Severe Risk
IP address 91.196.152.29 is a critical-risk address linked to sustained hacking activity, having generated 233 total abuse reports across an active 10-month threat campaign detected by automated honeypot sensors. Hosted in France and associated with ASN AS213412 operated by ONYPHE SAS, this IP exhibits an extreme 10/10 threat level and a very high 8/10 activity frequency, indicating persistent, aggressive intrusion behaviour against exposed services worldwide.
The evidence profile shows 20 distinct hacking-category reports submitted exclusively through automated honeypot sensors between August 2025 and June 2026, establishing a confirmed attack timeline spanning nearly a full year. The 85% confidence score reflects substantial corroboration across detection sources, while the sheer volume of reports relative to the detection window points to continuous, automated scanning and probing rather than isolated opportunistic attempts. Geographic attribution to France and the specific network operator provides context for potential attribution, though threat actors routinely leverage compromised infrastructure in diverse jurisdictions.
The dominant hacking-category activity encompasses broad intrusion attempts, exploitation probing, and unauthorized access vectors targeting vulnerable services. This pattern represents a concrete real-world risk: attackers systematically enumerate and exploit exposed entry points, potentially gaining foothold for data exfiltration, lateral movement, or deploying secondary payloads. An IP with this threat magnitude and frequency functioning against an unhardened or unpatched service creates a direct pathway to complete system compromise.
Site operators should immediately block or heavily rate-limit traffic from this address at the network perimeter and consider implementing deny-by-default firewall rules for unused ports. Deploying fail2ban or equivalent dynamic blocklist tools that automatically trigger based on honeypot and log anomalies will neutralise repeated attempts. Regular patch management, enforced strong authentication on exposed services, and intrusion-detection monitoring are essential to mitigate the underlying vulnerability surface that this IP targets. Continuous review of abuse feeds and threat-intelligence databases will ensure timely response to evolving patterns from this and similar high-risk addresses.
US 
RO 
IR 
BG 
CA 
SE 
EE