Malicious IPs in Russia

IPv4 networks located in Russia that are currently flagged for malicious activity, aggregated from multiple external and internal threat intelligence sources. Snapshot of (UTC), updated daily.

Flagged IPv4 networks
502
#7 of 176 countries
Per million allocated IPv4
11.1
#36 of 77 countries
Flagged IPv4 addresses
12,791
ranges count at most as a /24
Allocated IPv4 addresses
45,344,832
RIR delegation statistics

Russia at a glance

Russia had 502 flagged IPv4 networks in the snapshot of 2026-10-10, rank #7 of 176 countries by absolute count. Relative to its allocated IPv4 space that is 11.1 flagged networks per million addresses, rank #36 of 77, close to the median of 10.6 across all rated countries. The largest category is brute force sources with 59% of the flagged networks, followed by other malicious networks (16%). The three networks (ASNs) with the most flagged IPs hold 21% of them, led by ROSTELECOM-AS PJSC Rostelecom (AS12389). Another 1 flagged IPv6 network is located in Russia.

Malicious activity in Russia by category

A network listed in several categories counts once, in the most specific one. Also flagged: 1 IPv6 network.

  • Brute force sources in Russia

    296 (59%)

    296 flagged networks, #7 of 159 countries for brute force sources. Sources of password guessing against SSH, mail, FTP and web logins. Brute Force Sources by Country

  • Other malicious networks in Russia

    79 (16%)

    79 flagged networks, #14 of 147 countries for other malicious networks. Addresses and ranges reported as malicious without a more specific category. Other Malicious Networks by Country

  • Spam sources in Russia

    64 (13%)

    64 flagged networks, #5 of 85 countries for spam sources. Sources of email spam. Spam Sources by Country

  • Botnet hosts in Russia

    50 (10%)

    50 flagged networks, #12 of 126 countries for botnet hosts. Infected hosts taking part in a botnet. Botnet Hosts by Country

  • C2 servers in Russia

    12 (2%)

    12 flagged networks, #11 of 52 countries for C2 servers. Command-and-control servers, payload hosts and other attacker-run infrastructure. C2 Servers by Country

  • Scanners in Russia

    1 (0%)

    1 flagged network, #26 of 44 countries for scanners. Hosts scanning or probing services on the internet. Scanners by Country

Networks with the most flagged IPs in Russia

Autonomous systems announcing the flagged networks located in Russia.

#NetworkFlagged networks
1AS12389ROSTELECOM-AS PJSC Rostelecom60
2AS25159SONICDUO-AS PJSC MegaFon24
3AS48282VDSINA-AS Hosting technology LTD19
4AS3216SOVAM-AS PJSC "Vimpelcom"18
5AS42610NCNET-AS PJSC Rostelecom13
6AS12714MEGAFON-AS PJSC MegaFon12
7AS28890INSYS-AS INSYS LLC12
8AS8359MTS MTS PJSC11
9AS25513ASN-MGTS-USPD PJSC Moscow city telephone network11
10AS57026CHEB-AS JSC "ER-Telecom Holding"9

Compare Russia with other countries

Ranked by flagged networks per million allocated IPv4 addresses.

Countries ranked next to Russia by rate

#CountryNetworksPer million
34Brazil93311.4
35Peru3611.1
36Russia50211.1
37Argentina21311.0
38Ireland11110.8
39Kazakhstan3610.6

Other countries in the RIPE NCC region

#CountryNetworksPer million
1Iraq65142
2Uzbekistan41122
7Albania3059.3
10Jordan2233.9
13Azerbaijan2328.8
15Qatar2326.9
16Oman2425.2
17Moldova3023.8

Questions about Russia

How many malicious IP addresses are there in Russia?
On 2026-10-10, 502 IPv4 networks (/24 blocks) located in Russia were flagged for malicious activity, with 12,791 listed IPv4 addresses and 1 IPv6 network. Each /24 counts once, however many of its addresses are listed.
Which networks in Russia host the most flagged IPs?
ROSTELECOM-AS PJSC Rostelecom (AS12389, 60 networks), SONICDUO-AS PJSC MegaFon (AS25159, 24 networks), VDSINA-AS Hosting technology LTD (AS48282, 19 networks). Large hosting providers appear because attackers rent their servers, not necessarily because of the operator.

Query this data per IP via the API

Look up threat categories, reputation score, ASN and geolocation for any address in Russia or anywhere else with one API call.

Read the API docsSee pricing
Back to the world threat mapAll networks registered in Russia