Elevated Risk
IP 87.106.98.147 is a high-risk German address associated with 455 abuse reports and a threat level of 8/10, representing a credible and active source of VoIP fraud and hacking activity detected through automated honeypot sensors. The volume of reports combined with a 92% confidence score indicates this is not an isolated incident but sustained malicious behavior originating from infrastructure operated by IONOS SE (AS8560).
The data shows 455 total reports filed against this single IP, with recent activity concentrated in May 2026 across both threat categories. Fraud VoIP dominates the reports with 17 confirmed instances, while hacking-related activity accounts for 7 additional reports. Detection came from 20 separate automated honeypot sensors, indicating broad geographic or logical distribution of the monitoring infrastructure that caught this activity. The accompanying Suricata alerts specifically flag "SURICATA STREAM spurious retransmission" patterns, which suggest the threat actor is attempting to manipulate TCP stream state to evade detection or exploit vulnerable session handling in target systems.
VoIP fraud represents the primary threat category, exploiting telephone infrastructure to initiate unauthorized calls—typically to premium-rate numbers for direct financial gain. The secondary hacking activity signals broader intrusion capability, with stream manipulation techniques commonly used as a precursor to session hijacking, reconnaissance, or exploiting unpatched services. An IP with this reputation targeting VoIP infrastructure poses direct financial risk through toll fraud and indirect risk through potential access to broader network resources if initial compromise succeeds.
Site operators should immediately block or rate-limit traffic from this address at the network perimeter, implement strict call authentication protocols such as STIR/SHAKEN for VoIP services, and monitor outbound call patterns for anomalies indicating active exploitation. Keeping systems patched and deploying fail2ban or similar intrusion prevention tools will reduce the effectiveness of any accompanying hacking attempts. Regular review of SIP invite patterns and enforcing strong authentication on all VoIP endpoints provides additional defense against the observed fraud activity.
ES 
GB 
FR 
GE