Critical Threat
IP 103.91.140.28 is a high-risk address originating from the Philippines, assigned to the network of Dasca Cable Services, Inc. (AS136515), with a threat level of 10 out of 10 and an accumulated 23,540 abuse reports tied exclusively to hacking activity detected by automated honeypot sensors.
The volume of reports associated with this IP is substantial, with all 20 most recent threat categorisations filed under the hacking classification. The IP was first reported in August 2025 and most recently in September 2025, indicating an active threat window spanning at least two months. All report sources are attributed to automated honeypot sensors, which detected repeated intrusion attempts, vulnerability probes and unauthorised access patterns. The 59% confidence score reflects some uncertainty in attributing the full scope of activity, yet the sheer report count combined with the maximum threat rating makes this address particularly noteworthy for any organisation exposing network services to the internet.
The dominant threat category of hacking encompasses a broad spectrum of intrusion activity, including the exploitation of unpatched vulnerabilities, credential-based attacks and scanning for exposed services. This IP represents an active source of automated hostile probing that could compromise poorly configured or outdated systems on any network it targets. The real-world risk is that compromised or poorly secured devices may be harvested as part of broader scanning campaigns, potentially leading to data breaches, lateral movement or deployment of further malicious infrastructure. Even organisations with basic hardening in place should treat this IP as a credible, persistent threat source warranting immediate blocking.
Defensive measures should include implementing strict ingress filtering or null-routing for this source address at the network edge. Deploying automated abuse-management tools such as fail2ban can dynamically block repeated login attempts and scanning behaviour. Enforcing strong authentication, including multi-factor authentication, across all externally accessible services dramatically reduces the effectiveness of credential-guessing campaigns. Finally, maintaining a strict patch cadence and minimising exposed attack surface through firewall rules and service restriction will limit the viability of any exploitation attempts originating from this or similar threat actors.
RO 
UA 
VN