Severe Risk
IP 134.122.188.6 is a critical-risk address with 946 total abuse reports linked primarily to web application attack probes targeting vulnerable online services. Registered to CTG Server Limited in Singapore (AS152194), this IP has accumulated a substantial threat history despite a current activity frequency rated at zero out of ten, suggesting the host may be intermittently active or recently dormant while remaining flagged across multiple automated honeypot sensors.
The volume of reports—946 in total—originates exclusively from automated honeypot detection systems, with the most recent threat breakdown showing Web App Attack as the dominant category. The IP was first and last reported during August 2025, indicating concentrated malicious activity within a narrow timeframe. The 59% confidence score reflects moderate certainty in attribution, accounting for variables such as potential NAT traversal or compromised infrastructure sharing the address. The network operator, CTG Server Limited, manages the associated ASN in Singapore, a jurisdiction often associated with both legitimate cloud infrastructure and transient malicious hosting due to the region's robust data-center ecosystem.
Web application attacks encompass exploitation attempts against OWASP Top 10 vulnerabilities including cross-site scripting, SQL injection, local/remote file inclusion, and CSRF vectors. For an exposed web service, a sustained campaign from this address poses real risk of initial access compromise, data exfiltration, or server takeover depending on unpatched software. Even with current activity at zero, the historical report density signals an actor with persistent scanning behaviour, and resumed activity could occur without warning.
Site operators should immediately block or challenge traffic from this address at the firewall or load-balancer level and implement geolocation-based restrictions if Singaporean traffic is not expected. Deploying a Web Application Firewall with rule sets tuned to OWASP threats will detect and neutralise probing patterns. Enforce strong authentication, limit exposed endpoints, and ensure all web software is patched current. Monitoring logs for requests matching probe signatures and automating blocklist updates using tools like fail2ban or equivalent intrusion-prevention systems provides layered defence against repeat encounters.
HK 
JP 
RO 
PH 
UA 
VN