Severe Risk
IP 78.153.140.148 is a high-risk address operated by Hostglobal.plus Ltd in the United Kingdom, generating 634 abuse reports from automated honeypot sensors with a perfect 10/10 threat level and an 8/10 activity frequency over approximately eleven months between August 2025 and June 2026.
The overwhelming majority of recent reports against this IP — all 20 of the latest categorised incidents — consistently flag Web App Attack activity detected by 20 separate honeypot sensors, yielding a 76% confidence score in the hostile classification. This sustained scanning and probing behaviour, persisting across nearly a year, indicates a methodical campaign rather than opportunistic or transient involvement. The network originates from AS202306 under Hostglobal.plus Ltd, a United Kingdom-based operator, and the sheer volume of reports relative to the modest geographic footprint underscores the systematic nature of the automated scanning infrastructure operating from this address.
Web application attacks encompass exploitation attempts targeting vulnerabilities listed in the OWASP Top 10, including cross-site scripting, cross-site request forgery, and file inclusion vectors. These probes seek to discover misconfigured or unpatched web-facing services, establish footholds for data exfiltration, or deploy secondary payloads. For any organisation running web applications, an IP generating this pattern of automated reconnaissance against their infrastructure represents a direct pathway to compromise if defences are not adequately layered.
Site operators should immediately block or rate-limit traffic from this address at the firewall or load-balancer level, particularly for HTTP/HTTPS endpoints. Deploying a Web Application Firewall with rule sets tuned to OWASP threats will intercept many of these probe patterns before they reach application logic. Regular security audits and prompt patching of web applications eliminate the vulnerabilities these scans are designed to exploit. Additionally, tools such as fail2ban can automatically update firewall rules when automated honeypot sensors detect sustained probing activity from repeat offenders.
TR 
FR 
UA 
CA 
MK 
RO