High Risk
IP address 141.94.123.107 is a high-risk address originating from France that has been linked to VoIP fraud activity, with automated honeypot sensors recording 213 abuse reports over a concentrated period in May 2026, indicating persistent and aggressive threat behaviour that poses a direct financial risk to exposed telephone infrastructure.
The address belongs to network operator OVH SAS operating under ASN AS16276, a major European cloud provider known to host diverse customer traffic, which may include both legitimate services and compromised systems. With a confidence score of 91 percent and an activity frequency rating of 8 out of 10, this IP demonstrates a sustained pattern of malicious probing rather than isolated scanning. All 213 reports were logged within the same month, suggesting a focused campaign rather than opportunistic random activity. The 20 most recent reports consistently flagged the address for VoIP fraud, making this the dominant and verified threat category. The detection of this activity across automated honeypot infrastructure confirms that the behaviour is systematic and not attributable to misconfiguration or legitimate traffic anomalies.
VoIP fraud represents a direct financial exploitation mechanism, wherein attackers leverage vulnerable telephone systems to place unauthorized calls, often to premium-rate or international numbers, generating illicit revenue for the attacker while imposing costs on the victim organization. The concentrated volume of reports and high activity frequency for this specific address suggest it has been actively used to compromise or abuse VoIP services, potentially through credential guessing, protocol exploitation, or abuse of open telephony interfaces. Organizations running SIP (Session Initiation Protocol) services, cloud PBX systems, or any internet-facing voice infrastructure are particularly exposed to this threat vector.
Site operators should immediately block or rate-limit traffic from this address at the network perimeter firewall and monitor inbound SIP traffic for unusual calling patterns, especially calls to international or premium-rate destinations. Implementing strong authentication for VoIP administrative interfaces, enabling call admission controls, and deploying monitoring solutions capable of detecting abnormal call durations or destination patterns will reduce exposure. Tools such as fail2ban can be configured to automatically block repeated suspicious attempts targeting telephony services, and regular audits of call routing rules will help identify any unauthorized configuration changes initiated by this threat actor.
PL 
SG 
CA 
RU 
TH 
VN 
CH 
GR 
JP