Maximum Danger
IP 176.65.149.67 is a critical-risk address originating from the Netherlands that has generated 5,842 abuse reports over approximately one year, with automated honeypot sensors flagging it specifically for hacking activity including unauthorized SSH sessions on non-standard ports.
Across AS51396 operated by Pfcloud UG, this IP has demonstrated sustained aggressive behavior with a threat level of 10/10 and an activity frequency rated 8/10. The detection confidence stands at 85 percent based on 20 independent automated honeypot sensors logging the activity between August 2025 and August 2026. The volume of reports combined with the consistent detection pattern indicates this is not isolated scanning but systematic intrusion attempts against exposed network services.
The dominant threat category of hacking encompasses automated exploitation attempts, vulnerability probing, and unauthorized access vectors targeting exposed services. The observed pattern of SSH sessions on unusual ports suggests the operator is attempting to evade standard detection by running authentication services on non-standard ports while simultaneously conducting credential-based attacks. For any organization running SSH on an unusual port or exposing management interfaces to the internet, this IP represents a direct threat of compromise through brute-force or credential-stuffing techniques.
Network defenders should immediately block this IP at the firewall level given its critical threat classification and extensive abuse history. Deploying automated tools such as fail2ban can provide dynamic defense against repeated connection attempts from this source. SSH services should be hardened by enforcing key-based authentication, disabling root login, and ensuring connections are limited to known IP ranges where feasible. Continuous network traffic monitoring is recommended to detect any successful connections this address may have already established within exposed environments.
SE 
IR 
AE 
BG 
FR 
RO 
AU