Significant Threat
IP 77.83.39.156, registered in Ukraine and operated by Kprohost LLC, is a high-risk address with a threat level of 7/10, associated with 718 total abuse reports predominantly documenting email spam and hacking activity. The IP was first flagged in January 2026 and most recently in March 2026, with detection sourced from 20 automated honeypot sensors across the community. Despite the significant report volume, the activity frequency score of 0/10 suggests these incidents are dispersed rather than continuous, indicating opportunistic or scheduled scanning behavior rather than sustained automated attacks.
Analysis of the reported threat categories reveals Email Spam as the dominant activity with 20 recent reports, followed by Hacking with 17 reports. Network-based detection via Suricata sensors flagged SMTP abuse patterns, specifically malformed packets with broken acknowledgements commonly associated with spam relay attempts and bulk email distribution. The combination of honeypot detections and the specific protocol violations observed indicates this IP is actively engaged in unsolicited email operations, potentially for advertising, phishing campaigns, or malware distribution. The low activity frequency relative to total reports suggests this host may rotate through targets or operate intermittently to evade detection thresholds.
SMTP spam represents a concrete operational risk for exposed mail servers, as compromised or abused mail relays can damage an organization's sender reputation, trigger blocklisting, and serve as a vector for phishing or malicious payload delivery. The hacking activity reported alongside the spam suggests this IP may also be probing for vulnerable mail transfer agents or attempting to exploit configuration weaknesses in exposed SMTP services.
Site operators should implement immediate blocking or rate-limiting for inbound connections from this address, particularly on TCP port 25. Deploying or strengthening fail2ban rules tailored to SMTP abuse patterns and malformed packet signatures can automate this response. Implementing strict SPF, DKIM, and DMARC email authentication protocols will reduce the impact of any spam originating through or relayed via this IP. Continuous monitoring of mail logs for connections from this address and regular review of honeypot telemetry will help assess whether the threat posture changes over time.
MC 
GB 
SE