Medium Threat
IP 213.209.157.221 is a German-based address operated by Moon Dc (ASN AS208485) that presents a moderate-low threat level, classified primarily for email spam activity with a substantial report volume of 1,472 total reports submitted through automated honeypot sensors over October and November 2025. Despite the elevated report count, its current activity frequency is assessed at zero, suggesting the address may be temporarily dormant or operating below detection thresholds at present.
The IP carries a threat level of five out of ten with a confidence score of fifty-five percent, indicating moderate certainty that the observed behavior is intentional rather than misconfigured infrastructure. All 20 of the most recent threat reports specifically cite email spam as the dominant abuse category, and detection was solely attributed to automated honeypot sensors, which are designed to simulate exposed mail services and log incoming connections. The address originates from Germany, a jurisdiction that typically enforces spam and abuse regulations strictly, which may contribute to the reduced ongoing activity despite the historically high report count.
Email spam activity from this address poses a concrete risk to any publicly accessible SMTP service, as mass-distribution campaigns often serve as vectors for phishing, credential harvesting, or malware delivery. Even at low current activity levels, a previously active spam source can resume operations quickly, and its reputation history means mail sent from this IP is likely to be blocked or flagged by major email providers. Organizations running exposed mail servers without proper authentication mechanisms face the greatest exposure, as such servers can be exploited to relay spam or used as jumping-off points for more sophisticated attacks.
Site operators should implement and enforce SPF, DKIM, and DMARC email authentication protocols to prevent unauthorized relay and protect domain reputation. Deploying tools such as fail2ban to dynamically block repeated offenders and configuring rate-limiting on SMTP services can significantly reduce exposure to automated spam campaigns. Regular monitoring of abuse feeds and IP blocklists will help identify if this address resumes activity. Additionally, ensuring mail servers are not configured as open relays closes a common exploitation pathway leveraged by spam originators.
UA 
CH 
GB 
SC