Substantial Risk
IP 207.90.244.2 is a high-risk address linked to sustained hacking activity, detected by twenty automated honeypot sensors with a threat level rating of 8 out of 10 based on 12,748 total incident reports filed over a nine-month observation window between September 2025 and June 2026.
This Cogent-174 (AS174) address, registered in the United States, has generated a substantial abuse volume that reflects persistent, automated reconnaissance and intrusion activity. The dominant threat category identified across recent reports is general hacking activity, encompassing intrusion attempts, unauthorized access probing, and vulnerability scanning behaviour. Secondary Web application attack patterns were also logged, indicating that exposed web services are within this actor's targeting scope. With an activity frequency rated at 8 out of 10 and reports distributed across twenty independent sensor sources, the detection confidence stands at 82 percent. The consistent report volume over an extended timeframe suggests an automated scanning campaign rather than opportunistic, one-off probes.
Hacking activity of this nature typically involves systematic attempts to identify and exploit misconfigured or unpatched services, often preceding more sophisticated intrusion attempts. The recorded attack patterns include connection-based probes and web application reconnaissance techniques designed to map attack surfaces and identify vulnerable endpoints. While the volume of reports does not automatically indicate successful compromises, it signals an active threat actor probing internet-facing infrastructure continuously. For organisations running exposed SSH, RDP, or HTTP-based services, such persistent scanning creates elevated risk of credential compromise or exploitation of known vulnerabilities if defensive controls are absent.
Site operators are advised to implement automated blocking mechanisms such as fail2ban or equivalent tools to reject repeated connection attempts from high-volume sources. Exposed services should enforce strong, unique credentials and wherever possible key-based or multi-factor authentication to resist credential-stuffing and brute-force attempts. Deploying a Web Application Firewall provides an additional defensive layer against application-layer probing. Consistent patch management, regular security audits, and network monitoring for connection patterns matching the observed scan signatures will further reduce exposure to the threat vectors this IP represents.
CA 
RO 
UA 
BG 
KZ