Substantial Risk
IP 165.154.118.215 is a high-risk address operating from a Thailand-hosted network that has generated 204 abuse reports across automated honeypot sensors, indicating persistent hacking activity including connection attempts, malware events and exploit delivery over an eight-month period from October 2025 through June 2026.
Security telemetry shows this IP was first reported on 2025-10-01 and most recently flagged on 2025-06-11, with 20 distinct honeypot sources contributing reports. Of categorized recent reports, Hacking accounts for 19 instances while Exploited Host represents 1 case, suggesting the address may itself be running compromised software being weaponized for further attacks. The network AS135377 belongs to UCLOUD INFORMATION TECHNOLOGY HK LIMITED, a hosting provider whose infrastructure is frequently associated with automated scanning and attack campaigns. The activity frequency score of 4/10 and a threat level of 8/10 confirm this is not isolated probing but sustained hostile engagement targeting exposed services.
The dominant Hacking classification encompasses intrusion attempts, vulnerability exploitation and unauthorized access vectors detected through honeypot event triggers, attack connections and malware activity patterns. This profile is consistent with mass scanning operations or participation in botnet infrastructure, where compromised hosts conduct reconnaissance and exploit attempts against internet-facing systems without the owner's knowledge. An Exploited Host designation indicates the address itself has likely been compromised and is being used as an unwitting attack platform, compounding the risk it poses to any network it contacts.
Network defenders should block 165.154.118.215 at the firewall or edge device level given its sustained abuse history and high threat scoring. Implement fail2ban or equivalent dynamic blocking daemons to automatically respond to repeated connection attempts from this source. Ensure all internet-facing services are fully patched, especially SSH and web applications which are common Hacking targets, and apply strict rate-limiting on authentication endpoints. Finally, notify the hosting provider using the ASN and network operator details to request investigation and remediation of the compromised or abuse-running infrastructure.
NG 
HK 
KR 
JP 
TW 
KZ 
GE 
RO 
ID