Severe Risk
IP 87.120.191.13 is a critical-risk address operated by Vpsvault.host Ltd under ASN AS215925 that has accumulated 13,131 abuse reports since first detected in August 2025, with automated honeypot sensors flagging it primarily for general hacking activity including intrusion attempts and exploitation attempts against exposed services.
The volume of reports associated with this IP is exceptionally high, ranking among the most-reported addresses in comparable threat-intelligence datasets, yet the activity frequency metric of 0/10 suggests that the most aggressive campaign has subsided or shifted. The 20 recent reports in the hacking category all originated from automated honeypot sensors, indicating sustained automated scanning and exploit-probing behavior rather than isolated manual intrusion attempts. The geographic attribution to the United States places this address within a commercial VPS infrastructure environment commonly leveraged by threat actors for its reliability and anonymity, which aligns with the pattern of mass-scale automated attacks originating from compromised or rented cloud resources.
Hacking activity encompasses a broad spectrum of unauthorized access techniques, from brute-force credential attacks against services like SSH, RDP and web panels to targeted probing for known software vulnerabilities and misconfiguration exploits. Even with reduced current activity, the historical magnitude of abuse reports indicates this address has repeatedly demonstrated hostile intent toward internet-facing systems. The underlying threat lies not only in successful compromise but also in the reconnaissance and enumeration phases that precede attacks, which can themselves exhaust server resources and generate anomalous log noise that obscures genuine security incidents.
Site operators should implement defensive controls immediately: block or rate-limit traffic from this IP at the firewall level, enforce strong authentication on all exposed services with account-lockout policies, and deploy monitoring rules to alert on connection patterns associated with port scanning or credential-stuffing campaigns. Tools such as fail2ban or equivalent log-analysis utilities can automate dynamic blocking based on observed attack signatures. Regularly reviewing authentication logs for source IP 87.120.191.13 and correlating with threat-intelligence feeds will help determine whether the address remains active against specific infrastructure.
SC 
RO