Elevated Risk
IP 64.39.103.51 is a high-risk address that generated 1,212 abuse reports in a single month, placing it firmly in the high-threat category with a threat level of 8/10. The volume of community reports combined with detection across 20 automated honeypot sensors reveals persistent malicious activity originating from this US-based IP address. Email spam represents the dominant reported threat category, followed by web application attacks and general hacking attempts, indicating this address has been used for multiple attack vectors against exposed services.
The data shows this address was first and last reported in October 2025, meaning all documented activity occurred within a compressed timeframe. Despite the substantial report count, the activity frequency registers at 0/10, which may indicate the IP is currently dormant or that its detection rate has subsided since the reporting period. The IP routes through AS27385, operated by Qualys, a US-based network operator. The 58% confidence score suggests moderate certainty in the classification, while the 1,212 total reports provide strong empirical evidence of sustained hostile behavior rather than isolated probe events.
Email spam activity of this magnitude typically indicates the address has been used for mass distribution of unsolicited messages, a common vector for phishing campaigns and malware delivery. The web application attack reports suggest automated scanning for vulnerabilities such as injection flaws, path traversal, or authentication weaknesses in internet-facing applications. Hacking activity encompasses various intrusion attempts and unauthorized access probing against services exposed to the internet. Together, these categories represent a multi-vector threat profile where an exposed mail relay, vulnerable web application, or unpatched service could be compromised in short order.
Site operators should implement SPF, DKIM, and DMARC email authentication protocols to prevent abuse of any mail infrastructure, deploy a web application firewall to filter common attack patterns, and ensure all internet-facing systems are patched against known vulnerabilities. Implementing fail2ban or similar dynamic blocking tools can automatically mitigate brute-force and scanning activity. Organizations may also consider blocking or rate-limiting traffic from this IP based on current threat intelligence feeds as a precautionary measure.
GB 
GE 
SI 
KR 
PL 
RO