High Risk
IP 207.90.244.3 is a high-risk address associated with sustained hacking activity, exhibiting an exceptionally high report volume of 12,861 incidents detected across 20 automated honeypot sensors with an 8/10 threat level and 82% confidence. The IP, registered to Cogent Communications (AS174) in the United States, has been actively reported between September 2025 and June 2026, indicating persistent threat behavior over an extended period.
The detection data reveals that the vast majority of recent reports (19 of 20) classify the activity under the Hacking category, encompassing general intrusion attempts, exploitation attempts, and unauthorized access probes. Additionally, a single Exploited Host report indicates that this IP may itself represent a compromised system being weaponized as an attack platform without the legitimate owner's knowledge. The network operator, Cogent Communications, is a major tier-one internet service provider whose infrastructure frequently appears in threat intelligence feeds due to its scale and the challenging nature of abuse mitigation across such a broad network footprint.
Hacking activity at this volume and persistence suggests automated scanning and exploitation toolkits targeting vulnerable services across the internet. The co-presence of Exploited Host classification raises the possibility that this address has been commandeered by threat actors to conduct attacks while masking their true origin, potentially subjecting the IP's legitimate operators to reputation damage and abuse complaints. Organizations exposing services to the internet should treat this IP as a confirmed malicious source until further notice.
Site operators are advised to block 207.90.244.3 at the firewall or network edge to eliminate automated reconnaissance and exploitation traffic. Implementing fail2ban or similar dynamic blocking tools can automate this process based on repeated failed authentication attempts. Enforcing strong, unique credentials and disabling password-based authentication in favor of key-based access on exposed services significantly reduces the attack surface. Continuous monitoring of authentication logs for patterns associated with this IP and regular patch management for internet-facing systems will further harden defenses against the intrusion techniques this address has historically deployed.
CA 
TR 
FR 
GB 
UA 
MK 
RO