200845, 8 networks), DIGI-ES DIGI SPAIN TELECOM S.A (AS57269, 6 networks). Large hosting providers appear because attackers rent their servers, not necessarily because of the operator.

Query this data per IP via the API

Look up threat categories, reputation score, ASN and geolocation for any address in Spain or anywhere else with one API call.

Read the API docsSee pricing
Back to the world threat mapAll networks registered in Spain