High Risk
IP 137.184.13.100 is a high-risk address operating from DigitalOcean's infrastructure in the United States that has generated 9,537 abuse reports between September 2025 and June 2026, with automated honeypot sensors flagging it primarily for hacking activity alongside evidence that the host itself has been compromised and is being weaponised for further attacks.
The volume of reports is substantial at 9,537 with a confidence score of 81%, drawn from 20 distinct automated honeypot sensors distributed across the network. The activity frequency rating of 8 out of 10 indicates sustained, aggressive engagement rather than opportunistic or fleeting probes. The IP belongs to AS14061 (DigitalOcean-ASN), a major cloud infrastructure provider, and the dominant threat classification is Hacking (18 recent reports) with a smaller but significant cluster of Exploited Host reports (3), suggesting this address likely began as a compromise of a cloud-hosted asset before being repurposed as an attack platform. The attack-pattern data references malware and exploit activity alongside specifically Redis-targeted connections, indicating the host is actively scanning for or attempting to exploit vulnerable data-store services.
The combination of Exploited Host status with persistent hacking activity means this IP represents a double threat: it is both a compromised system whose owner is likely unaware of its misuse and an active instrument being used to compromise other targets. Redis attack patterns suggest the operator is scanning for misconfigured NoSQL databases to exploit, potentially for data exfiltration, cryptojacking deployment or use as a pivot point for deeper network intrusion. The sustained high-frequency engagement over a nine-month period demonstrates persistent, automated campaigns rather than manual hacking, consistent with botnet-style operation.
Site operators should immediately block or heavily rate-limit connections from 137.184.13.100 at the firewall level and monitor for follow-on addresses in the same DigitalOcean network range. Implementing authentication hardening on any exposed services, particularly Redis instances without password protection, is critical. Deploying intrusion-detection tools such as fail2ban can automatically block repeated attack patterns. Organisations should also consider notifying DigitalOcean's abuse team to report the compromised host and potential ongoing malicious activity originating from their infrastructure.
NL 
GB 
CA 
BE 
UA 
KR 
BD