Malicious IPs in Netherlands

IPv4 networks located in Netherlands that are currently flagged for malicious activity, aggregated from multiple external and internal threat intelligence sources. Snapshot of (UTC), updated daily.

Flagged IPv4 networks
446
#9 of 179 countries
Per million allocated IPv4
8.86
#40 of 76 countries
Flagged IPv4 addresses
15,412
ranges count at most as a /24
Allocated IPv4 addresses
50,365,216
RIR delegation statistics

Netherlands at a glance

The Netherlands had 446 flagged IPv4 networks in the snapshot of 2026-10-11, rank #9 of 179 countries by absolute count. Relative to its allocated IPv4 space that is 8.86 flagged networks per million addresses, rank #40 of 76, close to the median of 9.38 across all rated countries. The largest category is brute force sources with 39% of the flagged networks, followed by other malicious networks (21%). The three networks (ASNs) with the most flagged IPs hold 31% of them, led by GOOGLE-CLOUD-PLATFORM - Google LLC (AS396982). Another 11 flagged IPv6 networks are located in the Netherlands.

Malicious activity in Netherlands by category

A network listed in several categories counts once, in the most specific one. Also flagged: 11 IPv6 networks.

  • Brute force sources in Netherlands

    174 (39%)

    174 flagged networks, #12 of 162 countries for brute force sources. Sources of password guessing against SSH, mail, FTP and web logins. Brute Force Sources by Country

  • Other malicious networks in Netherlands

    95 (21%)

    95 flagged networks, #10 of 143 countries for other malicious networks. Addresses and ranges reported as malicious without a more specific category. Other Malicious Networks by Country

  • C2 servers in Netherlands

    67 (15%)

    67 flagged networks, #3 of 51 countries for C2 servers. Command-and-control servers, payload hosts and other attacker-run infrastructure. C2 Servers by Country

  • Scanners in Netherlands

    51 (11%)

    51 flagged networks, #2 of 40 countries for scanners. Hosts scanning or probing services on the internet. Scanners by Country

  • Botnet hosts in Netherlands

    48 (11%)

    48 flagged networks, #10 of 122 countries for botnet hosts. Infected hosts taking part in a botnet. Botnet Hosts by Country

  • Spam sources in Netherlands

    11 (2%)

    11 flagged networks, #12 of 89 countries for spam sources. Sources of email spam. Spam Sources by Country

Networks with the most flagged IPs in Netherlands

Autonomous systems announcing the flagged networks located in Netherlands.

#NetworkFlagged networks
1AS396982GOOGLE-CLOUD-PLATFORM - Google LLC58
2AS33915TNF-AS Vodafone Libertel B.V.43
3AS14061DIGITALOCEAN-ASN - DigitalOcean, LLC39
4AS216071VDSINA SERVERS TECH FZCO22
5AS1136KPN KPN B.V.14
6AS8075MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation11
7AS12876AS12876 Scaleway SAS11
8AS197170TECHTIES-AS TechTies Inc.9
9AS202412OMEGATECH-AS Omegatech LTD8
10AS210558services-1337-gmbh 1337 Services GmbH7

Compare Netherlands with other countries

Ranked by flagged networks per million allocated IPv4 addresses.

Countries ranked next to the Netherlands by rate

#CountryNetworksPer million
38South Korea1,0739.54
39Peru309.23
40Netherlands4468.86
41Lithuania358.47
42Ecuador238.43
43Türkiye1317.78

Other countries in the RIPE NCC region

#CountryNetworksPer million
1Iraq66144
2Uzbekistan42125
7Albania2651.4
11Jordan2030.9
12Azerbaijan2430.0
15Qatar2124.5
17Moldova3023.8
20Belgium24219.6

Questions about Netherlands

How many malicious IP addresses are there in the Netherlands?
On 2026-10-11, 446 IPv4 networks (/24 blocks) located in the Netherlands were flagged for malicious activity, with 15,412 listed IPv4 addresses and 11 IPv6 networks. Each /24 counts once, however many of its addresses are listed.
Which networks in the Netherlands host the most flagged IPs?
GOOGLE-CLOUD-PLATFORM - Google LLC (AS396982, 58 networks), TNF-AS Vodafone Libertel B.V. (AS33915, 43 networks), DIGITALOCEAN-ASN - DigitalOcean, LLC (AS14061, 39 networks). Large hosting providers appear because attackers rent their servers, not necessarily because of the operator.

Query this data per IP via the API

Look up threat categories, reputation score, ASN and geolocation for any address in Netherlands or anywhere else with one API call.

Read the API docsSee pricing
Back to the world threat mapAll networks registered in Netherlands