IP Threat Report
20.91.139.111

🔎 Directory Scan Defense

IP 20.91.139.111 is enumerating directories. Configure fail2ban apache-404 jail after 10+ 404 errors. Disable directory listings. Normalize all 404 responses.

🌊 Traffic Flood Defense

IP 20.91.139.111 is generating excessive traffic. Limit connections per source IP. Enable geographic blocking if traffic from this region is unexpected.

🤖 User-Agent Anomaly Defense

IP 20.91.139.111 shows suspicious UA behavior. Block empty User-Agent requests. Implement JavaScript-based bot detection for sensitive endpoints.

20.91.139.111 has been assigned a threat score of 280/100 (Critical). A score this high marks a critical threat actor. This address has demonstrated persistent, aggressive malicious behavior across multiple detection vectors.

📊 Threat Analysis

Threat intelligence analysis has linked 20.91.139.111 to malicious activity originating from Gävle, Sweden, operating on the network of Microsoft Corporation. The address has been under observation since its initial detection. During its 3-day observation window, we recorded 593 hostile requests from this IP — roughly 197.7 per day on average. Operating from datacenter infrastructure, this IP is typical of addresses used in organized attack operations. Cloud and VPS providers are commonly exploited as launching platforms for automated scanning. The combination of 3 distinct attack vectors indicates a sophisticated, multi-pronged threat actor deploying automated tools that probe multiple attack surfaces simultaneously. At 280/100, this is an extremely high-risk address. All traffic should be considered hostile.