Elevated Risk
IP 154.239.6.163 is a high-risk address originating from Egypt's Etisalat Misr network (AS36992) that has generated 470 incident reports from automated honeypot sensors since April 2026, indicating sustained hostile reconnaissance and intrusion activity with an elevated 8/10 threat level and 93% confidence score.
The IP was first reported in April 2026 and remained active through May 2026, accumulating reports across 20 distinct honeypot sensor sources. Detection patterns show a primary focus on Ciscoasa port scanning operations combined with Suricata stream anomaly alerts indicating malformed acknowledgment packets, consistent with sophisticated reconnaissance probes designed to map network defenses and identify vulnerable entry points for subsequent exploitation attempts.
Port scanning activity as observed from IP 154.239.6.163 represents active network reconnaissance where the address systematically probes target systems for open ports and services that could serve as attack vectors. The accompanying Suricata alerts regarding broken acknowledgment packets suggest the scanning implementation includes techniques to evade detection or exploit stateful inspection gaps in firewall configurations. The "Hacking" classification reflects confirmed intrusion attempt patterns beyond passive reconnaissance, indicating this address has progressed from simple scanning to active exploitation attempts against exposed services. Organizations with misconfigured or unpatched services facing the internet face genuine risk of unauthorized access originating from this source.
Site operators should implement blocking or rate-limiting measures for this IP address at the network perimeter, enforce strong authentication requirements on all exposed services, and monitor logs for any authentication failures or unusual traffic patterns originating from this source. Deploying intrusion detection systems and keeping systems patched reduces vulnerability to the exploitation techniques this address has demonstrated. Additionally, configuring firewall rules to drop traffic from this address and implementing fail2ban or similar automated blocking tools provides layered defense against continued reconnaissance.
MU 
MX 
SC 
UA 
RO