Extreme Threat
IP 91.196.152.105 is a high-risk address operated by ONYPHE SAS in France (AS213412) that has generated 175 abuse reports over approximately eleven months, predominantly for sustained hacking activity, warranting immediate defensive action on any exposed infrastructure.
Automated honeypot sensors recorded all 20 most recent reports attributed to this address, which reference general hacking activity encompassing intrusion attempts, vulnerability exploitation and unauthorized access attempts against exposed services. The address scored a perfect 10 out of 10 threat level with a 90 percent confidence rating, and its activity frequency of 7 out of 10 indicates repeated, sustained engagement rather than opportunistic scanning. The consistent presence of honeypot detections spanning from August 2025 through June 2026 confirms that this is not an isolated incident but an established pattern of malicious behaviour originating from infrastructure associated with ONYPHE SAS in the French network space.
Hacking activity of this intensity against honeypot sensors typically signals an attacker systematically probing for exploitable services or misconfigured systems across the internet. The sheer volume of reports combined with the sustained timeframe means this address has almost certainly targeted numerous organisations, and any publicly accessible service that received connections from 91.196.152.105 during this period should be considered potentially scanned or attacked. The high confidence score and perfect threat rating reinforce that this address poses a genuine risk to unhardened services, particularly those with weak authentication, outdated software or unnecessary internet exposure.
Administrators should block 91.196.152.105 at the firewall or edge device level and monitor for any emerging patterns of connection from this address to internal resources. Deploying or configuring tools such as fail2ban to automatically block repeated authentication failures is an effective mitigation against the brute-force and exploitation patterns this address represents. Auditing exposed services and restricting administrative interfaces to trusted networks or VPN access reduces the attack surface available to probes from addresses like this one. Maintaining up-to-date threat intelligence feeds and reviewing authentication logs for matches to this address will further strengthen situational awareness and incident response readiness.
US 
PT