Substantial Risk
IP 207.90.244.10 is a high-risk address linked to sustained, high-volume hacking activity detected across automated honeypot sensors, with more than 20,000 incident reports logged over a ten-month window from September 2025 through June 2026. Originating from Cogent's tier-1 network backbone (AS174) in the United States, this IP presents a significant threat to any exposed service due to its aggressive and persistent intrusion behavior.
The abuse report volume of 20,967 incidents places this address among the most frequently reported sources in threat intelligence feeds, with an activity frequency score of 8 out of 10 indicating near-continuous malicious operations. Detection across 20 separate automated honeypot sensors confirms that the hostile traffic is distributed and opportunistic, targeting multiple points rather than a single victim. The reporting timeframe spanning autumn 2025 into mid-2026 demonstrates persistent engagement over an extended period, suggesting automated exploitation toolkits or botnet-assisted scanning rather than isolated manual intrusion attempts.
The dominant threat classification of Hacking encompasses unauthorized access attempts, vulnerability probing, and exploitation of misconfigured or outdated services. The additional Exploited Host classification raises the possibility that this address may belong to a compromised server or endpoint being weaponized as an attack platform without its operator's knowledge. Observed attack patterns involving repeated connection attempts and malware-related activity are consistent with credential brute-forcing, vulnerability scanning, or propagation vectors commonly associated with botnet infrastructure.
Network defenders should immediately block or rate-limit inbound connections from this source at the firewall or load balancer level. Exposed services, particularly SSH and web interfaces, should be hardened with strong authentication, account lockout policies, and continuous monitoring for scanning signatures. Deploying automated threat-response tools such as fail2ban can proactively ban repeated offenders. Given the Exploited Host classification, it is advisable to notify Cogent's abuse team so the upstream provider can investigate whether the source system itself has been compromised.
CA 
BG 
UA 
MX 
RO 
FR