Critical Threat
IP 160.119.71.92 is a critical-risk address originating from Seychelles, with a threat level of 10 out of 10 and a 94% confidence score. This IP has generated 1509 total abuse reports from automated honeypot sensors, with an exceptionally high activity frequency rating of 8 out of 10. The dominant threat category detected against this address is general hacking activity, including intrusion attempts and exploitation attempts targeting exposed services.
The volume and consistency of reports paint a clear picture of persistent malicious behavior. Across the three-month window from June 2026 to August 2026, honeypot sensors logged thousands of hostile connection attempts from this single source address. The 20 independent automated honeypot sensors reporting against this IP represent a broad detection footprint, meaning the activity is not isolated to a single network segment or geographic cluster. The IP is allocated to Alsycon B.V. under ASN AS49870, and its Seychelles origin places it within a jurisdiction that has historically hosted bulletproof hosting infrastructure. With an activity frequency of 8 out of 10, this address demonstrates a near-continuous scanning and attacking posture rather than opportunistic or intermittent behavior.
Hacking activity as classified in these reports encompasses a broad spectrum of intrusion tradecraft, including credential guessing, vulnerability scanning, and exploitation attempts against services exposed to the public internet. For organizations running SSH, RDP, web applications, or database services without robust access controls, this type of sustained probing creates a concrete pathway to unauthorized access. The volume of reports indicates this IP is part of an automated campaign likely running through an IP block rather than a manually operated tool, meaning the attack surface is broad and the threat is systematic rather than targeted.
Site operators should immediately block this IP at the network edge or firewall level given its critical threat rating and report volume. Implementing fail2ban, crowdsec, or similar dynamic blocking tools can automate this response and provide ongoing protection. Enforcing strong, non-default credentials and disabling password-based authentication where possible will reduce the effectiveness of any credential-focused attempts. Regular patching of exposed services, particularly SSH and web-facing applications, eliminates low-hanging fruit for exploitation attempts. Monitoring authentication logs for unusual patterns from this source and similar addresses will help identify any successful intrusion attempts early.
NL 
RO 
MX