Malicious IPs in Iran
IPv4 networks located in Iran that are currently flagged for malicious activity, aggregated from multiple external and internal threat intelligence sources. Snapshot of (UTC), updated daily.
Iran at a glance
Iran had 83 flagged IPv4 networks in the snapshot of 2026-10-11, rank #37 of 179 countries by absolute count. Relative to its allocated IPv4 space that is 7.64 flagged networks per million addresses, rank #46 of 76, close to the median of 9.38 across all rated countries. The largest category is brute force sources with 75% of the flagged networks, followed by other malicious networks (12%). The three networks (ASNs) with the most flagged IPs hold 43% of them, led by TCI Iran Telecommunication Company PJS (AS58224). Another 2 flagged IPv6 networks are located in Iran.
Malicious activity in Iran by category
A network listed in several categories counts once, in the most specific one. Also flagged: 2 IPv6 networks.
Brute force sources in Iran
62 (75%)62 flagged networks, #32 of 162 countries for brute force sources. Sources of password guessing against SSH, mail, FTP and web logins. Brute Force Sources by Country
Other malicious networks in Iran
10 (12%)10 flagged networks, #45 of 143 countries for other malicious networks. Addresses and ranges reported as malicious without a more specific category. Other Malicious Networks by Country
Botnet hosts in Iran
5 (6%)5 flagged networks, #51 of 122 countries for botnet hosts. Infected hosts taking part in a botnet. Botnet Hosts by Country
Spam sources in Iran
4 (5%)4 flagged networks, #31 of 89 countries for spam sources. Sources of email spam. Spam Sources by Country
Scanners in Iran
2 (2%)2 flagged networks, #26 of 40 countries for scanners. Hosts scanning or probing services on the internet. Scanners by Country
Networks with the most flagged IPs in Iran
Autonomous systems announcing the flagged networks located in Iran.
| # | Network | Flagged networks |
|---|---|---|
| 1 | AS58224TCI Iran Telecommunication Company PJS | 28 |
| 2 | AS42337RESPINA-AS Respina Networks & Beyond PJSC | 4 |
| 3 | AS49100IR-THR-PTE Pishgaman Toseeh Ertebatat Company (Private Joint Stock) | 4 |
| 4 | AS60631PARVASYSTEM Vandad Vira Hooman LLC | 4 |
| 5 | AS60077AT-CLOUD Asre Dadeha Asiatech | 2 |
| 6 | AS25184AFRANET Afranet | 2 |
| 7 | AS31549RASANA Aria Shatel PJSC | 2 |
| 8 | AS205536TENP Tejarat Electronic Nojhan Pardazesh LLC | 2 |
| 9 | AS44244IranCell-AS Iran Cell Service and Communication Company | 1 |
| 10 | AS44208Farahoosh Farahoosh Dena PLC | 1 |
Compare Iran with other countries
Ranked by flagged networks per million allocated IPv4 addresses.
Countries ranked next to Iran by rate
| # | Country | Networks | Per million |
|---|---|---|---|
| 44 | Poland | 156 | 7.78 |
| 45 | Algeria | 37 | 7.76 |
| 46 | Iran | 83 | 7.64 |
| 47 | Israel | 57 | 7.07 |
| 48 | Romania | 55 | 7.00 |
| 49 | China | 2,213 | 6.45 |
Other countries in the RIPE NCC region
| # | Country | Networks | Per million |
|---|---|---|---|
| 1 | Iraq | 66 | 144 |
| 2 | Uzbekistan | 42 | 125 |
| 7 | Albania | 26 | 51.4 |
| 11 | Jordan | 20 | 30.9 |
| 12 | Azerbaijan | 24 | 30.0 |
| 15 | Qatar | 21 | 24.5 |
| 17 | Moldova | 30 | 23.8 |
| 20 | Belgium | 242 | 19.6 |
Questions about Iran
- How many malicious IP addresses are there in Iran?
- On 2026-10-11, 83 IPv4 networks (/24 blocks) located in Iran were flagged for malicious activity, with 1,108 listed IPv4 addresses and 2 IPv6 networks. Each /24 counts once, however many of its addresses are listed.
- Which networks in Iran host the most flagged IPs?
- TCI Iran Telecommunication Company PJS (AS58224, 28 networks), RESPINA-AS Respina Networks & Beyond PJSC (AS42337, 4 networks), IR-THR-PTE Pishgaman Toseeh Ertebatat Company (Private Joint Stock) (AS49100, 4 networks). Large hosting providers appear because attackers rent their servers, not necessarily because of the operator.
Query this data per IP via the API
Look up threat categories, reputation score, ASN and geolocation for any address in Iran or anywhere else with one API call.