Significant Threat
IP 91.230.168.187 is a high-risk address assessed at threat level 10/10, linked to sustained hacking activity with 171 independent abuse reports submitted over a six-month detection window from January to June 2026. The confidence score of 92% indicates a highly reliable assessment of malicious intent, while the activity frequency rating of 8/10 confirms repeated, persistent engagement against target systems rather than isolated or accidental contact.
All 171 reports originate from automated honeypot sensors, which captured repeated connection attempts consistent with unauthorized intrusion activity. The targeting profile aligns exclusively with the Hacking category, encompassing vulnerability exploitation attempts, intrusion vector probing, and unauthorized access maneuvers. The IP is registered to ONYPHE SAS operating ASN 213412, with routing through United States infrastructure. The six-month reporting span demonstrates sustained rather than opportunistic behavior, placing this address firmly in the category of active, deliberate threat actors rather than transient scanner traffic.
Hacking activity at this intensity represents a concrete risk to any exposed service. Automated honeypot sensors detected connection patterns consistent with systematic reconnaissance and exploitation attempts against services listening on common ports. The persistent nature of the activity over multiple months suggests either an automated campaign running continuously or repeated manual engagement by the same actor. Organizations with exposed attack surfaces, particularly unpatched services or misconfigured daemons, face elevated risk of successful compromise if this traffic reaches production infrastructure.
Site operators should implement immediate defensive controls: block or rate-limit this IP at the network perimeter using firewall rules or intrusion prevention systems; audit exposed services and ensure all software is patched to current security versions; enforce strong authentication requirements, potentially augmented by fail2ban or similar dynamic blocking tools that automatically respond to repeated connection attempts; and monitor logs for any similar patterns originating from adjacent IP ranges. Proactive threat hunting and regular review of abuse feeds will help identify emerging threats before they result in compromise.
FR 
SG 
NG 
CH 
BE 
ID 
GB 
RU