Substantial Risk
IP 77.91.71.24 is a high-risk address originating from Georgia that has been consistently linked to port-scanning reconnaissance activity, with automated honeypot sensors recording over 1,000 abuse reports across a two-month detection window this summer. The IP's threat level of 8/10 and confidence score of 91% reflect a reliably malicious actor profile that warrants immediate blocking by exposed services.
Analysis of the reported data reveals that the scanning activity intensified during July and August 2026, with honeypot sensors flagging Cisco ASA port scan probes as the dominant threat category. The AS211486 network is operated by Alferov Aleksey Aleksandrovich, and the sustained activity frequency of 8/10 demonstrates persistent, automated scanning behavior rather than isolated or opportunistic probes. All 1,000 reports were attributed to automated honeypot detection systems, providing substantial coverage of the scanning campaign's footprint.
Port scanning represents the initial reconnaissance phase of targeted attacks, systematically mapping exposed services to identify exploitable entry points for subsequent intrusion attempts. The Cisco ASA probe pattern detected indicates a focused effort to identify firewall and VPN gateway vulnerabilities that could enable unauthorized network access. High-volume scanning from this address significantly increases the probability of discovering misconfigured or unpatched services across any exposed network.
Site operators should implement firewall rules or ACLs to block 77.91.71.24 at the network perimeter, configure intrusion detection systems to alert on scanning patterns originating from this source, and enforce strict least-privilege access policies on any externally facing services. Deploying automated dynamic blocking tools such as fail2ban can further reduce the effectiveness of continued reconnaissance attempts. Regular auditing of exposed service inventories and prompt patching of Cisco ASA and related gateway devices will minimize viable attack surface that this scanning campaign seeks to exploit.
BG 
GB 
UA