Elevated Risk
IP 91.92.243.76 is a high-risk address linked to sustained port-scanning activity, generating over two thousand abuse reports with a threat level of 8/10 and a 91% confidence score that the observed behavior is malicious in nature.
Automated honeypot sensors recorded 2055 reports against this IP across a compressed two-month window spanning May to June 2026, indicating persistent and concentrated reconnaissance activity with an activity frequency rating of 8/10. The reports originated from twenty separate detection points, confirming coordinated scanning behavior rather than isolated probe attempts. The target network is AS202412 operated by Omegatech LTD, and geographic context places the activity within United States infrastructure. The CiscoASA-specific probe pattern detected suggests selective targeting of security appliance configurations rather than generic network-wide scanning, which elevates the credibility of the threat posed to organizations running that particular technology.
Port scanning represents the reconnaissance phase of most targeted cyber attacks, systematically cataloging open services and potential entry points on exposed systems. When focused on CiscoASA devices as observed here, this scanning directly informs subsequent intrusion attempts against potentially unpatched security hardware. The scale of this campaign, evidenced by thousands of coordinated reports across multiple detection sensors, indicates an automated but sustained effort to identify vulnerable installations. An attacker successfully mapping an organization's CiscoASA attack surface through such reconnaissance gains the actionable intelligence needed to launch targeted exploitation attempts against identified weaknesses.
Site operators should immediately audit CiscoASA deployments for current security patches and verify that management interfaces are not exposed to unnecessary external access. Implementing firewall rules or intrusion prevention signatures that detect and block scanning patterns from this address range reduces exposure. Hardening authentication on all administrative interfaces through multi-factor authentication and strong credential policies limits the impact of any subsequent intrusion attempts. Organizations may also consider automated blocking mechanisms such as fail2ban or equivalent tools that dynamically ban IPs exhibiting aggressive scanning behavior. Continuous monitoring of authentication logs for suspicious activity originating from this address range provides additional situational awareness.
BG 
UA