Critical Alert
IP 185.191.239.39 is a critical-risk address with a 10/10 threat level that has generated 725 abuse reports over approximately two months, overwhelmingly linked to automated hacking activity detected by honeypot sensors. The Swiss-hosted IP, operated through AS264617 by GRUPO PANAGLOBAL 15 S.A, presents a severe and ongoing risk due to its sustained, high-frequency intrusion attempts against exposed network services worldwide.
The volume and consistency of reports paint a clear picture of malicious infrastructure: 725 total reports from 20 distinct automated honeypot sensors, with a threat confidence rating of 94 percent, indicates near-certain hostile intent. First reported in January 2026 and continuing through February 2026, this IP has operated at an 8/10 activity frequency, meaning the scanning and attack activity has been near-constant rather than sporadic. All 20 most recent reports categorize the activity as general hacking, confirming a focused campaign of exploitation attempts rather than incidental port scanning. The network assignment to GRUPO PANAGLOBAL 15 S.A, while registered in Swiss address space, suggests the infrastructure may be serving actors regardless of nominal geographic attribution.
The dominant hacking classification encompasses automated vulnerability probing, exploitation of unpatched services, and repeated unauthorized access attempts. With 725 coordinated reports across dozens of honeypot sensors, this IP functions as part of organized reconnaissance or attack infrastructure systematically cataloguing exposed entry points. Such activity typically precedes more targeted breaches or serves as a component of botnet-delivered exploit kits. The consistent pattern of connection attempts indicates the operator is systematically cycling through known vulnerability signatures against every exposed target within reach.
Site operators should block this IP immediately at the network perimeter and implement connection rate-limiting on any internet-facing services to reduce exposure to automated tooling. Deploying defensive tools such as fail2ban or equivalent intrusion-prevention systems can detect and automatically block repeated hacking patterns from sources exhibiting similar behavior. Enforcing strong, unique credentials combined with multi-factor authentication on all accessible services significantly raises the cost of successful compromise. Continuous monitoring of authentication logs for brute-force signatures and maintenance of a strict patch management cycle for exposed software further mitigates the concrete risk this IP represents to vulnerable deployments.
RO 
MX