Critical Threat
IP 192.159.99.113 presents a critical threat profile that warrants immediate defensive action. This address, operated by 1337 Services GmbH under ASN AS210558 in the United States, has accumulated 233 abuse reports from automated honeypot sensors over a four-month window spanning January to April 2026, with a threat level assessed at 10 out of 10. The dominant activity recorded against this IP falls into the hacking category, accounting for 20 of the most recent reports, supplemented by a single exploited-host classification, indicating the address may itself be running malicious tooling without the operator's knowledge.
The detection picture reveals concentrated hostile activity originating from this endpoint. All 233 reports derive from 20 distinct automated honeypot sensors distributed across the threat-intelligence community, suggesting systematic scanning or exploitation attempts rather than isolated incidents. The temporal distribution covers a first report in January 2026 with continued activity through April 2026, establishing a persistent multi-month campaign. Despite the elevated threat score, the reported activity frequency sits at zero out of 10, indicating the honeypots detected relatively few individual connection attempts per sensor, though the cumulative report volume remains significant. Network analysis shows HTTP traffic missing the standard Host header, a pattern commonly associated with automated exploit delivery, malware communication, or reconnaissance tooling rather than legitimate browsing behavior.
The hacking classification encompasses intrusion attempts, vulnerability exploitation, and unauthorized access vectors, posing a direct risk to any exposed service listening on common ports. The additional exploited-host designation suggests this IP may be part of a botnet or compromised infrastructure being weaponized remotely, meaning the operator themselves could be an unwitting victim whose system is being leveraged for attacks. The Suricata signature triggered—HTTP requests lacking a Host header—frequently flags exploit kits, port scanners, and command-and-control beacon traffic, all of which can precede more damaging intrusions against target networks. An address with this dual classification presents a compound risk: it may be simultaneously conducting attacks while also being compromised itself, amplifying its potential impact on the broader internet ecosystem.
NL 
PL 
SC 
RO