Let's talk
Live Cyber Threat Pulse

Global attack activity

Top origin countries of global attack traffic from Cloudflare Radar, alongside live honeypot observations from the SANS Internet Storm Center. Updated every 30 minutes.

Global threat level (ISC Infocon)

green

Top attack source countries

United States of America: 24.7% of global attack trafficPeople's Republic of China: 5.7% of global attack trafficGermany: 5% of global attack trafficIndonesia: 4.1% of global attack trafficIndia: 3.5% of global attack trafficBrazil: 3.3% of global attack trafficNetherlands: 3.1% of global attack trafficSouth Korea: 2.8% of global attack trafficFrance: 2.8% of global attack trafficVietnam: 2.2% of global attack trafficRussian Federation: 1.9% of global attack trafficUnited Kingdom: 1.9% of global attack trafficAustralia: 1.7% of global attack trafficUnited States of America: 20% of global attack trafficPeople's Republic of China: 7.4% of global attack trafficNetherlands: 6.8% of global attack trafficGermany: 4.1% of global attack trafficIndia: 4.1% of global attack trafficIndonesia: 3.9% of global attack trafficFrance: 3.6% of global attack trafficBrazil: 3% of global attack trafficSouth Korea: 2.8% of global attack trafficVietnam: 2.5% of global attack trafficJapan: 2.2% of global attack trafficRussian Federation: 1.9% of global attack trafficMexico: 1.6% of global attack trafficUnited States of America: 25.3% of global attack trafficIndia: 6.2% of global attack trafficGermany: 4.6% of global attack trafficPeople's Republic of China: 4.4% of global attack trafficNetherlands: 4.1% of global attack trafficIndonesia: 4.1% of global attack trafficBrazil: 3.1% of global attack trafficFrance: 3% of global attack trafficVietnam: 2.3% of global attack trafficTürkiye: 1.9% of global attack trafficUnited Kingdom: 1.8% of global attack trafficSouth Korea: 1.6% of global attack trafficItaly: 1.4% of global attack traffic

Top attack source countries

  • USUnited States of America24.7%
  • CNPeople's Republic of China5.7%
  • SGSingapore5.4%
  • DEGermany5%
  • IDIndonesia4.1%
  • INIndia3.5%
  • BRBrazil3.3%
  • NLNetherlands3.1%

Most targeted ports

  • 80HTTP387,701 reports
  • 443HTTPS360,464 reports
  • 23Telnet193,662 reports
  • 22SSH59,830 reports
  • 2222SSH (alt)22,562 reports
  • 8080HTTP (alt)15,530 reports
  • 51413—7,865 reports
  • 137NetBIOS6,176 reports

Most active attacking IPs

  • 91.191.209.198first seen 2022-06-13
  • 185.94.111.1first seen 2021-09-11
  • 66.240.205.34first seen 2021-09-11
  • 207.90.244.6first seen 2022-12-10
  • 80.82.77.33first seen 2021-09-12
  • 80.82.77.139first seen 2021-09-12
  • 207.90.244.3first seen 2022-12-08
  • 207.90.244.5first seen 2022-12-10

Top attack source countries

  • USUnited States of America20%
  • CNPeople's Republic of China7.4%
  • NLNetherlands6.8%
  • SGSingapore5.4%
  • DEGermany4.1%
  • INIndia4.1%
  • IDIndonesia3.9%
  • FRFrance3.6%

Most targeted ports

  • 8080HTTP (alt)2,789,141 reports
  • 80HTTP2,709,571 reports
  • 8000—2,607,535 reports
  • 443HTTPS1,842,949 reports
  • 22SSH1,797,251 reports
  • 23Telnet971,533 reports
  • 2222SSH (alt)519,970 reports
  • 9000—388,110 reports

