Severe Risk
IP 176.65.149.224, registered to Pfcloud UG and routed through Netherlands network infrastructure AS51396, presents a maximum threat level of 10/10 and is directly associated with persistent hacking activity. With 5,729 independent abuse reports logged across an approximately eleven-month observation window spanning August 2025 to July 2026, this address represents one of the highest-risk IPs currently tracked in the database, exhibiting continuous activity frequency rated at 8/10 against an 85% confidence score in malicious attribution.
The volume and consistency of abuse reports targeting this address are exceptional, with all 20 most recent threat categorizations clustering around hacking activity. Automated honeypot sensors across the network collectively registered thousands of connection attempts and exploitation probes originating from this single source address. The detection span of nearly a full year, combined with the sustained reporting frequency, indicates infrastructure deliberately maintained for ongoing malicious operations rather than transient compromised hosts or opportunistic scanning. Attribution to AS51396, operated by Pfcloud UG, places this activity within a commercial hosting environment known to accommodate threat actors.
The dominant hacking classification encompasses intrusion attempts, vulnerability exploitation, and unauthorized access probes, with recent honeypot evidence capturing explicit signs of active SSH sessions established on non-standard ports. This pattern suggests threat actors are leveraging this IP to conduct sustained reconnaissance against exposed SSH services, attempting to identify misconfigured or outdated deployments that deviate from hardened defaults. The concrete risk to any exposed service lies in successful credential compromise, lateral movement into internal networks, or deployment of secondary payloads such as backdoors or cryptocurrency miners.
Site operators should immediately block this IP at the network perimeter firewall level given its confirmed malicious status. Implementing automated connection-throttling mechanisms such as fail2ban or equivalent intrusion prevention tools will disrupt the repetitive authentication probes characteristic of this address. All SSH services should enforce key-based authentication exclusively, disable root login, and employ non-standard port configuration as an additional hardening layer. Continuous monitoring of authentication logs combined with implementation of intrusion detection signatures covering SSH brute-force patterns will provide ongoing situational awareness against similar threat infrastructure.
SE 
IR 
AE 
BG 
GB 
FR