High Risk
IP address 85.217.140.4 is a high-risk address based in France with a threat level of 8 out of 10, linked primarily to active hacking activity including unauthorized access attempts and exploitation of vulnerable services. This IP has accumulated 513 total abuse reports with an activity frequency rated at 8 out of 10, indicating persistent and aggressive behavior over its observed operational window between January and June 2026.
Detection data shows 513 reports attributed to this single address, with the dominant threat category being general hacking activity as reported by 20 distinct automated honeypot sensors deployed across the threat intelligence network. The network is operated by Modat B.V. under ASN AS209334, and the observed attack patterns include SSH sessions initiated on non-standard ports, a technique frequently employed by threat actors to evade detection by conventional security monitoring tools that focus only on default service ports.
Hacking activity encompasses a broad range of intrusion techniques including vulnerability exploitation, brute-force attempts, and unauthorized access probing. The detection of SSH sessions on unusual ports specifically suggests this actor is attempting to establish persistent footholds while avoiding signature-based detection systems that expect standard port 22 traffic. With a confidence score of 78 percent, there is strong evidentiary support for this IP posing a genuine risk to any exposed services, particularly those with SSH, Telnet, or other remote-access protocols accessible from the internet.
Organizations should implement immediate defensive measures including blocking this IP address at the network perimeter firewall, deploying or strengthening fail2ban or equivalent rate-limiting solutions to throttle repeated connection attempts, and ensuring all internet-facing services run on non-standard ports where feasible alongside strong authentication requirements. Regular review of authentication logs for the source IP range and implementation of intrusion detection signatures for anomalous SSH behavior on unusual ports will further reduce exposure to this threat actor.
CA 
TR 
GB 
UA 
MK 
RO