Substantial Risk
IP 31.70.75.109 is a high-risk address originating from Germany that has been linked to 2,720 reported incidents of VoIP fraud, representing a significant threat to unprotected telephony infrastructure worldwide.
Automated honeypot sensors detected this address conducting malicious activity across a concentrated three-month window between May 2026 and July 2026, with an activity frequency rating of 8 out of 10 indicating persistent and repeated attempts. The 91% confidence score substantiates the reliability of these findings, while all 20 contributing detection sources confirmed identical fraudulent VoIP behaviour. The address routes through AS8560, operated by IONOS SE, a major European hosting and cloud services provider frequently exploited by threat actors to mask their operations behind legitimate infrastructure. The volume of reports — averaging approximately 30 per day during the active period — suggests an automated, high-throughput campaign rather than opportunistic scanning.
VoIP fraud exploits telephony systems to initiate unauthorized calls, typically routing through premium-rate or international numbers to generate illicit revenue for the attacker. For organisations running exposed SIP (Session Initiation Protocol) servers, unauthenticated VoIP endpoints, or poorly monitored call routing infrastructure, an address with this threat profile poses direct financial risk. Attackers leveraging compromised VoIP systems can accumulate substantial charges within minutes, leaving victim organisations liable for fraudulent call costs while the attacker profits. The scale of reporting for this specific IP indicates that its operators have systematically targeted telephony resources across numerous victims.
Site operators should immediately block or rate-limit traffic from this address at the network perimeter and implement call authentication protocols such as SIP over TLS and SRTP to encrypt signalling and media streams. Restricting international and premium-rate dialing destinations, monitoring call detail records for anomalous volume spikes, and deploying defensive tools like fail2ban to automatically ban repeat offenders will significantly reduce exposure. Regular audit of SIP credentials, implementation of strong authentication for all VoIP endpoints, and geolocation-based call routing restrictions provide additional layers of protection against fraudulent activity of this nature.
ES 
GB 
FR 
BG 
UA