High Risk
IP 85.217.140.8 is a high-risk address originating from France that has been linked to 929 security reports and presents a significant and persistent threat, with a threat-level score of 8 out of 10 indicating serious malicious activity. The IP, routed through network operator Modat B.V. on ASN AS209334, was first reported in January 2026 and remains active through June 2026, demonstrating sustained engagement in hostile probing over a six-month window. Detection confidence stands at 75 percent, supported by 20 automated honeypot sensor reports that captured the address engaging in unauthorized intrusion activity. Activity frequency scores 8 out of 10, reflecting an aggressive and sustained pattern of operation rather than isolated opportunistic scanning.
The volume of abuse reports and the consistent detection across multiple honeypot sensors establish a clear pattern of malicious intent. Over the six-month reporting period, this single IP generated nearly one thousand incident submissions, placing it in the upper echelon of reported threat sources. The geographic origin in France and the professional network operator affiliation do not mitigate the apparent hostile activity; threat actors routinely operate from infrastructure that appears legitimate. The sustained nature of the reports, spanning half a year, indicates a deliberate and persistent campaign rather than transient compromise of an end-user machine.
The dominant threat category recorded against 85.217.140.8 is general hacking activity, specifically including indicators of unauthorized SSH sessions on unusual ports detected by network intrusion sensors. This pattern suggests the address is engaged in probing for exposed Secure Shell services running on non-standard port configurations, a common reconnaissance technique used to identify poorly secured remote-access infrastructure. Such activity serves as a precursor to credential brute-forcing, vulnerability exploitation or the establishment of covert persistence channels. Organizations with exposed SSH services face elevated risk from this class of automated intrusion tooling, particularly if default configurations or weak authentication mechanisms remain in place.
CA 
UA 
GB 
KR