Let's talk
Live Cyber Threat Pulse

Global attack activity

Top origin countries of global attack traffic from Cloudflare Radar, alongside live honeypot observations from the SANS Internet Storm Center. Updated every 30 minutes.

Global threat level (ISC Infocon)

green

Top attack source countries

United States of America: 21.4% of global attack trafficPeople's Republic of China: 10.4% of global attack trafficNetherlands: 6.3% of global attack trafficGermany: 4% of global attack trafficIndonesia: 3.8% of global attack trafficBrazil: 3.1% of global attack trafficFrance: 3% of global attack trafficIndia: 2.4% of global attack trafficSouth Korea: 2.2% of global attack trafficVietnam: 1.9% of global attack trafficJapan: 1.8% of global attack trafficUnited Kingdom: 1.8% of global attack trafficRussian Federation: 1.6% of global attack trafficUnited States of America: 22.9% of global attack trafficNetherlands: 7.7% of global attack trafficPeople's Republic of China: 5.3% of global attack trafficGermany: 4.7% of global attack trafficIndonesia: 4.5% of global attack trafficBrazil: 3.1% of global attack trafficFrance: 3.1% of global attack trafficIndia: 2.5% of global attack trafficJapan: 2% of global attack trafficSouth Korea: 1.9% of global attack trafficUnited Kingdom: 1.9% of global attack trafficRussian Federation: 1.8% of global attack trafficCanada: 1.8% of global attack trafficUnited States of America: 22.1% of global attack trafficNetherlands: 6.6% of global attack trafficGermany: 5.5% of global attack trafficIndonesia: 5% of global attack trafficPeople's Republic of China: 4.5% of global attack trafficIndia: 4.3% of global attack trafficFrance: 3.8% of global attack trafficBrazil: 3.5% of global attack trafficSouth Korea: 2.6% of global attack trafficVietnam: 2% of global attack trafficTürkiye: 1.9% of global attack trafficMexico: 1.6% of global attack trafficJapan: 1.6% of global attack traffic

Top attack source countries

  • USUnited States of America21.4%
  • CNPeople's Republic of China10.4%
  • NLNetherlands6.3%
  • SGSingapore4.7%
  • DEGermany4%
  • IDIndonesia3.8%
  • BRBrazil3.1%
  • FRFrance3%

Most targeted ports

  • 22SSH553,239 reports
  • 23Telnet366,776 reports
  • 443HTTPS250,105 reports
  • 2222SSH (alt)199,225 reports
  • 80HTTP153,267 reports
  • 8080HTTP (alt)62,832 reports
  • 137NetBIOS62,831 reports
  • 8000—58,648 reports

Most active attacking IPs

  • 91.191.209.198first seen 2022-06-13
  • 185.94.111.1first seen 2021-09-11
  • 74.50.61.103first seen 2021-11-19
  • 66.240.205.34first seen 2021-09-11
  • 207.90.244.6first seen 2022-12-10
  • 80.82.77.33first seen 2021-09-12
  • 80.82.77.139first seen 2021-09-12
  • 207.90.244.3first seen 2022-12-08

Top attack source countries

  • USUnited States of America22.9%
  • NLNetherlands7.7%
  • SGSingapore6.2%
  • CNPeople's Republic of China5.3%
  • DEGermany4.7%
  • IDIndonesia4.5%
  • BRBrazil3.1%
  • FRFrance3.1%

Most targeted ports

  • 443HTTPS4,726,183 reports
  • 8080HTTP (alt)1,372,684 reports
  • 80HTTP1,061,366 reports
  • 22SSH1,055,291 reports
  • 8000—1,041,529 reports
  • 23Telnet899,587 reports
  • 2222SSH (alt)315,807 reports
  • 6881—170,368 reports

