Significant Threat
IP 138.68.143.86, registered to DigitalOcean's network in Great Britain, presents a high-risk threat profile scoring 8 out of 10, with 700 total abuse reports logged between September 2025 and March 2026. The dominant activity is general hacking intrusion attempts, though the IP also exhibits characteristics of an exploited host platform being leveraged for further attacks. Despite the substantial report volume, automated honeypot sensors detected all malicious activity with consistent patterns, placing confidence in the assessment at 59 percent.
Network telemetry from AS14061 reveals that 20 distinct honeypot sensors flagged this address across the six-month reporting window. Suricata intrusion-detection systems identified abnormal SSH sessions operating on non-standard ports, alongside CiscoASA firewall alerts flagging port-scan reconnaissance behaviour and application-layer protocol anomalies. The combination of these signatures indicates systematic probing and exploitation activity rather than opportunistic noise. The Exploited Host classification appearing in two recent reports suggests the IP may belong to a compromised cloud infrastructure instance being weaponised without the legitimate operator's knowledge.
Hacking activity of this nature poses a concrete risk to any exposed service, particularly secure-shell endpoints accepting connections on unexpected ports. Attackers leverage such infrastructure to conduct credential stuffing, vulnerability exploitation and lateral movement after initial compromise. Port-scanning behaviour observed here typically precedes more targeted intrusion attempts, mapping open services for subsequent exploitation. The absence of frequent repeat connections does not diminish the threat, as even singular successful breaches can grant persistent access or deploy secondary payloads across a target environment.
Site operators should immediately block this IP at the firewall level given its confirmed malicious history. Enabling fail2ban or equivalent authentication-hardening tools on SSH services, enforcing key-based authentication and restricting connections to known IP ranges substantially reduces exposure to credential-based attacks. Regular monitoring of authentication logs for unusual source addresses and port activity helps detect probing patterns early. If this IP originates from your own infrastructure, treat the underlying instance as compromised and conduct a full forensic assessment before returning it to service.
NL 
CA 
SG 
VN 
ES 
BD 
JP 
BY 
ID 
CH 
LK