Substantial Risk
IP 165.154.162.102 is a high-risk address associated with 188 reported incidents of malicious activity, primarily hacking attempts, originating from infrastructure operated by UCLOUD INFORMATION TECHNOLOGY HK LIMITED in the United States. With a threat level of 8/10 and a confidence score of 71%, this IP poses a significant threat to exposed services and requires immediate defensive action.
Automated honeypot sensors recorded 188 abuse reports against this address across a six-month observation window from November 2025 to May 2026, with the activity attributed to 20 distinct detection sources. The dominant threat category is Hacking, accounting for 19 recent reports, while Email Spam contributed 2 reports and single incidents were flagged for IoT Targeted activity and Exploited Host behavior. The attack-pattern analysis reveals connections consistent with SMTP spam and abuse, IoT and ICS targeting, and malware or exploit activity flagged by intrusion-detection sensors. The moderate activity frequency score of 3/10 indicates consistent but not overwhelming traffic volume, suggesting this IP participates in sustained, methodical scanning or exploitation campaigns rather than high-volume opportunistic attacks.
Hacking activity encompasses a broad spectrum of intrusion attempts, vulnerability exploitation, and unauthorized access vectors. The combination of IoT targeting and exploited-host indicators suggests this IP may be leveraged to compromise smart devices, cameras, routers, or industrial control systems that lack robust security hardening. The presence of SMTP-related abuse patterns implies the infrastructure may also be used for email phishing or malware distribution campaigns. A threat level of 8/10 reflects the concrete risk of successful service compromise if exposed to the open internet without adequate protections.
Network defenders should block or severely restrict access from IP 165.154.162.102 at the firewall or network edge, implementing geolocation and ASN-based filtering as supplementary controls. Deploying or configuring tools such as fail2ban to automatically ban repeated offenders can reduce the effectiveness of brute-force or scanning techniques. Exposed services, particularly SSH, SMTP, and IoT management interfaces, should enforce strong, unique credentials, implement multi-factor authentication, and disable unused services. Continuous monitoring for IoT-specific traffic patterns and regular firmware updates for connected devices will further reduce the attack surface available to this threat actor.
NG 
HK 
KR 
JP 
TW 
BG 
RU 
CA 
PH 
FR 
SE 
MY 
ID 
VN