Critical Threat
IP 78.153.140.39 is a critical-risk address operated by Hostglobal.plus Ltd (AS202306) in the United Kingdom, associated with 790 high-confidence abuse reports dominated by web application attack probes detected across an eight-month surveillance window from September 2025 through May 2026.
The IP accumulated 790 reports from 20 automated honeypot sensors with an activity frequency rated 8 out of 10, indicating sustained, repeated offensive operations rather than isolated scanning. The first recorded encounter occurred in September 2025, with activity persisting continuously until May 2026, demonstrating persistent interest in exploiting web-facing infrastructure. The 78% confidence score and perfect 10/10 threat-level classification align with the concentration of Web App Attack reports in recent submissions, suggesting this address is actively probing for application-layer vulnerabilities rather than conducting broad network reconnaissance. The geographic location in Great Britain does not indicate a reduced threat profile; threat actors routinely deploy infrastructure across diverse jurisdictions.
Web application attacks represent a mature and dangerous threat category encompassing exploitation of OWASP Top 10 vulnerabilities including cross-site scripting, cross-site request forgery, local and remote file inclusion, SQL injection, and authentication bypass. Unlike network-layer noise, these probes specifically craft requests designed to identify vulnerable web application parameters, expose sensitive data, or establish initial footholds for deeper compromise. A successful attack against an unpatched or misconfigured web application can result in data exfiltration, site defacement, malware distribution infrastructure, or lateral movement into internal systems.
Site operators should immediately block or rate-limit traffic from this address at the firewall or load-balancer level, deploy a web application firewall with rules tuned to OWASP threats, ensure all web applications and server-side components are patched and hardened against known vulnerabilities, and audit application logs for any matching probe patterns to identify potentially successful reconnaissance. Implementing proactive blocking based on threat-intelligence feeds containing this IP will reduce exposure to ongoing scanning campaigns.
CA 
CH 
UA