Critical Alert
IP 87.120.191.23 is a critical-risk address associated with 457 documented abuse reports for hacking activity, representing one of the most dangerous IPs recently flagged in automated honeypot detection systems. With a threat level of 10/10 and a 94% confidence score, this address operated by Vpsvault.host Ltd via AS215925 has been actively targeting vulnerable services since November 2025, with the most recent reports filed in December 2025.
The volume and consistency of malicious traffic originating from this IP are significant. All 457 reports were generated by automated honeypot sensors, indicating sustained, automated attack infrastructure rather than opportunistic scanning. While activity frequency is measured at 3/10, the sheer number of independent detections over a two-month period demonstrates persistent probing behavior. The geographic location in the United States and the VPS hosting provider association suggest this is a commercial or state-sponsored operation rather than a compromised end-user device, increasing the likelihood of sophisticated evasion techniques.
Hacking activity encompasses a broad spectrum of intrusion methodologies including vulnerability exploitation, credential attacks, and unauthorized system access attempts. This classification indicates the address has been observed executing concrete exploitation sequences rather than mere reconnaissance, posing direct risk to any exposed service. Organizations running outdated software or misconfigured network services face the highest exposure to compromise through such infrastructure.
Site operators should immediately block this IP at the firewall level and implement automated blocking via tools such as fail2ban to prevent repeated connection attempts. Maintaining strict patching schedules for all internet-facing services eliminates the vulnerabilities most commonly targeted by this threat category. Deploying network-level intrusion detection and establishing real-time abuse report monitoring provides additional layers of defense against ongoing and future targeting from similar infrastructure.
RO 
MX