Severe Risk
IP address 122.3.88.147, registered to the Philippine Long Distance Telephone Company network (AS9299) in the Philippines, presents a critical threat with a maximum threat level of 10 out of 10. Automated honeypot sensors have filed 203 total abuse reports against this address, with the most recent confirmed activity showing it operating as an exploited host actively conducting malware and exploit activity against internet-facing infrastructure. This IP exhibits an activity frequency rating of 8 out of 10, indicating sustained and aggressive malicious behavior over a concentrated reporting window in February 2026.
The confidence score of 57 percent reflects that while the hostile activity is well-documented through six independent automated honeypot detections, attribution to the precise underlying compromise vector remains partially uncertain. The volume of reports, combined with the dominant exploited host classification, strongly suggests this address belongs to a compromised end-user system or gateway device that has been silently recruited into malicious operations without the knowledge of its legitimate owner or ISP. The Philippine network assignment indicates the source infrastructure is located in a high-density broadband market where residential router compromises are a documented attack-enabling trend.
An exploited host classification indicates the target IP is not the originator of attacks but rather a hijacked platform being weaponised by threat actors to obfuscate their identity, launch secondary attacks, or relay malicious traffic. The associated malware and exploit activity detected against honeypot sensors confirms active hostile probing originating from this compromised endpoint. Real-world risk includes this address being used in credential stuffing campaigns, distributed denial-of-service amplification, spam distribution, or serving as a pivot point for deeper network intrusion — all while the Philippine subscriber remains an unwitting accomplice and potential victim of the initial compromise.
Site operators should block IP 122.3.88.147 at the network perimeter or firewall level and monitor for related activity from adjacent addresses within the same PLDT allocation. Reporting this IP to the Philippine Long Distance Telephone Company abuse desk is strongly recommended so the provider can notify the affected subscriber and remediate the underlying compromise. Exposed services should be protected through rate limiting, strong multi-factor authentication, and defensive tools such as fail2ban to mitigate any residual brute-force risk. Continuous logging of inbound connection attempts from this address range will assist in identifying broader campaign patterns.
RO 
CA