Hoax bomb threats have caused at least 25 flights across Europe to be disrupted, with some forced to make emergency landings, as questions mounted over an apparently coordinated effort to cause chaos for travellers.

The series of warnings on Thursday affected flights between Italy, Ireland, the UK, Spain, Bulgaria, Romania, Poland, Finland, Austria, Denmark, Belgium, Portugal, France, Greece, Serbia and Czechia.

The threats affected flights by Ryanair, Aer Lingus, Wizz Air, Finnair, easyJet, Aegean Airlines, Iberia, Sky Express, Air Serbia and LOT. All landed safely. Searches of the planes found nothing suspicious.

In the UK, Heathrow, London’s principal airport, and Birmingham airport received threats overnight, but it was determined that they were hoaxes with the help of specialist investigators from the Metropolitan police’s aviation police command.

The day of hoaxes followed similar threats on Tuesday, when seven planes across Europe were searched or diverted after malicious alerts. On Monday a flight from the UK to Bulgaria was diverted after a threat that was apparently without substance. In total at least 33 flights have been affected this week.

Investigators said on Thursday there remained no evidence that the hoaxes were being orchestrated by a hostile terror group or state actor, such as Russia or Iran, although inquiries across Europe into the incidents continue.

The global airlines body Iata condemned the disruption and urged authorities to identify the origin of the threats. “Safety is the number one priority for the industry and we take all threats seriously,” said Nick Careen, Iata’s senior vice-president for operations, safety and security, in a statement.

The EU transport commissioner, Apostolos Tzitzikostas, said it was too early to know if the incidents were linked but that any threats against civilians were unacceptable.

Bomb threats emailed to airports in Rome and Sofia were signed “fighters of the Male State”, according to sources at Aeroporti di Roma (ADR), which manages the city’s two airports, and a text seen by Agence France-Presse.

Male State is a Russian far-right, ultranationalist and misogynistic movement founded in 2016 by Vladislav Pozdnyakov. On his Telegram channel Pozdnyakov, a prominent supporter of the war in Ukraine, did not comment on or claim responsibility for the bomb threats.

The emails reportedly read: “We, the fighters of the Male State, will make history with our actions today. Your feminist regime will remember this forever. The explosion will occur in 60 minutes. Today, your skies will turn red.”

A Cork airport spokesperson confirmed to the Guardian that the airport had received an anonymous threat by phone on Thursday morning, causing a flight to be delayed. It was understood to be a Ryanair flight from London Stansted.

A separate Ryanair flight from Pescara in Italy to Brussels-Charleroi was inspected after the word “bomb” was discovered scrawled on the walls of its onboard toilet.

The affected flights had knock-on effects but were a tiny fraction of the 27,400 flights scheduled in Europe on Thursday, according to the European air traffic control agency, Eurocontrol.

The pilot of an Aer Lingus flight from Dublin to Rome that diverted to Évreux was being questioned by French authorities for initially refusing to land at a military base, according to French media reports.

The disruption followed cyber-attacks this week against supermarket refrigeration systems.

A Kremlin spokesperson said on Thursday it was “absurd” to blame Vladimir Putin’s administration for the fridge hacks. “We have ​such baseless accusations against our country, implicating it in everything,” Dmitry Peskov told reporters.

In Rome, the Italian defence minister Guido Crosetto said: “It seems to me that every day now, from refrigerators to blood supplies in France, to these fake alarms, there’s someone who has an interest in stoking tensions.” Asked if he knew who was behind the hoaxes, he said: “It’s called ‘under-threshold warfare’ because it’s below the attribution threshold. It’s done that way on purpose, so no one can pin the blame.”

Many of the affected flights were operated by low-cost carriers but there was little discernible pattern surrounding the incidents.

Aviation experts say fake threats occur daily but that such a number of credible threats, even if malicious hoaxes, appears to point to coordinated action.

Capt Martin Drake, a former airline pilot and technical adviser to the Balpa union, said airlines had security teams who assessed each threat on a traffic-light scale: green to keep going or red to be grounded, with an amber option only for flights yet to take off, allowing tighter checks and searches of the plane before clearing it to fly.

“If you want to deliberately disrupt a flight, then you need to do so once it’s airborne,” said Drake. Pilots have a QRH – a quick response handbook – whose instructions will probably include to descend quickly as well as divert to the nearest airport on receipt of a red alert.

At cruising altitude, “aircraft pressurisation would do a lot of the work of any improvised explosive device”.

While getting a large explosive onboard should be ruled out by multiple layers of security and screening, the effects of any detonation would be multiplied for planes at typical cruising altitude of 35,000ft.

Diversions are expensive as well as highly disruptive, but airlines have little choice in the face of any remotely credible threat.

The ready availability of airline operations information on the internet means that any hoaxer now has a level of detail about the schedules, the type of plane and its technical specifications that would have eluded all but insiders decades ago.

Rhys Jones, an analyst at Osprey Flight Solutions, an aviation intelligence firm, said the confidence of airlines in European airport security should not mean any change to normal protocols after the hoaxes, but “one of the natural responses will be to see double-downed security, media coverage and public concern about travelling”.

He said the threats seemed linked but “a reasonably chaotic campaign with no particular region targeted”, and while they could weaken future security responses through the normalisation of threats, simply creating disruption could be regarded as a success by those carrying out the hoaxes.

Additional reporting by Dan Sabbagh in London, Pjotr Sauer in Amsterdam and Angela Giuffrida in Rome