Severe Risk
IP 87.120.191.65 is a maximum-threat-level address linked to 720 reported incidents of hacking activity, originating from US-based infrastructure operated by Vpsvault.host Ltd under ASN AS215925, with automated honeypot sensors recording sustained hostile engagement over a four-month window from December 2025 through March 2026.
The data paints a concerning picture of persistent intrusion activity: 720 total abuse reports against this single IP, with 20 of the most recent reports specifically categorised as hacking attempts, all attributed to automated honeypot detections. Despite an unusually low activity frequency score of 0/10, the sheer volume of reports across multiple months indicates continuous automated scanning or exploitation attempts rather than isolated probes. The 66% confidence score reflects that while the threat classification is definitive, attribution nuances remain. The address sits within a commercial hosting environment operated by Vpsvault.host Ltd, a context that often correlates with compromised servers, bulletproof hosting, or exit-node abuse.
Hacking activity in this context encompasses vulnerability exploitation, credential attacks, and unauthorized access attempts targeting exposed services. For an organisation with directly reachable infrastructure, an IP accumulating this volume of hacking reports poses a concrete risk of successful compromise through brute-force attempts, exploitation of unpatched software, or targeted service abuse. Automated honeypot sensors recording consistent reports suggest the address is actively involved in systematic reconnaissance or exploitation campaigns against internet-facing systems.
Site operators should implement immediate defensive measures: block or heavily rate-limit connections from this address at the firewall level, enforce strong authentication on all accessible services with particular attention to SSH and RDP, and apply security patches systematically. Deploying fail2ban or equivalent log-analysis tools can automate the blocking of repeated intrusion patterns. Continuous traffic analysis and log monitoring will help determine whether this address has been used in prior successful compromises against your infrastructure.
HK 
FR 
SE