Notable Threat
IP 77.91.118.18 is a high-risk address originating from Russia and operated by INTEX ltd. under AS61436, with a threat level of 8 out of 10 and a confidence score of 94 percent. The IP has accumulated 1,273 abuse reports from automated honeypot sensors, with activity detected between May 2026 and July 2026. The dominant threat profile shows consistent hacking activity alongside targeted probes specifically aimed at IoT and industrial control systems, indicating a focused scanning and intrusion campaign against connected devices with weak security postures.
The report volume of 1,273 incidents across a three-month window and an activity frequency rating of 8 out of 10 demonstrate persistent, high-volume malicious engagement. Detection systems identified the address conducting "attack connection" attempts and triggering Suricata alerts related to application-layer protocol detection anomalies consistent with IoT and ICS reconnaissance. The simultaneous presence of general hacking probes and specialized IoT-targeted activity suggests this actor employs diversified attack methodology, likely attempting to exploit both traditional server vulnerabilities and the notoriously weak security of poorly-managed connected devices.
Hacking activity from this IP poses a direct risk of unauthorized access, data exfiltration, and system compromise for any exposed services. The IoT-directed component compounds this risk, as cameras, routers, sensors, and industrial hardware with default credentials or unpatched firmware represent low-hanging fruit for actors seeking to establish persistent footholds or build botnet capacity. The SURICATA protocol-detection anomaly further indicates the address may be probing network traffic patterns to identify vulnerable device signatures before launching targeted exploitation.
Site operators should block 77.91.118.18 at the network perimeter and monitor logs for any successful connections. Implement fail2ban or similar dynamic blocking tools to automatically respond to repeated connection attempts. Restrict exposure of administrative interfaces, enforce strong unique credentials across all services, and segment IoT devices onto isolated network zones. Keep all systems patched, disable unnecessary protocols, and review firewall rules to ensure only essential ports are reachable from untrusted networks.
FR 
RO 
MX 
SC