Elevated Risk
IP address 138.226.239.90 is a high-risk address with a threat level of 8/10 and a confidence score of 91%, primarily linked to sustained port scanning activity detected by automated honeypot sensors. The IP has generated over 1000 total abuse reports, indicating persistent hostile reconnaissance behavior from this source.
Analysis of the available data reveals that automated honeypot sensors across 20 detection points confirmed port scanning activity originating from this address during July and August 2026. The address is registered to HomeLine Broadband LLC within ASN AS213474 and geolocates to the United Kingdom, consistent with the network operator data. With a total report volume exceeding 1000 and an activity frequency rated at 8/10, this IP demonstrates a consistent pattern of sustained scanning operations rather than isolated probing events. The high confidence score of 91% indicates strong corroboration across multiple detection sources.
Port scanning represents a critical initial phase in the attack lifecycle, allowing threat actors to identify exposed services, open ports, and potential entry points before launching targeted exploitation attempts. In this specific case, the scanning patterns indicate probes targeting CiscoASA firewall infrastructure. An address conducting systematic reconnaissance against perimeter security devices poses a significant risk to organizations with improperly secured or outdated firewall configurations. The sustained nature of the activity suggests an automated scanning campaign rather than incidental discovery, meaning the operator's infrastructure is being actively catalogued for potential follow-on attacks.
Site operators should immediately block IP address 138.226.239.90 at the network perimeter firewall to terminate ongoing reconnaissance. Implementing fail2ban or similar automated dynamic blocking tools can provide real-time response to scanning patterns. Operators should also audit exposed services, ensure firewall rules strictly limit permissible inbound traffic to essential ports only, and monitor for any related scanning activity from adjacent IP ranges. Regular review of authentication logs for brute-force attempts following this reconnaissance phase is strongly advised.
FI 
BG 
UA