Critical Alert
IP 91.196.152.184 is a maximum-threat address linked to sustained hacking activity originating from France, with a 10/10 threat level, 161 total abuse reports, and consistent automated honeypot detections spanning from August 2025 through May 2026. The combination of a 93% confidence score and an 8/10 activity frequency places this IP among the most dangerous sources currently flagged in public threat intelligence feeds. Any network exposing services to this address faces a high probability of targeted intrusion attempts.
The address is registered to AS213412 under network operator ONYPHE SAS, a French entity, and has generated reports across multiple months of observation. All 161 detections originated from automated honeypot sensors, which logged repeated "attack connection" and "honeypot event" patterns over a nine-month window. The sustained volume of reports—averaging roughly eighteen per month with activity consistently detected—indicates methodical, automated scanning rather than opportunistic or transient behavior. Geographic origin in France does not indicate benign intent, as threat actors routinely route operations through compromised infrastructure in well-connected jurisdictions.
The dominant threat category of hacking encompasses intrusion attempts, exploitation of vulnerabilities, and unauthorized access campaigns. Detection of honeypot events confirms that automated tooling is actively probing for entry points on exposed services. This pattern represents a concrete risk to any publicly accessible system, particularly those running outdated software or weak authentication configurations, as successful exploitation could grant attackers persistent access or deploy further malicious payloads.
Administrators should immediately block IP 91.196.152.184 at the network perimeter and configure firewall rules to drop subsequent packets from this source. Services exposed to the internet should implement strong, unique credentials and consider deploying tools such as fail2ban to automatically ban repeated login failures. Rate-limiting inbound connections and enforcing multi-factor authentication on administrative interfaces significantly reduces the effectiveness of these intrusion attempts. Continuous log monitoring for any activity originating from this address will help identify reconnaissance behavior before exploitation occurs.
US 
PT