Critical Threat
IP 91.230.168.39 is a critical-risk address with a threat level of 10 out of 10, assessed with 93% confidence based on 162 total reports and a high activity frequency rating. The dominant threat category identified is general hacking activity, indicating sustained intrusion attempts and exploitation of vulnerable services.
Detection data shows this IP was first reported in January 2026 and most recently reported in June 2026, demonstrating persistent malicious behavior over approximately six months. All 162 reports were generated by 20 automated honeypot sensors, confirming coordinated attack infrastructure. Geolocation associates the address with the United States, though the network is operated by ONYPHE SAS under ASN AS213412, suggesting the physical infrastructure may differ from registration data. The activity frequency of 8 out of 10 indicates repeated, sustained offensive operations rather than opportunistic scanning.
The reported hacking activity encompasses various intrusion methodologies, including vulnerability exploitation, brute-force authentication attacks, and unauthorized access attempts against exposed services. This pattern poses significant risk to SSH, RDP, web applications, and other network-accessible systems that lack robust authentication or run unpatched software. The volume and persistence of reports indicate systematic targeting rather than opportunistic probing.
Network defenders should immediately block or rate-limit traffic from this address at the firewall level and implement strict access controls on all exposed services. Strong authentication mechanisms, including multi-factor authentication and certificate-based access, should be enforced across all remote access points. Regular patching of systems and applications, combined with intrusion detection monitoring, will help identify and mitigate any successful intrusion attempts. Security teams should also review authentication logs for any matching source IPs to detect potential prior compromise.
FR 
JP