Elevated Risk
IP 185.156.73.167 is a high-risk address originating from Ukraine, associated with 2,534 reported incidents and assigned to network operator FOP Dmytro Nedilskyi (ASN AS211736). With a threat level of 8/10 and a confidence score of 78%, this IP has been flagged by twenty automated honeypot sensors for sustained malicious activity, primarily port scanning and hacking attempts. Despite a notably low current activity frequency score of 0/10, the volume and consistency of historical reports underscore its persistent threat profile.
The detection data reveals that IP 185.156.73.167 was first reported in August 2025 and most recently in April 2026, indicating an active operational window spanning multiple months. Community reports and honeypot telemetry document 16 instances classified as port scanning activity and 4 instances of broader hacking activity. Observed attack patterns include generic connection attempts and CiscoASA-focused probes, suggesting targeted reconnaissance against firewall and security appliances. The high report count relative to the timeframe points to repeated, automated scanning campaigns rather than isolated opportunistic probes.
Port scanning represents the initial phase of targeted intrusions, enabling threat actors to map exposed services, identify unpatched vulnerabilities, and plan subsequent exploitation steps. The presence of CiscoASA-specific probes indicates interest in perimeter security devices, which if compromised could grant extensive network access. The associated hacking activity suggests that more aggressive intrusion attempts have followed the reconnaissance phase. Even a low current activity frequency does not diminish risk, as dormant infrastructure frequently reactivates or signals an established persistent presence that has already achieved its objectives.
Site operators should immediately block IP 185.156.73.167 at the firewall level and implement deny-by-default security group rules to eliminate any residual access vectors. Configuring automated blocking via tools such as fail2ban or equivalent dynamic firewall rules can further reduce exposure to similar scanning activity. Exposed services should be minimised, with particular attention to management interfaces and security appliances that may be targets of CiscoASA-specific probes. Continuous traffic monitoring and intrusion detection logging will support rapid identification of any reactivation attempts originating from this or adjacent infrastructure.
RO 
BG 
CA 
KZ