Malicious IPs in Saudi Arabia
IPv4 networks located in Saudi Arabia that are currently flagged for malicious activity, aggregated from multiple external and internal threat intelligence sources. Snapshot of (UTC), updated daily.
Saudi Arabia at a glance
Saudi Arabia had 53 flagged IPv4 networks in the snapshot of 2026-10-10, rank #45 of 176 countries by absolute count. Relative to its allocated IPv4 space that is 4.71 flagged networks per million addresses, rank #60 of 77, well below the median of 10.6 across all rated countries. The largest category is brute force sources with 45% of the flagged networks, followed by other malicious networks (30%). The three networks (ASNs) with the most flagged IPs hold 68% of them, led by Mobily-AS Etihad Etisalat, a joint stock company (AS35819). Another 7 flagged IPv6 networks are located in Saudi Arabia.
Malicious activity in Saudi Arabia by category
A network listed in several categories counts once, in the most specific one. Also flagged: 7 IPv6 networks.
Brute force sources in Saudi Arabia
24 (45%)24 flagged networks, #49 of 159 countries for brute force sources. Sources of password guessing against SSH, mail, FTP and web logins. Brute Force Sources by Country
Other malicious networks in Saudi Arabia
16 (30%)16 flagged networks, #37 of 147 countries for other malicious networks. Addresses and ranges reported as malicious without a more specific category. Other Malicious Networks by Country
Botnet hosts in Saudi Arabia
12 (23%)12 flagged networks, #29 of 126 countries for botnet hosts. Infected hosts taking part in a botnet. Botnet Hosts by Country
Scanners in Saudi Arabia
1 (2%)1 flagged network, #26 of 44 countries for scanners. Hosts scanning or probing services on the internet. Scanners by Country
Networks with the most flagged IPs in Saudi Arabia
Autonomous systems announcing the flagged networks located in Saudi Arabia.
| # | Network | Flagged networks |
|---|---|---|
| 1 | AS35819Mobily-AS Etihad Etisalat, a joint stock company | 15 |
| 2 | AS25019SAUDINETSTC-AS Saudi Telecom Company JSC | 15 |
| 3 | AS31898ORACLE-BMC-31898 - Oracle Corporation | 6 |
| 4 | AS39891ALJAWWALSTC-AS Saudi Telecom Company JSC | 5 |
| 5 | AS35753ITC Etihad Salam Telecom CJSC | 3 |
| 6 | AS43766MTC-KSA-AS Mobile Telecommunication Company Saudi Arabia Joint-Stock company | 3 |
| 7 | AS45102ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd. | 2 |
| 8 | AS8895ISU King Abdul Aziz City for Science and Technology | 1 |
| 9 | AS9009M247 M247 Europe SRL | 1 |
| 10 | AS154177LIGHT4-AS-AP - LIGHT NODE LIMITED | 1 |
Compare Saudi Arabia with other countries
Ranked by flagged networks per million allocated IPv4 addresses.
Countries ranked next to Saudi Arabia by rate
| # | Country | Networks | Per million |
|---|---|---|---|
| 58 | Sweden | 156 | 4.94 |
| 59 | South Africa | 131 | 4.82 |
| 60 | Saudi Arabia | 53 | 4.71 |
| 61 | Portugal | 28 | 4.18 |
| 62 | Mexico | 115 | 3.96 |
| 63 | Czechia | 38 | 3.96 |
Other countries in the RIPE NCC region
| # | Country | Networks | Per million |
|---|---|---|---|
| 1 | Iraq | 65 | 142 |
| 2 | Uzbekistan | 41 | 122 |
| 7 | Albania | 30 | 59.3 |
| 10 | Jordan | 22 | 33.9 |
| 13 | Azerbaijan | 23 | 28.8 |
| 15 | Qatar | 23 | 26.9 |
| 16 | Oman | 24 | 25.2 |
| 17 | Moldova | 30 | 23.8 |
Questions about Saudi Arabia
- How many malicious IP addresses are there in Saudi Arabia?
- On 2026-10-10, 53 IPv4 networks (/24 blocks) located in Saudi Arabia were flagged for malicious activity, with 308 listed IPv4 addresses and 7 IPv6 networks. Each /24 counts once, however many of its addresses are listed.
- Which networks in Saudi Arabia host the most flagged IPs?
- Mobily-AS Etihad Etisalat, a joint stock company (AS35819, 15 networks), SAUDINETSTC-AS Saudi Telecom Company JSC (AS25019, 15 networks), ORACLE-BMC-31898 - Oracle Corporation (AS31898, 6 networks). Large hosting providers appear because attackers rent their servers, not necessarily because of the operator.
Query this data per IP via the API
Look up threat categories, reputation score, ASN and geolocation for any address in Saudi Arabia or anywhere else with one API call.