Extreme Threat
IP 165.154.32.235 is a high-risk address assessed at 8/10 threat level with a 71% confidence rating, linked primarily to sustained hacking activity and reconnaissance port-scanning operations. The IP has accumulated 440 total abuse reports across automated honeypot sensors, with recent submissions documenting 19 hacking-category incidents and 1 port-scan event. Operating from the Philippines under AS135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED), this address was first reported in November 2025 and remains active as of June 2026, indicating persistent threat behavior over approximately seven months.
Detection data reveals consistent hostile engagement directed at honeypot infrastructure, with 20 separate sensor sources reporting this IP across the observation window. The activity frequency registers at 3/10, suggesting intermittent but deliberate targeting rather than opportunistic scatter-shot approaches. The detected Suricata alert pattern and CiscoASA port-scan signature further corroborate coordinated reconnaissance and intrusion-probing activity, consistent with automated attack toolkits scanning for vulnerable services prior to exploitation attempts.
The dominant hacking activity represents unauthorized access attempts and exploitation probing against exposed services, posing a concrete risk to misconfigured or unpatched systems. Port-scanning behavior functions as reconnaissance, systematically identifying open entry points that could facilitate further compromise. Combined, these patterns indicate pre-attack intelligence gathering and initial exploitation attempts, with the elevated report volume signaling ongoing automated targeting rather than isolated probes. Systems exposed to the internet without proper hardening face elevated exposure to credential-guessing, vulnerability exploitation, or lateral movement if initial access is achieved.
Network defenders should immediately block or rate-limit this address at the perimeter firewall and implement strict inbound traffic policies for associated AS135377 address space. Deploying intrusion detection systems and configuring fail2ban or equivalent dynamic blocking tools can automatically respond to repeated attack patterns. All exposed services should follow least-privilege principles, enforce strong authentication, and maintain current patching cycles to reduce successful exploitation surfaces. Continuous monitoring for scanning signatures and authentication failures will enable rapid identification of any subsequent targeted activity originating from this source.
NG 
HK 
KR 
JP 
TW 
IR 
FR 
GB 
CA 
VN