Critical Threat
IP address 91.231.89.245, registered in France and operated by ONYPHE SAS under ASN AS213412, represents a critical threat with a perfect 10/10 threat level and 193 total abuse reports filed over approximately eleven months. Automated honeypot sensors detected the vast majority of this malicious activity, yielding an 85% confidence score that this address is deliberately engaged in hostile operations. With an activity frequency rated 7/10, this IP demonstrates persistent, repeated attack behavior rather than opportunistic scanning.
The reporting window spans from August 2025 through June 2026, indicating sustained malicious engagement over nearly a year. All 20 categorized hacking reports originated from automated honeypot infrastructure designed to simulate vulnerable services and capture intrusion attempts. The volume of 193 total reports suggests this address participates in large-scale automated attack campaigns, likely coordinated botnet activity or mass exploitation tooling. The network operator, ONYPHE SAS, appears to be associated with a cybersecurity intelligence platform, which may indicate this IP is either being used maliciously despite its legitimate operator or is itself a research asset generating community-facing threat data.
The dominant threat category of hacking encompasses unauthorized intrusion attempts, vulnerability exploitation, and systematic credential-based attacks against exposed services. These activities pose direct risks of data breach, service compromise, and lateral movement within target networks. Real-world impact includes potential account takeover, malware deployment, and complete system compromise for unpatched or misconfigured targets. The persistent, high-frequency nature of this IP's activity suggests it is actively targeting systems at scale rather than conducting isolated probe attempts.
Site operators should immediately block this IP at the firewall or network perimeter level given its extreme threat classification. Deploying or configuring defensive tools such as fail2ban or equivalent intrusion prevention systems can automatically detect and neutralize repeated connection attempts. Ensuring all exposed services run current security patches and enforce strong, non-default authentication credentials eliminates the primary attack surface these intrusions target. Continuous monitoring of authentication logs for attempts originating from this address will help identify any successful compromises that require incident response.
US 
KZ 
GH 
SE 
GB