Malicious IPs in Norway
IPv4 networks located in Norway that are currently flagged for malicious activity, aggregated from multiple external and internal threat intelligence sources. Snapshot of (UTC), updated daily.
Norway at a glance
Norway had 24 flagged IPv4 networks in the snapshot of 2026-10-10, rank #71 of 176 countries by absolute count. Relative to its allocated IPv4 space that is 1.54 flagged networks per million addresses, rank #76 of 77, well below the median of 10.6 across all rated countries. The largest category is brute force sources with 38% of the flagged networks, followed by botnet hosts (25%). The three networks (ASNs) with the most flagged IPs hold 42% of them, led by M247 M247 Europe SRL (AS9009).
Malicious activity in Norway by category
A network listed in several categories counts once, in the most specific one.
Brute force sources in Norway
9 (38%)9 flagged networks, #78 of 159 countries for brute force sources. Sources of password guessing against SSH, mail, FTP and web logins. Brute Force Sources by Country
Botnet hosts in Norway
6 (25%)6 flagged networks, #48 of 126 countries for botnet hosts. Infected hosts taking part in a botnet. Botnet Hosts by Country
Other malicious networks in Norway
6 (25%)6 flagged networks, #72 of 147 countries for other malicious networks. Addresses and ranges reported as malicious without a more specific category. Other Malicious Networks by Country
Spam sources in Norway
2 (8%)2 flagged networks, #43 of 85 countries for spam sources. Sources of email spam. Spam Sources by Country
C2 servers in Norway
1 (4%)1 flagged network, #35 of 52 countries for C2 servers. Command-and-control servers, payload hosts and other attacker-run infrastructure. C2 Servers by Country
Networks with the most flagged IPs in Norway
Autonomous systems announcing the flagged networks located in Norway.
| # | Network | Flagged networks |
|---|---|---|
| 1 | AS9009M247 M247 Europe SRL | 4 |
| 2 | AS25400TELIA-NORWAY-AS Telia Norge AS | 3 |
| 3 | AS29695Altibox_AS Lyse Tele AS | 3 |
| 4 | AS56655GIGAHOST Gigahost AS | 3 |
| 5 | AS2116GlobalConnect-AS2116 GLOBALCONNECT AS | 2 |
| 6 | AS2119TELENOR-NEXTEL Telenor Norge AS | 2 |
| 7 | AS8075MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation | 2 |
| 8 | AS50304BLIX Blix Solutions AS | 1 |
| 9 | AS211443SINOWORLDWIDE SINO WORLDWIDE TRADING LIMITED | 1 |
| 10 | AS42708GLESYS Glesys AB | 1 |
Compare Norway with other countries
Ranked by flagged networks per million allocated IPv4 addresses.
Countries ranked next to Norway by rate
| # | Country | Networks | Per million |
|---|---|---|---|
| 72 | United Kingdom | 337 | 2.38 |
| 73 | Switzerland | 52 | 2.23 |
| 74 | United States | 2,981 | 1.84 |
| 75 | Austria | 20 | 1.79 |
| 76 | Norway | 24 | 1.54 |
| 77 | Japan | 278 | 1.47 |
Other countries in the RIPE NCC region
| # | Country | Networks | Per million |
|---|---|---|---|
| 1 | Iraq | 65 | 142 |
| 2 | Uzbekistan | 41 | 122 |
| 7 | Albania | 30 | 59.3 |
| 10 | Jordan | 22 | 33.9 |
| 13 | Azerbaijan | 23 | 28.8 |
| 15 | Qatar | 23 | 26.9 |
| 16 | Oman | 24 | 25.2 |
| 17 | Moldova | 30 | 23.8 |
Questions about Norway
- How many malicious IP addresses are there in Norway?
- On 2026-10-10, 24 IPv4 networks (/24 blocks) located in Norway were flagged for malicious activity, with 538 listed IPv4 addresses. Each /24 counts once, however many of its addresses are listed.
- Which networks in Norway host the most flagged IPs?
- M247 M247 Europe SRL (AS9009, 4 networks), TELIA-NORWAY-AS Telia Norge AS (AS25400, 3 networks), Altibox_AS Lyse Tele AS (AS29695, 3 networks). Large hosting providers appear because attackers rent their servers, not necessarily because of the operator.
Query this data per IP via the API
Look up threat categories, reputation score, ASN and geolocation for any address in Norway or anywhere else with one API call.