High Risk
IP 77.91.118.50 is a critical-risk address operated by INTEX ltd. in Russia (AS61436) that has been linked to 1,244 abuse reports in a concentrated four-month window, with automated honeypot sensors flagging it primarily for port-scanning reconnaissance and hacking activity against edge security devices. The confidence score of 94% reflects a near-certain association with malicious intent, making this one of the highest-risk IPs currently tracked in community threat feeds. Its activity frequency rating of 8/10 indicates sustained, repeated probing rather than opportunistic or fleeting contact.
Detection data collected from 20 separate automated honeypot sensors over a May–August 2026 timeframe documents 20 distinct threat events, with the dominant category being general hacking activity (19 reports) alongside isolated port-scan detections (1 report). The geographic origin in Russia and the AS61436 network allocation to INTEX ltd. position this IP within a specific threat-actor context that security teams should treat with elevated scrutiny. The specific pattern noted—CiscoASA port-scan probing—suggests the address has been used to systematically map exposed Cisco adaptive security appliances as potential entry points.
Port scanning activity of this nature represents the reconnaissance phase of an attack lifecycle, where adversaries enumerate open services and reachable interfaces before launching exploitation attempts. The CiscoASA targeting is particularly concerning because these devices often serve as network perimeter gateways; a successful compromise could grant broad access to internal infrastructure. Combined with general hacking attempts, this IP presents a credible threat to any exposed management interfaces, weak configurations, or unpatched vulnerabilities on Cisco security hardware and adjacent services.
Network defenders should immediately block or aggressively rate-limit traffic originating from 77.91.118.50 at the perimeter firewall level and monitor upstream logs for any successful connection attempts. Reducing the attack surface by minimizing publicly exposed services—particularly Cisco ASA management interfaces—and enforcing strong authentication on any reachable console or API endpoints will deny the reconnaissance value these scans seek. Deploying intrusion-detection rules tuned to CiscoASA scan signatures and automating responses with tools such as fail2ban or equivalent blocklist daemons will further reduce exposure. Regular audit of CiscoASA configurations for unnecessary services and application of vendor security patches should follow as hardening priorities.
RO 
NL 
MX