Critical Threat
IP address 173.239.240.145 is a high-risk address assessed at a threat level of 10/10, originating from the United States within AS396356 operated by Latitude.sh. With 467 total abuse reports filed against this single IP, the overwhelming majority of recent detections — 17 of 23 — flag it as conducting port-scan activity, while smaller clusters of reports document hacking attempts and participation in DDoS attack campaigns. Despite a notably low activity frequency rating of 0/10, the volume of reports and the diversity of threat categories collectively paint the profile of a compromised or abuser-operated endpoint presenting a concrete risk to any exposed infrastructure.
Detection data spanning from March 2026 through April 2026 draws from 17 automated honeypot sensors and 3 community-based reports, yielding a 72% confidence score. The concentration of honeypot detections indicates systematic, automated scanning behavior rather than opportunistic manual probing. Abstracted attack-pattern notes corroborate Cisco ASA probe activity alongside general reputation-threat signals, reinforcing that this address is actively enumerating perimeter defenses and exposed services as a precursor to more targeted intrusion attempts.
Port scanning represents the most prevalent threat category associated with 173.239.240.145. Reconnaissance of this kind allows threat actors to map open ports and identify unpatched or misconfigured services that may later serve as entry points. The concurrent presence of hacking and DDoS indicators suggests this IP may function within a broader automated attack infrastructure, potentially part of a botnet or a scanning farm used to feed intelligence to follow-on attacks against third-party targets.
Operators with internet-facing assets should block or heavily rate-limit traffic from 173.239.240.145 at the network edge. Deploying strict ingress firewall rules to limit exposure of unnecessary services, monitoring logs for scanning patterns originating from this address, and leveraging tools such as fail2ban to automate dynamic blocking are practical immediate steps. Ensuring all exposed services are patched and hardening authentication mechanisms will further reduce the likelihood that reconnaissance from this IP translates into a successful intrusion.
MX 
UA 
GB