High Risk
IP 91.224.92.17 is a high-risk address with a threat level of 8 out of 10 that has been linked to web application attacks, accumulating 1,306 total abuse reports from automated honeypot sensors between August and October 2025. The IP originates from the United Kingdom and is routed through ASN AS209605, operated by UAB Host Baltic, a hosting provider whose infrastructure has been associated with scanning and probing activity in threat intelligence databases.
The confidence score of 63 percent reflects moderate certainty in the attribution, based on 20 recent reports specifically categorizing the activity as web application attacks. The detection timeframe spans approximately three months, with the first reports appearing in August 2025 and the most recent in October 2025. The activity frequency metric of 0 out of 10 suggests intermittent rather than continuous engagement, which is consistent with automated scanning campaigns that probe large IP ranges in irregular patterns rather than sustained targeted assaults against a single host.
Web application attacks encompass exploitation attempts targeting vulnerabilities described in the OWASP Top 10, including cross-site scripting, cross-site request forgery, file inclusion vulnerabilities and other input-validation weaknesses in web-facing software. The probe pattern detected suggests this address is systematically scanning the internet for vulnerable web applications, potentially as a precursor to more targeted compromise or as part of an automated exploitation toolkit designed to identify easily breached targets at scale.
Site operators exposing web services should consider implementing a web application firewall to filter malicious request patterns, enforce strict input validation on all user-supplied data and maintain current patch cycles for all web software including content management systems, plugins and backend frameworks. Deploying rate-limiting rules on authentication and form-submission endpoints can further disrupt automated scanning activity. Community tools such as fail2ban can be configured to automatically block IPs exhibiting aggressive probe behaviour based on log analysis.
LT 
FR 
HK 
SE 
TH 
VN