Maximum Danger
IP 91.191.209.118 is a high-risk address originating from Bulgaria that presents a critical threat level of 10/10, having generated 1,396 abuse reports from automated honeypot sensors since April 2026. The IP's activity frequency scores 8/10, indicating sustained and aggressive malicious behavior over a four-month period with the last confirmed detection in August 2026. With a 94% confidence score, threat intelligence systems have high certainty that this address is actively engaged in unauthorized intrusion activities.
The 1,396 total reports for IP 91.191.209.118 represent a substantial volume of malicious activity concentrated within a compressed timeframe, with all reports attributed to automated honeypot detection systems rather than isolated community flagging. The IP operates through AS57509, managed by L&L Investment Ltd., and the dominance of hacking-category reports suggests systematic attempts to exploit vulnerabilities or gain unauthorized access to target systems. Detection sensors identified ICMP-based probe patterns consistent with network reconnaissance and firewall probing techniques. The geographic concentration in Bulgaria and the persistent nature of the activity over four months indicates a determined threat actor utilizing automated tools to identify and compromise exposed services.
Hacking activity, as detected from this IP, encompasses intrusion attempts, vulnerability exploitation and unauthorized access probing that can directly lead to system compromise, data exfiltration or use of compromised infrastructure for further attacks. The ICMP communication patterns observed suggest the operator may be mapping network defenses and identifying filtered ports or firewall rules. Real-world risk includes potential successful breaches of unpatched systems, lateral movement within networks and deployment of secondary attack vectors such as malware or ransomware following initial access. Organizations with exposed services face immediate risk from connection attempts originating from this address.
Site operators should immediately block IP 91.191.209.118 at the firewall level given its critical threat classification and high report volume. Implementing strict ingress filtering and rate-limiting on authentication endpoints significantly reduces the effectiveness of automated intrusion attempts. Organizations should ensure all systems remain current with security patches and deploy intrusion detection systems to monitor for similar scanning patterns from adjacent addresses. Implementing certificate-based authentication or multi-factor authentication for sensitive services adds additional barriers against unauthorized access attempts. Regular review of IP reputation databases and integration of blocklists via tools such as fail2ban can automate defensive responses to addresses with established threat profiles like this one.
RO 
MX