Critical Threat
IP 78.140.216.223 is a critical-risk address registered to Osinovaya Roshcha Ltd in Russia, carrying a maximum threat level of 10/10 across 510 total abuse reports submitted through automated honeypot sensors during October 2025. The dominant threat classification is "Exploited Host," indicating this IP belongs to a compromised system being weaponized for external attacks without the legitimate owner's knowledge. Recent activity shows concentrated attempts to exploit Redis database services, a pattern consistent with automated vulnerability scanning targeting misconfigured in-memory data stores exposed to the internet.
The detection data reveals 20 separate automated honeypot reports, all categorizing this IP as an exploited host actively engaging in malicious scanning behaviour. All reports span the October 2025 timeframe, with activity frequency scored at 0/10, suggesting the IP may have been taken offline, quarantined by its provider, or is currently dormant between attack campaigns. The 67% confidence score reflects uncertainty about attribution rather than threat severity, as the volume and consistency of reports clearly establish harmful activity originating from this Russian network address within AS200643.
An exploited host represents a particularly insidious threat vector because the IP address belongs to an unwitting victim rather than a deliberate attacker infrastructure. The Redis attack pattern indicates automated exploitation of known Redis vulnerabilities or misconfiguration weaknesses, potentially enabling data exfiltration, remote code execution, or use of the compromised system as a stepping-stone for further attacks against other targets. Any organization running exposed Redis instances without proper authentication hardening or network-level access controls is vulnerable to compromise by traffic originating from this address.
Site operators should immediately block 78.140.216.223 at the network perimeter firewall and implement geo-based restrictions on inbound traffic from Russian address space if business operations do not require such connectivity. Redis instances should never be exposed directly to the internet; enforce bind-address restrictions, implement strong AUTH authentication, and consider deploying fail2ban or similar intrusion-prevention tools to dynamically block repeat offenders. Organizations discovering successful Redis exploitation should assume credential theft and data compromise, rotating all secrets and reviewing access logs for unauthorised commands.
UA 
FR 
GB 
KR