Critical Threat
IP 78.153.140.178 is a critical-risk address assessed at 10/10 threat level that has generated 580 abuse reports, with recent activity dominated by web application attack probes originating from United Kingdom network infrastructure operated by Hostglobal.plus Ltd.
Threat intelligence data shows this address was first reported in October 2025 and most recently in November 2025, with 20 confirmed web application attack detections attributed entirely to automated honeypot sensors. The 73% confidence score reflects strong corroboration across multiple detection systems despite the relatively narrow recent activity window. With 580 total reports filed and an activity frequency recorded at 0/10, this address presents an anomalous profile where historical report volume substantially outweighs current detected activity rate. The network is registered to Hostglobal.plus Ltd under ASN AS202306, placing the origin infrastructure in a UK-based hosting environment commonly associated with both legitimate and malicious web-facing services.
Web application attacks represent the dominant threat category for this IP, indicating systematic probing for vulnerabilities such as those enumerated in the OWASP Top 10 — including injection flaws, cross-site scripting vectors, and file inclusion weaknesses. The volume of historical reports combined with confirmed honeypot detections suggests sustained, automated scanning activity rather than opportunistic opportunism. Real-world risk manifests as repeated exploitation attempts against any exposed web service, potentially leading to data exfiltration, service compromise, or pivot to deeper network access if vulnerabilities are discovered.
Site operators should immediately deploy a web application firewall to filter malicious request patterns and consider blocking this address at the network perimeter pending further investigation. Keeping all web applications and server software updated with security patches directly addresses the vulnerability classes targeted by this activity. Implementing strict input validation and output encoding across all user-facing interfaces reduces the effectiveness of injection and scripting-based probes. For additional automated defense, tools such as fail2ban can be configured to dynamically ban addresses exhibiting suspicious scanning behavior after observing a configurable threshold of probing requests.
UA 
CO 
VN 
TH