Critical Threat
IP 91.224.92.177 is a high-risk address with a maximum threat score of 10/10 that has generated 608 incident reports, primarily consisting of general hacking activity targeting exposed services, and should be treated as dangerous by any organization discovering it in their logs or network traffic.
Detected by 20 automated honeypot sensors across a three-month window from February 2026 through April 2026, this address originates from the United Kingdom within autonomous system AS209605 operated by UAB Host Baltic. The sheer volume of 608 reports concentrated across a relatively small sensor network indicates sustained, high-frequency malicious activity rather than opportunistic scanning. With a confidence score of 91%, the attribution of this activity to hostile intent is highly reliable. The activity frequency has been assessed at 3 out of 10, suggesting consistent rather than constant engagement, yet the report density remains significant given the limited detection footprint.
The dominant threat category associated with 91.224.92.177 is general hacking activity, which encompasses intrusion attempts, vulnerability exploitation, and unauthorized access attempts against exposed services. A secondary component of IoT-targeted activity rounds out the threat profile, indicating this address may be actively scanning for poorly secured connected devices such as cameras, routers, and smart equipment. The dual threat vector suggests the operator is pursuing both traditional server compromise and opportunistic IoT device capture, potentially building a botnet or establishing persistent footholds across diverse target types.
Site operators should immediately block 91.224.92.177 at the firewall level and monitor logs for any successful connections from this address. Deploying fail2ban or equivalent intrusion prevention tools to automatically ban repeat offenders provides an additional layer of defense against the automated nature of these attacks. Ensuring all exposed services run current patches, enforcing strong and unique credentials, and implementing network segmentation for IoT devices will reduce the attack surface available to this threat actor. Regular review of honeypot telemetry and community abuse feeds helps maintain current blocklists against evolving scanning campaigns.
LT 
BG 
UA