High Risk
IP 152.32.169.7 is a high-risk threat actor address with a threat level of 8/10 that has accumulated 203 total abuse reports, predominantly for hacking activity, and presents a clear danger to any exposed network services. Operating from Hong Kong through the ZEN-DPS network on ASN AS62610, this address has demonstrated sustained malicious behavior over approximately nine months of active monitoring by automated honeypot sensors and community-based reporting mechanisms.
The detection data reveals a persistent threat with an activity frequency rated 7/10 and a confidence score of 77 percent, indicating reliable attribution of the observed behavior. Across 20 automated honeypot sensor reports, this IP was documented executing attack connections and triggering Suricata protocol-mismatch alerts, specifically noting application-layer inconsistencies across both communication directions. The dominant threat category of hacking accounts for 20 recent reports, complemented by a single fraud VoIP report, suggesting the address participates in multiple attack vectors. The timeframe spanning September 2025 through June 2026 demonstrates that this malicious activity is not isolated or transient but rather represents sustained hostile infrastructure engaged in systematic probing and exploitation attempts against target systems.
The hacking activity associated with this address encompasses unauthorized access attempts, vulnerability scanning, and exploitation of misconfigured or unpatched services, posing concrete risks to exposed SSH, telnet, and administrative interfaces. The protocol mismatch behavior detected by honeypot sensors indicates that this IP was actively testing application-layer responses, likely to identify service versions, bypass detection mechanisms, or manipulate traffic patterns to blend with legitimate communications. The fraud VoIP classification suggests potential involvement in call routing abuse or premium-rate number exploitation, though the primary threat vector remains broad intrusion activity. Real-world exposure to this address could result in credential compromise, data exfiltration, or lateral movement within compromised networks if exploitation succeeds.
SG 
CA 
IR 
EG 
RU 
ES 
LT 
GB 
LK 
RS