Critical Threat
IP address 185.243.96.105 is a critical-risk address originating from Ukraine that has been associated with 17,727 total abuse reports dominated by general hacking activity, including intrusion attempts and exploitation of vulnerabilities, warranting immediate blocking or strict rate-limiting for any exposed services.
The IP, registered to network operator Rices Privately owned enterprise under ASN AS48693, was first reported in October 2025 and most recently reported in February 2026, spanning approximately five months of active engagement with honeypot sensors. The total abuse volume of 17,727 reports is substantial and reflects sustained, repeated scanning behaviour over the observation window, while the last reported dataset shows 20 specific hacking-category incidents captured by automated honeypot sensors. The 59% confidence score indicates a moderate level of certainty in the attribution, and the current activity frequency score of 0/10 suggests that, as of the most recent reports, the IP is not currently emitting detectable hostile traffic — a common pattern with cyclical or sporadic threat actors that go dormant between campaigns.
The dominant reported category, hacking, encompasses a broad range of intrusion activity including unauthorized access attempts, vulnerability probing and exploitation attempts against exposed services. Although the current activity frequency registers as zero, the massive historical report count demonstrates that this address has operated as an aggressive, automated threat actor in the recent past. Such IPs frequently cycle between active and dormant phases, meaning exposed services remain at risk of renewed scanning or exploitation attempts at any time, particularly if the operator repurposes the infrastructure for new campaigns.
Site operators should block or heavily rate-limit connections from 185.243.96.105 at the firewall level, and consider implementing automated blocking tools such as fail2ban or equivalent intrusion-prevention systems that respond to repeated authentication failures and suspicious connection patterns. All exposed services should enforce strong, unique credentials and disable unnecessary services or ports to reduce attack surface. Regular monitoring of abuse feeds and maintain intrusion-detection logging will help identify any resumption of hostile activity from this or adjacent infrastructure quickly.
RO 
PH 
VN