Maximum Danger
IP 88.80.148.122 is a maximum-risk address linked to IoT-targeted exploitation attempts originating from Bulgarian infrastructure operated by Belcloud LTD, with a threat level rating of 10/10 and 744 independent abuse reports confirming sustained malicious activity over a concentrated reporting period.
Analysis of the 744 reports from automated honeypot sensors reveals this address as a consistent source of IoT and ICS-related exploitation activity, with a confidence score of 94% and activity frequency rated at 5/10. The traffic pattern is concentrated within a single reporting month in April 2026, indicating a focused campaign rather than opportunistic scanning. Geolocation places the source in Bulgaria, and the AS44901 network is operated by Belcloud LTD, a hosting provider whose infrastructure has been repeatedly abused for automated attack propagation. The volume of reports from 20 distinct automated honeypot sensors across the threat intelligence community demonstrates coordinated detection of this address's malicious behavior from multiple independent vantage points.
The dominant threat category, IoT-targeted attacks, exploits the notoriously weak security posture of internet-connected devices including cameras, routers, smart sensors, and industrial control systems. Attackers leverage default credentials, unpatched firmware, and misconfigured network services to gain unauthorized access to these devices and incorporate them into botnets for subsequent DDoS campaigns, spam distribution, or lateral movement within corporate networks. The concrete risk to exposed organizations is unauthorized device compromise, data exfiltration from connected systems, and potential weaponization of owned IoT infrastructure for attacks against third parties.
Site operators should immediately block this IP at the network perimeter, implement strict firewall rules limiting inbound connection attempts from untrusted sources, and deploy rate-limiting on exposed services to disrupt automated attack tooling. Organizations with IoT deployments should segment these devices onto isolated network zones, audit all connected devices for default credentials, apply firmware updates promptly, and disable UPnP to prevent internal propagation. Tools such as fail2ban can help dynamically block repeated attack patterns from addresses generating high-volume abuse reports.
CY 
RO 
FR 
SE 
TR