Critical Threat
IP 64.225.226.35 is a critical-risk address associated with sustained, high-volume hacking activity, accumulating 1,000 abuse reports from automated honeypot sensors over approximately three months in mid-2026. With a threat level of 10 out of 10 and a confidence score of 94%, this United States-based IP represents one of the most actively reported sources of intrusion attempts currently tracked in public threat feeds.
The IP originates from network AS19009, operated by OneCleveland, and has been continuously reported between June 2026 and August 2026. All 20 most recent reported threat categories classify the activity as general hacking, encompassing intrusion attempts, exploitation attempts, and unauthorized access probes. Detection data shows this address generates repeated Suricata alerts indicating RST packet anomalies typical of port scanning, session disruption, or reconnaissance behavior. The activity frequency score of 8 out of 10 confirms persistent, high-rate engagement against target services rather than isolated or opportunistic scanning.
The dominant threat category, hacking activity, indicates this address is involved in systematic attempts to compromise exposed services by probing for vulnerabilities, exploiting misconfigurations, or forcing authentication mechanisms. The Suricata stream anomaly detected suggests the address may be conducting aggressive port scanning, connection manipulation, or attempting to disrupt established sessions to facilitate further intrusion steps. Concrete risks include credential exposure, service compromise, or use of the targeted system as a pivot point for broader network intrusion.
Site operators should immediately block or rate-limit connections from this address at the firewall or network edge device. Implementing fail2ban or equivalent log-analysis tools can automatically detect and ban hosts exhibiting this scanning behavior based on failed authentication patterns. Ensuring all exposed services run current security patches, disabling unused services, and enforcing strong authentication requirements significantly reduces susceptibility to the intrusion techniques this address employs. Ongoing monitoring of authentication logs and network traffic for repeated probes from this source will help identify any successful compromise attempts.
VN 
HK 
BG 
FI 
PT