Critical Threat
IP 51.159.110.167 is a maximum-threat-level address operated by Scaleway S.a.s. in France that has been consistently flagged for hacking activity, with automated honeypot sensors recording 1822 abuse reports over a six-month period from January to July 2026.
The IP, part of AS12876, carries a threat level of 10 out of 10 and an activity frequency rating of 8 out of 10, indicating persistent and aggressive intrusion attempts. All 20 of the most recent reports attribute the activity to hacking operations, with detection solely from automated honeypot infrastructure. The sustained volume of reports spanning half a year demonstrates that this address is not a transient or opportunistic actor but rather an established source of hostile network traffic. Suricata intrusion-detection systems have logged anomalous stream behaviour including malformed acknowledgment packets, consistent with reconnaissance or exploitation techniques targeting exposed services.
Hacking activity encompasses a broad range of intrusion methodologies including vulnerability exploitation, credential probing, and unauthorized access attempts. The observed broken acknowledgment packets suggest the IP may be conducting reconnaissance against services using TCP stream analysis, potentially probing for weaknesses in stateful protocol implementations or attempting to trigger unexpected behaviour in target systems. With 1822 independent reports and a confidence score of 85%, the evidence strongly indicates this address poses a concrete risk to any publicly accessible service, particularly those with unpatched vulnerabilities or weak authentication mechanisms.
Network operators should implement immediate blocking of this IP at the firewall or edge level given its sustained malicious profile. Deploying automated defensive tools such as fail2ban can dynamically update firewall rules in response to detected intrusion patterns. Ensuring all public-facing systems are current with security patches and employing robust authentication measures significantly reduces susceptibility to the types of attacks associated with this address. Continuous monitoring of access logs for connections originating from this IP will help identify any successful compromise attempts.
PL 
GB 
BG 
RO 
HK