Critical Alert
IP 87.251.75.163 is a maximum-threat-level address linked to 234 abuse reports and identified as a source of active hacking activity, representing a clear danger to any exposed network service. The IP originates from Germany and is allocated through AS213010, operated by Gening Nikita Dmitrievich, with automated honeypot sensors flagging it continuously between November 2025 and January 2026.
Detection data shows the IP generated activity across 20 automated honeypot sensors, with all reported incidents falling under the hacking category. The discrepancy between the high total report count of 234 and the lower per-category figures suggests sustained probing behavior over an extended observation window. The activity frequency metric of 0/10 indicates that when the address was detected, each individual engagement was brief or low-volume in nature, yet the cumulative effect of repeated attempts creates a persistent risk profile. Geographic and network attribution places the source in Germany, though this does not necessarily reflect the true origin of the operator, as network allocations can be geographically misaligned with infrastructure ownership.
The dominant threat classification of hacking encompasses unauthorized access attempts, vulnerability exploitation, and intrusion activity targeting exposed services. Even infrequent connection attempts from this IP pose a concrete risk because automated attack tooling can systematically probe for weak credentials, unpatched software, or misconfigured services across thousands of targets simultaneously. Every successful connection from a known malicious source represents a potential breach vector, making blocking or strict rate-limiting of this address an immediate priority for any organization running internet-facing services such as SSH, RDP, or web applications.
Organizations should block IP 87.251.75.163 at the firewall or network perimeter level and implement fail2ban or equivalent host-based intrusion prevention tools to automatically ban repeated offenders. Enforcing strong, unique credentials and disabling password-based authentication where possible significantly reduces the effectiveness of any credential-stuffing or brute-force attempts originating from this address. Regular patching of internet-facing services and deployment of intrusion detection monitoring will further mitigate exploitation risks. Ongoing monitoring of abuse feeds and automated blocklist updates ensures that this threat remains blocked as long as it remains active.
