Extreme Threat
IP 175.110.122.154 is a critical-risk address operated through WorldStream B.V. (AS49981) in the Netherlands that has generated 530 abuse reports and is currently engaged in Internet of Things (IoT) targeted reconnaissance and exploitation activity, scoring a maximum threat level of 10/10 with 94% confidence. The volume of reports and high activity frequency of 8/10 indicate sustained, aggressive behaviour against IoT infrastructure rather than opportunistic scanning.
Analysis of the 530 total reports, with 20 recent submissions all categorised as IoT-targeted activity, reveals that automated honeypot sensors detected this address attempting to identify and exploit vulnerable connected devices including cameras, routers, and smart hardware. The timeline spans from April 2026 through May 2026, indicating an active campaign during this two-month window. The Netherlands-based hosting provider WorldStream B.V. has been associated with this IP throughout the reporting period, and the consistent report volume underscores the persistent nature of the threat originating from this address.
IoT-targeted attacks pose significant real-world risk because they specifically probe for devices that often ship with weak default configurations, unpatched firmware, and disabled security features. Compromising these devices can grant attackers a foothold for data exfiltration, botnet recruitment, lateral movement within networks, or use as proxy infrastructure for further attacks. The 20 recent IoT-specific reports suggest active exploitation attempts rather than mere port scanning, elevating the urgency for organisations with exposed smart devices or industrial control systems.
Defensive measures should include immediate blocking or rate-limiting of traffic from this IP at the network perimeter, implementation of intrusion detection rules to alert on IoT-protocol anomalies, and rigorous hardening of any Internet-accessible IoT devices. Operators should audit IoT device firmware, change all default credentials, disable unnecessary services such as UPnP, and apply network segmentation to isolate smart devices from critical infrastructure. Tools like fail2ban can automate blocking of repeated offending IPs, and continuous monitoring of honeypot and community feeds will help track evolving threats from this source.
RO 
MX