Notable Threat
IP 165.227.47.218 is a high-risk address associated with automated honeypot detections over a nine-month period, with hacking activity accounting for the majority of the 198 reported incidents. Hosted within DigitalOcean's AS14061 infrastructure in Canada, this IP demonstrates a sustained threat profile that warrants immediate defensive attention for any exposed services.
The abuse reports span from August 2025 through May 2026, accumulating 198 total reports across 20 distinct automated honeypot sensors. With a threat level of 8/10 and an activity frequency rated at 4/10, the IP exhibits persistent rather than burst-based behavior. Port-scan reconnaissance using Zmap user-agent signatures dominated recent detections, alongside generalized hacking attempts including exploitation probes and unauthorized access patterns. The concentration of reports across multiple independent sensors and the moderate confidence score of 66% indicate that this activity represents genuine malicious reconnaissance rather than isolated false positives.
The detected activity combines two complementary threat vectors that together form a classic pre-attack sequence. Port scanning serves as reconnaissance, systematically mapping exposed services and identifying potential entry points on target systems. The accompanying hacking attempts leverage the gathered intelligence to exploit vulnerabilities or guess authentication credentials. This combination poses a concrete risk to any exposed SSH, web interfaces, or other network-accessible services, as the scanning phase may identify unpatched or misconfigured systems that subsequent exploitation attempts could compromise.
Site operators should treat connections originating from this IP as hostile and implement immediate blocking at the network perimeter. Deploying rate-limiting rules and authentication hardening measures such as key-based authentication, account lockout policies, and non-standard port configurations reduces the effectiveness of these attempts. Continuous monitoring of inbound connection patterns and regular review of honeypot threat intelligence feeds helps identify emerging reconnaissance signatures before they escalate into successful intrusions.
NL 
SG 
GB 
VN 
BD 
RU