Critical Alert
IP 144.172.109.24 is a critical-risk address associated with prolific general hacking activity, amassing 304 abuse reports from automated honeypot sensors within a single month of tracking. With a threat score of 10 out of 10 and a confidence rating of 94%, this US-based IP represents one of the highest-risk actors observable in current threat feeds. The address is routed through AS14956 under the ROUTERHOSTING network, and all recorded activity falls squarely within the hacking threat category, indicating sustained, systematic intrusion attempts rather than opportunistic scanning.
The data paints a clear picture of concentrated malicious traffic. All 304 reports originated exclusively from automated honeypot sensors, establishing a highly consistent detection pattern across the measurement period in December 2025. The activity frequency score of 8 out of 10 confirms near-continuous engagement with target infrastructure, suggesting the operator behind this IP deploys automated tooling that systematically probes for vulnerabilities across a wide range of exposed services. The 94% confidence score reflects the unambiguous nature of the observed behaviour — the threat signature matches known hacking patterns with minimal ambiguity.
The hacking classification encompasses diverse intrusion methodologies aimed at unauthorized system access, vulnerability exploitation, and service compromise. These automated campaigns pose substantial risk to any exposed services, particularly those running outdated software, weak authentication mechanisms, or publicly accessible management interfaces. The sheer volume of reports indicates this is not random scanning but a deliberate, repeated campaign leveraging the same infrastructure for sustained probing.
Site operators should treat this IP as definitively hostile and implement immediate defensive controls. Deploying dynamic firewall rules through tools such as fail2ban can automatically block repeated offending IPs based on log patterns. Enforcing strong, unique credentials alongside multi-factor authentication across all exposed services significantly raises the barrier for successful intrusion. Maintaining rigorous patch management schedules ensures known vulnerabilities cannot be leveraged by the exploitation techniques this actor employs. Finally, reviewing access logs for any matching source activity and monitoring for similar behaviour from adjacent IP ranges within AS14956 provides additional situational awareness against ongoing campaigns.
CH 
RO 
MX