Severe Risk
IP 165.154.33.91 is a maximum-threat-level address originating from the Philippines with a substantial abuse history, accumulating 768 reports from automated honeypot sensors across approximately seven months of active malicious behavior linked primarily to general hacking activity and evidence of host exploitation.
Operated under ASN AS135377 by UCLOUD INFORMATION TECHNOLOGY HK LIMITED, IP 165.154.33.91 was first flagged in October 2025 with the most recent reports logged in May 2026. The detection profile shows consistent activity across 20 distinct honeypot sensors, generating an average of roughly 110 reports per month at a moderate activity frequency of 3 out of 10. The reported threat categories include 20 instances of general hacking activity and 1 instance classified as exploited host, indicating this address may be functioning as a compromised attack platform being leveraged by threat actors without the knowledge of its legitimate operator.
The dominant hacking activity detected against this address includes connection attempts that triggered Suricata alerts for malformed TLS records, a signature commonly associated with exploit delivery and malware communication attempts. Combined with the exploited host classification, this pattern suggests the IP may be running unauthorized attack tooling or serving as a relay for malicious traffic. The sustained volume of reports over an extended period indicates deliberate, persistent targeting of exposed services rather than opportunistic scanning, elevating the risk profile for any infrastructure accessible to this address.
Network defenders should implement immediate blocking or rate-limiting for IP 165.154.33.91 at perimeter firewalls and web application gateways. Enabling intrusion detection rules that flag anomalous TLS handshakes and malformed record types will help identify potential exploit traffic. Systems exposed to this address should be audited for unauthorized access or compromise indicators. Additionally, deploying defensive tools such as fail2ban or similar connection-throttling mechanisms can mitigate brute-force attempts, and organizations are encouraged to report the malicious activity to the relevant hosting provider to facilitate remediation of the potentially compromised infrastructure.
NG 
HK 
FR 
TW 
PE 
GB