Substantial Risk
IP address 31.70.66.9, allocated to IONOS SE (AS8560) and geolocated to Germany, presents a high-risk threat profile with a threat level of 8 out of 10 and a confidence score of 91 percent. This address has accumulated 1,757 total abuse reports from automated honeypot sensors, reflecting sustained malicious activity observed between May 2026 and July 2026. The dominant threat category identified against this IP is VoIP fraud, a pattern consistent with the exploitation of internet telephony infrastructure for unauthorized call generation and financial gain.
Detection data indicates that the activity against IP 31.70.66.9 was captured across multiple automated honeypot sensors, with the IP exhibiting an activity frequency rating of 8 out of 10. The concentration of reports within the VoIP fraud category suggests this address is involved in systematic abuse rather than opportunistic scanning. The high volume of reports over a concentrated two-month window demonstrates persistent intent, and the attribution to a major European hosting provider (IONOS SE) indicates the source is operating within a commercial network environment commonly leveraged by threat actors for anonymization or scalability.
VoIP fraud exploits internet telephony systems to route unauthorized calls, typically to premium-rate or international numbers, generating revenue for the attacker at the victim's expense. For organizations running exposed SIP (Session Initiation Protocol) servers, unmanaged VoIP gateways, or open telephony ports, an IP engaged in this activity represents a direct financial and operational threat. Attackers scanning for weak or default SIP credentials or misconfigured VoIP endpoints can rapidly pivot from reconnaissance to active toll fraud, resulting in unexpected charges, service disruption, or compromised call routing. The reputation damage and financial liability associated with such abuse can extend well beyond the immediate incident.
Site operators should immediately block or throttle traffic from IP 31.70.66.9 at the network perimeter firewall or intrusion prevention system. Enable fail2ban or equivalent dynamic blockade tools to automatically respond to repeated SIP INVITE attempts or authentication failures targeting VoIP services. Audit exposed SIP servers for weak or default credentials, enforce strong password policies, and restrict international and premium-rate outbound dialing where telephony is not a core business function. Monitor call detail records for anomalous volume spikes and implement call authentication mechanisms such as SIP ALG inspection or encryption to reduce exposure to relay-based fraud.
ES 
GB 
FR 
BG 
UA