Substantial Risk
IP 5.196.63.60 is a high-risk address with a threat level of 7/10, generating 937 abuse reports and exhibiting an activity frequency of 8/10, with its malicious behavior focused on VoIP fraud detected through automated honeypot sensors during a concentrated window from April to May 2026.
The address resides within the OVH SAS network (AS16276) in France, a major European cloud provider whose infrastructure is frequently targeted by threat actors due to its scale and reputation. The 91% confidence score indicates strong evidentiary support from 20 distinct honeypot detection events, all categorizing the activity as VoIP fraud. The concentrated two-month reporting timeframe suggests persistent, deliberate engagement with vulnerable telephony infrastructure rather than opportunistic scanning.
VoIP fraud exploits internet-based telephony systems to route unauthorized calls—typically to premium-rate or international numbers—generating illegal revenue for the attacker while imposing financial losses on the victim organization. An IP engaged in this activity may be probing for open SIP proxies, testing credential combinations against telephony platforms, or serving as a relay point for fraudulent call traffic. The concrete risk to an exposed VoIP service is substantial: unauthorized call routing can result in significant charges, service degradation, and potential legal liability.
Site operators running VoIP or SIP services should immediately block or closely scrutinize traffic from this IP. Implementing call authentication standards such as STIR/SHAKEN helps verify caller legitimacy. Deploying defensive tools like fail2ban can automatically mitigate repeated connection attempts. Restricting international and premium-rate dialing unless explicitly authorized, combined with monitoring call patterns for anomalies, reduces the attack surface for revenue-generating fraud schemes.
CA 
PL 
RU 
MX 
UA 
RO 
LK 
GB 
KR 
PH 
BD 
ID