Malicious IPs in Ukraine
IPv4 networks located in Ukraine that are currently flagged for malicious activity, aggregated from multiple external and internal threat intelligence sources. Snapshot of (UTC), updated daily.
Ukraine at a glance
Ukraine had 155 flagged IPv4 networks in the snapshot of 2026-10-10, rank #24 of 176 countries by absolute count. Relative to its allocated IPv4 space that is 16.9 flagged networks per million addresses, rank #27 of 77, 1.6 times the median of 10.6 across all rated countries. The largest category is brute force sources with 75% of the flagged networks, followed by other malicious networks (14%). The three networks (ASNs) with the most flagged IPs hold 32% of them, led by RadioService-AS Radio Service Ltd. (AS62384).
Malicious activity in Ukraine by category
A network listed in several categories counts once, in the most specific one.
Brute force sources in Ukraine
116 (75%)116 flagged networks, #20 of 159 countries for brute force sources. Sources of password guessing against SSH, mail, FTP and web logins. Brute Force Sources by Country
Other malicious networks in Ukraine
22 (14%)22 flagged networks, #30 of 147 countries for other malicious networks. Addresses and ranges reported as malicious without a more specific category. Other Malicious Networks by Country
Botnet hosts in Ukraine
8 (5%)8 flagged networks, #42 of 126 countries for botnet hosts. Infected hosts taking part in a botnet. Botnet Hosts by Country
C2 servers in Ukraine
3 (2%)3 flagged networks, #25 of 52 countries for C2 servers. Command-and-control servers, payload hosts and other attacker-run infrastructure. C2 Servers by Country
Scanners in Ukraine
3 (2%)3 flagged networks, #22 of 44 countries for scanners. Hosts scanning or probing services on the internet. Scanners by Country
Spam sources in Ukraine
3 (2%)3 flagged networks, #36 of 85 countries for spam sources. Sources of email spam. Spam Sources by Country
Networks with the most flagged IPs in Ukraine
Autonomous systems announcing the flagged networks located in Ukraine.
| # | Network | Flagged networks |
|---|---|---|
| 1 | AS62384RadioService-AS Radio Service Ltd. | 30 |
| 2 | AS56812ASZARKO CHP Zarko Alexandr Ivanovich | 12 |
| 3 | AS3255UARNET-AS LLC EKSINTECH | 7 |
| 4 | AS13188TRIOLAN CONTENT DELIVERY NETWORK LTD | 7 |
| 5 | AS202502Eurolir-AS LLC "ATOM3" | 5 |
| 6 | AS197218ASLANPRO PP Dmutrashko Evgeny Vitalievich | 5 |
| 7 | AS47283ZEUS-UA-AS FOP Koval Dmitro Orestovich | 5 |
| 8 | AS15895KSNET-AS "Kyivstar" PJSC | 4 |
| 9 | AS213954GTS-AS Global Transit Systems LLC | 3 |
| 10 | AS6849UKRTELNET JSC "Ukrtelecom" | 3 |
Compare Ukraine with other countries
Ranked by flagged networks per million allocated IPv4 addresses.
Countries ranked next to Ukraine by rate
| # | Country | Networks | Per million |
|---|---|---|---|
| 25 | Georgia | 23 | 17.6 |
| 26 | Serbia | 40 | 17.3 |
| 27 | Ukraine | 155 | 16.9 |
| 28 | Singapore | 454 | 16.3 |
| 29 | Nigeria | 46 | 14.3 |
| 30 | Bulgaria | 60 | 13.8 |
Other countries in the RIPE NCC region
| # | Country | Networks | Per million |
|---|---|---|---|
| 1 | Iraq | 65 | 142 |
| 2 | Uzbekistan | 41 | 122 |
| 7 | Albania | 30 | 59.3 |
| 10 | Jordan | 22 | 33.9 |
| 13 | Azerbaijan | 23 | 28.8 |
| 15 | Qatar | 23 | 26.9 |
| 16 | Oman | 24 | 25.2 |
| 17 | Moldova | 30 | 23.8 |
Questions about Ukraine
- How many malicious IP addresses are there in Ukraine?
- On 2026-10-10, 155 IPv4 networks (/24 blocks) located in Ukraine were flagged for malicious activity, with 4,204 listed IPv4 addresses. Each /24 counts once, however many of its addresses are listed.
- Which networks in Ukraine host the most flagged IPs?
- RadioService-AS Radio Service Ltd. (AS62384, 30 networks), ASZARKO CHP Zarko Alexandr Ivanovich (AS56812, 12 networks), UARNET-AS LLC EKSINTECH (AS3255, 7 networks). Large hosting providers appear because attackers rent their servers, not necessarily because of the operator.
Query this data per IP via the API
Look up threat categories, reputation score, ASN and geolocation for any address in Ukraine or anywhere else with one API call.