Severe Risk
IP address 91.231.89.87, registered in France under ASN AS213412 to network operator ONYPHE SAS, presents a critical threat level of 10/10 based on 168 total abuse reports filed between August 2025 and June 2026, with the dominant malicious activity categorized as general hacking intrusion attempts.
Automated honeypot sensors across the security community generated all 20 confirmed hacking-category reports, producing an 86% confidence rating that this address is actively engaged in hostile reconnaissance and exploitation activity. The IP demonstrates sustained malicious behavior with an activity frequency score of 7 out of 10, indicating persistent rather than opportunistic scanning. The eleven-month reporting window from mid-2025 through mid-2026 confirms this is not a transient or compromised endpoint but an established threat actor maintaining consistent attack operations from French network infrastructure.
General hacking activity encompasses unauthorized access attempts, vulnerability exploitation, and intrusion probing against exposed services. The volume of reports and high activity frequency suggest this address participates in automated attack campaigns, likely scanning broad IP ranges for exploitable entry points rather than targeting specific victims. Real-world risk includes credential compromise, data exfiltration, and lateral movement within networks where weak or misconfigured services accept connections from untrusted sources. Organizations running exposed SSH, RDP, or web applications without adequate hardening face the greatest exposure.
Site operators should immediately block this IP at the network perimeter firewall and implement fail2ban or equivalent rate-limiting rules to mitigate repeated connection attempts. Enforcing key-based authentication for remote access services, disabling unused network daemons, and applying vendor-released security patches within standard SLAs significantly reduces exploitability. Continuous monitoring of authentication logs for source IP 91.231.89.87 will confirm whether blocklists are effectively applied and detect any attempts to circumvent restrictions through proxy or spoofing techniques.
US 
MY 
RS