Significant Threat
IP 172.110.223.147 is a high-risk address originating from the Philippines with a threat level of 8/10 and a confidence score of 91%, strongly linked to VoIP fraud activity detected across automated honeypot sensors. This IP has generated 405 total abuse reports with an activity frequency rated 8/10, indicating sustained and aggressive malicious behavior over the May–June 2026 reporting window.
The evidence base for this assessment is robust: all 20 of the most recent threat reports specifically cite VoIP fraud as the abuse category, with detection originating exclusively from automated honeypot infrastructure rather than traditional community-based reporting. The address routes through AS47154, operated by Husam A. H. Hijazi, a network operator suggesting a limited or individual network footprint. The combination of high report volume, elevated activity frequency, and a 91% confidence rating provides strong empirical grounds for treating this IP as a confirmed threat vector requiring immediate defensive action.
VoIP fraud represents a concrete financial threat to organizations operating phone infrastructure. Attackers exploit compromised or unsecured VoIP endpoints to route unauthorized calls—typically through premium-rate or international numbers—generating illicit revenue while burdening the victim with substantial telecommunications charges. The sustained activity pattern observed here indicates this IP is actively engaged in scanning for or directly exploiting vulnerable VoIP deployments, making any exposed telephone system a direct financial liability.
Site operators should implement call authentication mechanisms such as STIR/SHAKEN protocols to verify caller legitimacy, enforce strict rate limiting on call initiation endpoints, and monitor call records for unusual patterns including premium-rate or international destination anomalies. Tools like fail2ban can block repeated authentication failures at the network perimeter. Organizations with exposed VoIP services should restrict international and premium-rate dialing by default and actively block or closely scrutinize all traffic originating from this IP address until its reputation improves.
HK 
UA