Substantial Risk
IP 92.63.197.78 is a high-risk address operating from Ukrainian network infrastructure that has generated 660 abuse reports and maintains an 8/10 activity frequency, with automated honeypot sensors flagging it primarily for sustained port-scanning reconnaissance activity against Ciscoasa appliances over a compressed two-month detection window in early 2026.
Community and automated honeypot sensors first reported this address in March 2026, with activity continuing through May 2026. The IP originates from AS211736, operated by FOP Dmytro Nedilskyi, and all 20 recent threat reports consistently cite port-scanning behaviour as the dominant threat category. The 87% confidence score reflects strong agreement across detection sources that this activity is malicious rather than legitimate network traffic, while the 7/10 threat level and elevated activity frequency together indicate persistent, deliberate reconnaissance rather than opportunistic or fleeting scanning.
Port scanning represents a critical early stage of the attack lifecycle, allowing threat actors to map exposed services and identify potential entry points before launching targeted exploitation. The specific focus on Ciscoasa scanning suggests deliberate reconnaissance against perimeter security appliances, which if successful could yield credentials, configuration weaknesses or unpatched vulnerabilities that enable deeper network intrusion. For any organisation with internet-facing Ciscoasa devices or similar perimeter equipment, this scanning pattern indicates an active probing campaign that could precede more serious attacks if vulnerabilities are discovered.
Site operators should immediately review firewall rules to restrict inbound access to unnecessary ports and services, implement strict geolocation or ASN-based filtering where feasible given the Ukrainian origin, and monitor logs for scanning patterns from this address and adjacent ranges. Deploying automated dynamic blocking tools such as fail2ban can proactively respond to repeated probe attempts. The priority action is ensuring Ciscoasa firmware and all perimeter services are fully patched and that default or weak credentials are eliminated, eliminating the attack surface that this reconnaissance activity is designed to discover.
GB 
IR 
BE