Severe Risk
IP 87.121.84.6 is a maximum-threat-level address linked to 573 hacking-related abuse reports that poses significant risk to any exposed network services it targets.
The IP, registered to Vpsvault.host Ltd in the United States under ASN AS215925, has been flagged by 20 automated honeypot sensors between October 2025 and February 2026, generating a substantial volume of incident data for analysis. Despite the maximum 10/10 threat classification, the activity frequency score of 0/10 indicates that observed malicious behavior occurs in concentrated bursts rather than as continuous background noise, suggesting deliberate operational patterns by the source. The 60% confidence score reflects moderate certainty in attributing all reported activity to this single source, though the report volume alone establishes a clear pattern warranting defensive action.
Hacking activity as catalogued by these reports encompasses exploitation attempts, vulnerability probing and unauthorized access efforts against exposed services. The real-world risk manifests as potential credential compromise, system exploitation or establishment of persistent access, particularly against unpatched or misconfigured services reachable from the internet. The episodic nature of the activity suggests the operator may be adjusting tactics to evade static detection thresholds, making passive monitoring alone insufficient for adequate defence.
Site operators should implement automated banning tools such as fail2ban to detect and block repeated probing patterns from this address. Enforcing key-based authentication on SSH and similar remote-access services eliminates the credential-based attack surface entirely. Maintaining current security patches across all internet-facing systems closes known vulnerabilities that exploitation attempts target. Additionally, restricting service exposure through firewall rules and implementing network-level rate limiting reduces the effectiveness of automated intrusion campaigns originating from this source.