Severe Risk
IP 78.153.140.250 is a critical-risk address assessed at threat level 10/10, linked to sustained hacking activity with 672 abuse reports filed across an eleven-month observation window from August 2025 through June 2026. The IP presents a high activity frequency rating of 8/10, indicating consistent automated intrusion attempts rather than isolated probing. Detection confidence stands at 73%, placing substantial evidentiary weight behind the reported threat profile despite inherent limitations in automated sensor attribution.
Automated honeypot sensors logged the entirety of the 672 reports, with all 20 most recent reports categorising the activity as general hacking. The IP originates from the United Kingdom within AS202306, operated by Hostglobal.plus Ltd. The sustained volume of reports spanning from mid-2025 into 2026 demonstrates persistent automated scanning and exploitation behaviour rather than transient opportunistic attacks, suggesting this address is part of an active infrastructure conducting widespread vulnerability probing against exposed services across multiple targets.
The dominant threat category, hacking, encompasses automated intrusion attempts, exploitation of known vulnerabilities and brute-force credential attacks targeting exposed services such as SSH, Telnet or web interfaces. With an activity frequency rating of 8/10 and over six hundred confirmed honeypot interactions, this address poses a concrete risk to any internet-facing system lacking proper hardening. Attackers leveraging such infrastructure typically conduct systematic reconnaissance to identify unpatched services or weak authentication mechanisms before executing further exploitation stages.
Defensive measures should include immediate blocking of this IP at the network perimeter firewall alongside implementation of fail2ban or similar dynamic denial-of-service tools to automatically ban repeated offending sources. All internet-facing services should enforce strong, unique credentials and multi-factor authentication where feasible. Operators should ensure systems remain patched against known vulnerabilities and deploy intrusion detection monitoring to identify suspicious authentication patterns. Regular review of authentication logs for brute-force signatures and implementation of rate-limiting on login endpoints will substantially reduce exposure to the scanning behaviour this address represents.
UA 
RO 
SE 
MA