Critical Threat
78.128.112.6 is a critical-risk IP address linked to sustained hacking activity with a maximum threat rating of 10/10 and an exceptionally high volume of 1236 abuse reports from automated honeypot sensors. Originating from Bulgaria and operated by 4 Vendeta Ltd under autonomous system AS208637, this address has demonstrated persistent attack behavior at an 8/10 frequency during its active window between April and August 2026, representing one of the most prolific malicious actors documented in recent threat intelligence feeds.
The threat profile for this IP reflects sustained malicious intent with a 94% confidence score, grounded in reports from 20 distinct automated honeypot detection sources. The consistent report volume across a four-month period indicates systematic, automated attack campaigns rather than opportunistic scanning. The network operator, 4 Vendeta Ltd, operates within Bulgaria's digital infrastructure, and the persistent nature of the observed activity suggests dedicated infrastructure rather than transient compromise.
The dominant hacking classification encompasses intrusion attempts, vulnerability exploitation, and unauthorized access campaigns targeting exposed services. Detected Suricata signatures referencing ICMP destination unreachable communications administratively prohibited suggest the address participates in network reconnaissance and traffic pattern analysis to identify accessible attack vectors. These methodologies pose concrete risks of unauthorized system access, credential compromise, and potential recruitment into coordinated botnet operations.
Network operators should implement immediate blocking measures at perimeter firewalls and configure intrusion prevention systems to automatically blacklist this address based on its established threat reputation. Strong authentication controls, particularly multi-factor authentication on exposed services, substantially reduce the effectiveness of credential-based attacks. Regular patching cycles and vulnerability scanning eliminate commonly targeted entry points. Deploying fail2ban or equivalent dynamic blockade tools provides automated response to repeated malicious connection attempts from addresses like this one.
RO 
GE 
SG