Notable Threat
IP 185.93.89.79 is a high-risk address originating from Iranian network infrastructure that has accumulated 218 abuse reports between January and June 2026, indicating sustained hostile reconnaissance and intrusion activity. The IP operates from AS213790 under Limited Network LTD with an 8/10 threat score and 94% confidence rating, suggesting automated honeypot sensors and community reporting platforms have consistently flagged this address for malicious behavior over a six-month observation window.
Analysis of the 218 total reports reveals 18 instances classified as general hacking activity alongside 6 confirmed port scan events, with detection attributed to 20 separate automated honeypot sensors across the security community. The sustained frequency of 8/10 demonstrates this is not an isolated probe but rather persistent, repeated targeting of exposed services. Suricata intrusion-detection alerts dominate the attack-pattern data, with signature matches identifying the Zmap network-scanning tool as the primary User-Agent employed during reconnaissance operations, combined with application-layer protocol-anomaly detections indicating one-directional communication patterns characteristic of illicit scanning behavior.
Port scanning represents a critical early stage of the attack lifecycle, allowing threat actors to map exposed services, identify potentially vulnerable applications, and prioritize targets for subsequent exploitation attempts. The confirmed use of Zmap, an open-source network-exploration utility designed for efficient large-scale port enumeration, indicates the operator is conducting systematic, high-volume reconnaissance rather than opportunistic random probing. When combined with the hacking-category reports, this pattern suggests the IP has progressed beyond mere scanning into active exploitation attempts against discovered attack surface. The one-directional protocol anomalies further suggest scanning scripts configured with minimal protocol handshaking, a hallmark of automated tooling prioritizing speed over stealth.
Site operators should immediately block or rate-limit this IP at the firewall level given its extended history of hostile activity. Deploying automated blocking tools such as fail2ban can dynamically respond to repeated scan attempts without manual intervention. Exposed services should be audited and minimized, with unnecessary ports and protocols restricted to reduce potential attack vectors. Continuous monitoring for the Zmap User-Agent string and anomalous scanning patterns will enable early detection of follow-up intrusion attempts from this or related infrastructure.
SE 
MU 
RO 
GB