Elevated Risk
IP 77.91.71.90, registered in Georgia and operated through ASN AS211486 under Alferov Aleksey Aleksandrovich, is a high-risk address associated with sustained port-scan reconnaissance activity. With a threat level of 8/10 and an activity frequency rated 8/10, this IP generated 1,000 total abuse reports sourced exclusively from automated honeypot sensors, with a confidence score of 91 percent indicating high reliability in the assessment. The concentration of recent reports across July and August 2026 reflects an active and deliberate scanning campaign targeting exposed network infrastructure.
The data reveals a focused threat profile: all 20 categorized reports flag the same attack type—port scanning—and the associated attack-pattern notes reference Ciscoasa port-probe behavior specifically. This narrow specialization, combined with a report volume exceeding four figures in a compressed timeframe, strongly suggests an automated, systematic enumeration effort rather than opportunistic noise. The exclusive use of honeypot detection indicates the scanning is indiscriminate across internet-facing targets, probing for open services that could serve as entry points for further exploitation.
Port scanning represents a critical early phase in the attack lifecycle, allowing threat actors to map accessible services, identify vulnerable software versions and unpatched ports, and select targets for subsequent intrusion attempts. A Ciscoasa-specific probe pattern suggests the operator may be specifically hunting for exposed Cisco ASA firewall appliances, which are high-value targets due to their role as network perimeter devices. Even if the scan itself does not cause direct damage, successful reconnaissance dramatically lowers the barrier for follow-on attacks such as brute-force authentication, exploitation of known vulnerabilities, or deployment of malware.
Network administrators should treat any connection attempt from this IP as hostile. Implementing strict ingress firewall rules to block or throttle traffic from Georgian address space is a pragmatic first step. Deploying tools such as fail2ban or equivalent rate-limiting solutions to automatically block repeated scan attempts from this source will reduce noise and free up defensive resources. Exposed services should be audited regularly, unused ports should be closed, and Cisco ASA devices specifically should be verified against vendor security advisories to ensure current patching. Ongoing monitoring of IP reputation feeds will allow dynamic blocking if this address reappears under a different reporting window.
BG 
GB 
UA