Most active attacking IPs

  • 212.103.72.193first seen 2021-11-09
  • 212.103.72.201first seen 2021-11-09
  • 89.248.163.200first seen 2022-09-21
  • 91.191.209.198first seen 2022-06-13
  • 185.94.111.1first seen 2021-09-11
  • 74.50.61.103first seen 2021-11-19
  • 66.240.205.34first seen 2021-09-11
  • 207.90.244.6first seen 2022-12-10

Top attack source countries

  • USUnited States of America22.1%
  • NLNetherlands6.6%
  • DEGermany5.5%
  • IDIndonesia5%
  • CNPeople's Republic of China4.5%
  • SGSingapore4.3%
  • INIndia4.3%
  • FRFrance3.8%

Most targeted ports

  • 8080HTTP (alt)2,071,054 reports
  • 8000—1,811,865 reports
  • 22SSH1,798,530 reports
  • 80HTTP1,757,156 reports
  • 443HTTPS1,742,405 reports
  • 23Telnet869,217 reports
  • 2222SSH (alt)634,185 reports
  • 16881—264,692 reports

Most active attacking IPs

  • 212.103.72.193first seen 2021-11-09
  • 212.103.72.201first seen 2021-11-09
  • 89.248.163.200first seen 2022-09-21
  • 91.191.209.198first seen 2022-06-13
  • 185.94.111.1first seen 2021-09-11
  • 74.50.61.103first seen 2021-11-19
  • 66.240.205.34first seen 2021-09-11
  • 207.90.244.6first seen 2022-12-10

Last updated: 28 Oct 2026, 16:42 · isc.sans.edu — Data: SANS Internet Storm Center (DShield) and Cloudflare Radar — refreshed every 30 minutes. Figures reflect each network's observations, not all global traffic.

Publicly reported cyber incidents in Croatia

A selection of major incidents that were publicly reported by Croatian media and the affected organisations.

38

state-sponsored (APT) attacks on Croatian targets in 2024

2,390

cybercrime offences recorded in 2024 (+17.6% year over year)

26.1%

of Croatian companies had at least one security incident (EU average: 21.5%)

Source: tportal.hr (SOA)
2026Data breach

Ministry of Health

A weekend cyberattack hit selected ministry applications; the ministry confirmed the system holding patient medical data was not affected (June 2026).

Source: glas-slavonije.hr
2026Data breach

Hotel booking platform (Phobsa)

Personal data of over 100,000 hotel guests was stolen from a Croatian booking platform and abused for WhatsApp fraud attempts; financial data was reportedly not included (June 2026).

Source: dnevnik.hr
2025Ransomware

Ruđer Bošković Institute

A ransomware attack exploiting the SharePoint 'ToolShell' vulnerabilities hit the institute's mail and administrative network; IRB refused to pay and restored systems from backups (July 2025).

Source: irb.hr
2024Ransomware

Split Airport

A ransomware attack disrupted airport systems; the government confirmed a classic ransomware case, stated there would be no negotiations, and an international group was suspected (July 2024).

Source: vlada.gov.hr
2024DDoS

Ministry of Finance, Tax Administration, HNB, Zagreb Stock Exchange

Pro-Russian group NoName057(16) claimed DDoS attacks that kept the websites of several Croatian financial institutions unavailable for hours (June 2024).

Source: tportal.hr
2024Ransomware

University Hospital Centre Zagreb (KBC Zagreb)

LockBit 3.0 ransomware attack forced the hospital to shut down its IT systems and revert to manual operations; the group claimed to have stolen patient and employee data (June 2024).

Source: tportal.hr
2022Data breach

A1 Croatia

A data breach exposed personal data (name, address, personal ID number, phone) of roughly 10% of customers; the attacker demanded a ransom, and the regulator later fined the operator (February 2022).

Source: telegram.hr
2020Ransomware

INA Group

A Clop ransomware infection took large parts of the oil company's business systems offline; fuel sales continued but invoicing, loyalty cards and vouchers were disrupted (February 2020).

Source: ina.hr

Compiled from publicly available media reports and official statements. The list is illustrative, not exhaustive, and is provided for awareness purposes only.