Substantial Risk
IP address 91.230.168.135 is a high-risk threat actor associated with automated honeypot sensors and community reports, evaluated at an 8 out of 10 threat level with 93 percent confidence. This address, registered to ONYPHE SAS under ASN AS213412 in the United States, has accumulated 157 total abuse reports since January 2026, with the most recent activity detected in May 2026. The dominant threat profile centers on hacking-related intrusion attempts, supported by ancillary email spam activity, yielding an 8 out of 10 activity frequency rating that reflects sustained, repeated engagement with target infrastructure.
Analysis of the 157 reports across 20 distinct automated honeypot sensors reveals a consistent pattern of hostile probing activity over approximately five months. The overwhelming majority of reported incidents—19 confirmed cases—fall under the hacking category, with a single email spam report contributing to the broader abuse picture. The abstract attack-pattern signatures suggest connection-based intrusion attempts alongside SMTP abuse vectors, indicating this actor pursues multiple simultaneous approaches to compromise vulnerable services. The 93 percent confidence score substantiates that these patterns are not anomalous or coincidental but represent deliberate, structured targeting behavior.
Hacking activity of this nature typically involves systematic scanning, credential guessing, or exploitation of unpatched services to achieve unauthorized access. When combined with SMTP spam abuse, the actor demonstrates capability across both network intrusion and communication-layer attacks, creating a compound risk scenario for any exposed services. An organization running open SMTP relays, unpatched SSH daemons, or weakly configured mail systems faces elevated exposure from this address. The sustained activity frequency confirms this is not a transient probe but an ongoing campaign that has persisted across multiple reporting cycles.
Network defenders should immediately block or rate-limit traffic originating from 91.230.168.135 at the firewall or intrusion-prevention level. Services accessible from the public internet—particularly SSH, SMTP, and web interfaces—should enforce strong authentication mechanisms, including key-based authentication for SSH and multi-factor authentication where feasible. Implementing tools such as fail2ban can automate dynamic blocking of repeat offenders. Regular monitoring of authentication logs for brute-force patterns and maintenance of current security patches across all internet-facing systems will substantially reduce vulnerability to the intrusion techniques associated with this address.
FR 
VN 
PH 
MX 
PL 
LK 
PT