Severe Risk
IP 176.65.148.29 is a high-risk Dutch address that automated honeypot sensors flagged 195 times over a six-month period, with a near-certain 94 percent confidence score indicating sustained, deliberate intrusion activity. This IP presents a severe threat level of 10 out of 10, reflecting consistent attempts to compromise exposed network services through hacking techniques.
Operating from the Netherlands under ASN AS51396 owned by Pfcloud UG (haftungsbeschrankt), this address was first reported in January 2026 and continued generating abuse reports through June 2026, demonstrating persistent malicious behavior across a half-year window. All 195 reports originated from automated honeypot sensors designed to detect unauthorized access attempts and exploitation patterns. The activity frequency score of 8 out of 10 confirms regular, recurring probe activity rather than isolated incidents. The concentration of reports within the hacking category, accounting for all 20 most recent detections, indicates this IP is primarily engaged in systematic intrusion attempts against vulnerable services.
The hacking classification encompasses diverse intrusion methodologies including vulnerability exploitation, brute-force authentication attacks, and unauthorized access vector testing. For organizations running exposed SSH, RDP, Telnet, or web-facing services, this address represents an active threat vector capable of automated credential stuffing and exploit delivery. The sustained volume of attacks over six months suggests either a sophisticated automated campaign or a compromised infrastructure being leveraged for persistent network penetration attempts.
Site operators should immediately block this IP at the firewall level and implement fail2ban or equivalent log-based intrusion prevention tools to automatically ban repeat offenders. Enforcing strong, unique passwords alongside multi-factor authentication on all remote access services dramatically reduces brute-force success rates. Regular security patching and configuration audits of exposed services eliminate known exploit pathways these attackers commonly target. Continuous monitoring of authentication logs for source IP 176.65.148.29 helps identify any attempted connection history within internal networks.
SE 
IR 
AE 
BG 
MU 
RO 
GB