Critical Alert
IP 198.199.86.189 is a critical-risk address operating from DigitalOcean's network infrastructure in the United States, with a maximum threat rating of 10 out of 10 based on 419 total abuse reports documenting sustained hacking activity including intrusion attempts and exploitation of vulnerable services.
The IP, registered to DigitalOcean's ASN AS14061, was first and most recently reported in October 2025, with all 20 of the most recent reports consistently categorizing the observed activity as general hacking. Automated honeypot sensors detected the malicious behavior, generating the bulk of these reports. Despite the high threat classification, the activity frequency metric is recorded at zero out of ten, suggesting either intermittent attack patterns or reporting gaps in recent weeks. The confidence score of 64 percent indicates that while the hostile intent is well-established, analysts note some uncertainty about the full scope or specific payload delivery associated with the activity.
Hacking activity at this threat level typically involves systematic reconnaissance followed by exploitation attempts against exposed services, including brute-force authentication attacks, vulnerability scanning, and payload delivery efforts. An IP with this report volume and threat rating poses a concrete risk to any publicly accessible service, particularly those with misconfigurations, outdated software, or weak access controls. Even if this address represents a compromised DigitalOcean cloud instance being used as a staging point by threat actors, it remains a genuine operational hazard for targeted networks.
Site operators should block this IP address at the firewall or network edge immediately, implement strict rate-limiting on exposed authentication endpoints such as SSH and web login portals, and deploy defensive tools such as fail2ban to automatically mitigate repeated connection attempts. Enforcing strong, unique credentials and multi-factor authentication across all accessible services reduces the likelihood that any successful intrusion occurs. Continuous monitoring of authentication logs for patterns associated with this address is strongly advised.
NL 
GB 
CA 
BG 
TH 
HK 
CZ