High Risk
IP 31.70.86.135 is a moderate-to-high-risk address operating from IONOS SE infrastructure in Germany, assessed with a 7/10 threat level and 91% confidence based on 1003 total abuse reports. The IP has demonstrated sustained malicious activity at an 8/10 frequency level, with automated honeypot sensors consistently flagging the address for Fraud VoIP operations spanning May through July 2026.
The evidence base for this assessment is substantial. With over one thousand report filings and a confidence score exceeding ninety percent, the data signals a persistent, targeted threat rather than incidental scanning. Detection has been driven entirely by automated honeypot infrastructure, suggesting the IP maintains an active, probing presence across targeted networks. Operating within AS8560 (IONOS SE), a major commercial hosting and cloud provider, the address routes through a network typically associated with legitimate enterprise services, indicating the malicious activity likely exploits compromised endpoints or abusing the provider's legitimate infrastructure for financial gain through telephony fraud.
Fraud VoIP represents a financially motivated threat vector in which attackers compromise or manipulate voice-over-IP systems to generate unauthorized calls, frequently routing to premium-rate or international numbers that accrue charges paid by the victim. For organisations running exposed telephony infrastructure, an IP with this reputation hitting your services poses a direct financial exposure through toll fraud, unauthorized SIP registration attempts, and potential enumeration of valid extensions. The sustained report volume confirms this is not opportunistic noise but an established threat actor systematically probing for vulnerable VoIP deployments.
Organisations operating SIP endpoints or VoIP gateways should implement call pattern monitoring with alerting on unusual destination types, enforce strong SIP authentication, and restrict international and premium-rate dialing by default. Ingress filtering and blocklisting of known-abuse sources such as this IP, combined with tools like fail2ban to dynamically harden authentication, significantly reduces exposure. Regular audit of SIP trunk configurations and rate-limiting registration attempts will further limit the attack surface this class of threat exploits.
ES 
GB 
FR 
BG 
UA