Severe Risk
IP 89.42.231.179 is a critical-risk address originating from the Netherlands that has generated 490 abuse reports and is linked to both hacking intrusion attempts and IoT device targeting through automated honeypot sensors, with the most recent community reports dating to March 2026.
Operating within AS206264 under Amarutu Technology Ltd, this Netherlands-based IP was first flagged in December 2025 and continued generating reports through March 2026, accumulating a substantial volume of 490 reports across 20 distinct honeypot sensors. The threat profile is dominated by 17 hacking-category reports alongside 3 IoT-targeted incidents. While the current activity frequency registers at zero out of ten, the sheer volume of historical reports and the dual threat vector indicate an address that has been systematically employed for automated exploitation campaigns against internet-facing systems and poorly secured connected devices. The 66% confidence score reflects that a significant portion of this activity has been independently corroborated across multiple detection points rather than relying on a single sensor report.
The hacking activity associated with this address represents automated intrusion attempts and vulnerability exploitation targeting exposed services, while the IoT-targeted reports indicate scanning or exploitation behaviour specifically aimed at smart devices, routers, cameras and other connected hardware with weak default security configurations. Together these threat categories suggest an actor deploying broad-spectrum reconnaissance and compromise tools capable of identifying and exploiting both traditional server infrastructure and the growing ecosystem of inadequately protected IoT endpoints. The dual approach maximises the attack surface available to the operator while increasing the likelihood of successful compromise.
Site operators should block or rate-limit traffic from this address at the network edge, apply fail2ban or equivalent dynamic blocking for brute-force patterns, enforce strong multi-factor authentication on all exposed services, and ensure all IoT devices are placed in isolated network segments with updated firmware and non-default credentials. Regular monitoring of access logs for connection attempts originating from this range will help identify any ongoing reconnaissance activity.
SC 
HK 
FR