Elevated Risk
IP 92.63.197.80 is a high-risk address operating from Ukrainian network infrastructure that has been identified as a persistent source of hostile reconnaissance activity, specifically port scanning behavior, accumulating over 1,800 abuse reports with an elevated threat level of 8 out of 10 and a confidence rating of 91 percent.
The IP address 92.63.197.80 is registered within ASN AS211736 operated by FOP Dmytro Nedilskyi in Ukraine. Activity was first detected in March 2026 and has continued through June 2026, indicating a sustained multi-month campaign. The 20 most recent reports all cite port scanning activity, detected exclusively through automated honeypot sensors. The activity frequency score of 8 out of 10 reflects the persistent and repetitive nature of the reconnaissance behavior, with the volume of reports suggesting this address is actively used for systematic scanning operations rather than isolated probes.
Port scanning represents the initial reconnaissance phase of targeted attacks, where hostile actors systematically query target systems to identify open services, running applications and potential entry points. The specific focus on CiscoASA device reconnaissance indicates deliberate probing of perimeter security appliances, which could inform subsequent exploitation attempts if vulnerabilities are discovered. This scanning pattern poses a concrete risk to any exposed service, as successful identification of open ports or misconfigured devices can enable more sophisticated follow-on attacks ranging from credential abuse to remote code execution.
Site operators should immediately review firewall rules and minimize the exposure of network services to untrusted sources. Implementing strict ingress filtering and blocking this IP at the network edge will prevent further reconnaissance attempts. Authentication hardening measures, including the use of fail2ban or similar defensive tools to detect and block automated scanning patterns, are strongly recommended. Continuous monitoring of honeypot and community intelligence feeds will help maintain awareness of ongoing threat patterns associated with this address.
BG