Most active attacking IPs

  • 212.103.72.193first seen 2021-11-09
  • 212.103.72.201first seen 2021-11-09
  • 89.248.163.200first seen 2022-09-21
  • 91.191.209.198first seen 2022-06-13
  • 185.94.111.1first seen 2021-09-11
  • 74.50.61.103first seen 2021-11-19
  • 66.240.205.34first seen 2021-09-11
  • 207.90.244.6first seen 2022-12-10

Top attack source countries

  • USUnited States of America25.3%
  • INIndia6.2%
  • SGSingapore5%
  • DEGermany4.6%
  • CNPeople's Republic of China4.4%
  • NLNetherlands4.1%
  • IDIndonesia4.1%
  • BRBrazil3.1%

Most targeted ports

  • 443HTTPS3,452,464 reports
  • 80HTTP2,214,846 reports
  • 22SSH1,573,245 reports
  • 8080HTTP (alt)1,051,765 reports
  • 23Telnet1,043,794 reports
  • 2222SSH (alt)926,096 reports
  • 8000—764,321 reports
  • 5555ADB210,270 reports

Most active attacking IPs

  • 212.103.72.193first seen 2021-11-09
  • 212.103.72.201first seen 2021-11-09
  • 89.248.163.200first seen 2022-09-21
  • 91.191.209.198first seen 2022-06-13
  • 185.94.111.1first seen 2021-09-11
  • 74.50.61.103first seen 2021-11-19
  • 66.240.205.34first seen 2021-09-11
  • 207.90.244.6first seen 2022-12-10

Last updated: 16 Oct 2026, 06:16 · isc.sans.edu — Data: SANS Internet Storm Center (DShield) and Cloudflare Radar — refreshed every 30 minutes. Figures reflect each network's observations, not all global traffic.

Publicly reported cyber incidents in Croatia

A selection of major incidents that were publicly reported by Croatian media and the affected organisations.

38

state-sponsored (APT) attacks on Croatian targets in 2024

2,390

cybercrime offences recorded in 2024 (+17.6% year over year)

26.1%

of Croatian companies had at least one security incident (EU average: 21.5%)

Source: tportal.hr (SOA)
2026Data breach

Ministry of Health

A weekend cyberattack hit selected ministry applications; the ministry confirmed the system holding patient medical data was not affected (June 2026).

Source: glas-slavonije.hr
2026Data breach

Hotel booking platform (Phobsa)

Personal data of over 100,000 hotel guests was stolen from a Croatian booking platform and abused for WhatsApp fraud attempts; financial data was reportedly not included (June 2026).

Source: dnevnik.hr
2025Ransomware

Ruđer Bošković Institute

A ransomware attack exploiting the SharePoint 'ToolShell' vulnerabilities hit the institute's mail and administrative network; IRB refused to pay and restored systems from backups (July 2025).

Source: irb.hr
2024Ransomware

Split Airport

A ransomware attack disrupted airport systems; the government confirmed a classic ransomware case, stated there would be no negotiations, and an international group was suspected (July 2024).

Source: vlada.gov.hr
2024DDoS

Ministry of Finance, Tax Administration, HNB, Zagreb Stock Exchange

Pro-Russian group NoName057(16) claimed DDoS attacks that kept the websites of several Croatian financial institutions unavailable for hours (June 2024).

Source: tportal.hr
2024Ransomware

University Hospital Centre Zagreb (KBC Zagreb)

LockBit 3.0 ransomware attack forced the hospital to shut down its IT systems and revert to manual operations; the group claimed to have stolen patient and employee data (June 2024).

Source: tportal.hr
2022Data breach

A1 Croatia

A data breach exposed personal data (name, address, personal ID number, phone) of roughly 10% of customers; the attacker demanded a ransom, and the regulator later fined the operator (February 2022).

Source: telegram.hr
2020Ransomware

INA Group

A Clop ransomware infection took large parts of the oil company's business systems offline; fuel sales continued but invoicing, loyalty cards and vouchers were disrupted (February 2020).

Source: ina.hr

Compiled from publicly available media reports and official statements. The list is illustrative, not exhaustive, and is provided for awareness purposes only.