Elevated Risk
IP 128.14.227.37 is a high-risk address associated with 198 reported incidents spanning January to June 2026, with a threat level of 10/10 indicating severe malicious activity. The IP originates from Taiwan and is operated through AS135377 by UCLOUD INFORMATION TECHNOLOGY HK LIMITED, a network provider that has become a frequent source of abuse complaints. Automated honeypot sensors logged the vast majority of these reports, establishing a 75% confidence rating for the threat assessment. The dominant threat category is general hacking activity, encompassing intrusion attempts and exploitation of vulnerable services exposed to the internet.
The detection data reveals sustained aggressive behavior over a six-month window, with 20 distinct hacking-category incidents recorded alongside 1 web application attack report. The attack patterns captured include connection attempts and Suricata alerts flagging an application-layer protocol mismatch consistent with reconnaissance scanning. This pattern suggests the IP is actively probing internet-facing services, likely identifying unpatched or misconfigured systems for subsequent exploitation. The volume of 198 total reports against this single address within a half-year period indicates persistent automated scanning rather than opportunistic single-target attacks.
Hacking activity of this nature poses a direct risk to any exposed service, particularly Secure Shell daemons, remote administration interfaces, and outdated network devices. The protocol mismatch behavior detected is characteristic of credential stuffing tools and vulnerability scanners that rapidly enumerate targets before attempting known exploits. An address with this report volume operating from a cloud infrastructure provider frequently becomes a launchpad for further attacks, potentially targeting adjacent network ranges or services within the same ASN block.
Administrators should block IP 128.14.227.37 at the firewall or edge router level immediately and monitor logs for any successful connections originating from this address. Implementing fail2ban or similar dynamic blocking tools can automate denial of repeated connection attempts. Web application firewalls should be configured to flag and challenge traffic matching the detected reconnaissance signatures. Keeping all internet-facing software fully patched and employing strong multi-factor authentication on administrative interfaces significantly reduces the impact of any probing that does penetrate perimeter defenses.
NG 
HK 
KR 
JP 
BG 
RU 
GE 
TH