Maximum Danger
IP address 91.191.209.46, registered to L&L Investment Ltd. and operating within AS57509 in Bulgaria, presents a maximum threat level of 10/10 with a 94% confidence score based on 1,247 reports submitted across automated honeypot sensors between May and August 2026. This IP exhibits an exceptionally high activity frequency rating of 8/10, indicating sustained and aggressive hostile operations throughout its observed operational window. The dominance of hacking-category activity places this address firmly in the highest-risk classification for any exposed network infrastructure.
The report volume of 1,247 submissions represents a substantial threat footprint concentrated over approximately four months of active detection. All threat reports originate from automated honeypot sensors, confirming this is a deliberately automated attack campaign rather than isolated manual probing. Network analysis reveals the IP has been observed generating Suricata alerts consistent with administrative-level traffic filtering, where destination hosts explicitly reject communication attempts. This pattern typically indicates the IP is actively scanning or probing Bulgarian and international network ranges, cataloguing responsive services and filtering mechanisms for subsequent exploitation stages. The sustained activity volume and consistent reporting timeline suggest this is not opportunistic scanning but a persistent, targeted campaign.
Hacking activity as documented in these reports encompasses intrusion attempts, vulnerability probing, and unauthorized access vectors against exposed services. The administrative prohibition indicators observed in network traffic suggest the IP is mapping firewall rules and service availability across target ranges. Real-world risk includes compromise of unpatched services, credential exposure through brute-force attempts, and potential lateral movement if initial access is achieved. The automated nature of these operations means attacks continue uninterrupted around the clock, amplifying exposure windows for any vulnerable entry point.
Network administrators should immediately block this IP at the firewall level given its maximum threat classification and sustained hostile activity profile. Deploying fail2ban or equivalent log-based attack mitigation tools can automate temporary blocking of repeated connection attempts targeting authentication interfaces. Maintaining strict patching cycles for all exposed services dramatically reduces the attack surface this IP could exploit. Implementing rate-limiting on authentication endpoints and enforcing strong credential policies mitigates brute-force and credential-stuffing vectors commonly associated with this threat profile. Continuous traffic monitoring and log analysis will help identify any successful reconnaissance or intrusion attempts originating from this or similar high-risk sources.
RO 
MX