Substantial Risk
IP 185.218.138.13 is a high-risk address associated with 1,688 abuse reports and classified at threat level 8/10, with automated honeypot sensors identifying it primarily through port-scanning reconnaissance activity against network infrastructure.
Analysis of the available telemetry reveals consistent hostile behavior detected over a four-month window spanning March 2026 through June 2026, with all 1,688 reports attributed to automated honeypot sensors. The network originates from AS205997, an autonomous system operated by Vlad Cojuhari, geographically situated in the United States. The activity frequency score of 8/10 combined with a 91% confidence rating indicates a mature, persistent threat actor. The dominant threat category driving these reports is Port Scan, specifically CiscoASA port scanning and probing activity, which accounted for 20 recent report instances.
Port scanning represents a critical early stage in the attack lifecycle, enabling adversaries to map exposed services, identify running applications, and catalog potential entry points before launching targeted exploitation. The specific focus on CiscoASA scanning suggests the operator is systematically cataloguing perimeter firewall appliances, which often require careful configuration to avoid exposing management interfaces or vulnerable services to unauthorized access. While a port scan itself does not constitute a direct compromise, it dramatically narrows the attack surface that defenders must protect and provides actionable intelligence to subsequent stages of an intrusion attempt.
Site operators should implement strict ingress filtering on edge firewalls to limit exposure of management interfaces and unused ports, reducing the utility of any reconnaissance findings. Deploying tools such as fail2ban or equivalent intrusion-prevention systems can automatically detect and block repeated scanning patterns from persistent sources. Regular audit of publicly accessible CiscoASA configurations, including removal of unnecessary services and enforcement of strong administrative access controls, significantly reduces successful exploitation risk following such reconnaissance activity.
KZ 
BG 
UA