Notable Threat
IP 64.62.197.167, registered to Hurricane's network (AS6939) in the United States, is a high-risk address with a threat level of 8/10 and a confidence score of 88%, amassing 471 abuse reports across automated honeypot sensors over approximately ten months of observed activity. Its activity frequency rating of 8/10 signals sustained, repetitive offensive operations rather than a brief or isolated burst of malicious traffic. The dominant threat category is general hacking activity, supplemented by targeted web application probes and IoT reconnaissance, indicating a flexible, multi-vector attacking host capable of adapting its scanning and exploitation efforts across different service classes.
Detection data from 20 independent automated honeypot sources corroborates a pattern of repeated connection attempts against web application honeypot deployments, TLS anomaly detection triggered by Suricata rules, and direct IoT/ICS reconnaissance behaviour. The report timeline spanning August 2025 through June 2026 demonstrates persistent engagement over a prolonged window, with 19 of the most recent reports explicitly categorised as hacking activity alongside isolated web app attack and IoT-targeted reports. The sheer volume of 471 total reports from honeypot infrastructure alone suggests this IP is part of an automated, wide-reaching scanning campaign operating continuously rather than targeting a single victim or service type.
The hacking classification encompasses unauthorized access attempts, vulnerability probing and general intrusion reconnaissance that could serve as a precursor to credential compromise, data exfiltration or further exploitation of unpatched services. Web application attack patterns targeting ElasticPot-style honeypot environments imply the actor is actively cataloguing web-facing applications for known vulnerabilities such as those listed in the OWASP Top 10. IoT and ICS targeting behaviour compounds the risk, as exposed smart devices, cameras and networked infrastructure often ship with default credentials and minimal hardening, making them low-effort, high-reward targets for an automated attacker. The TLS anomaly alerts suggest the host may also be experimenting with malformed or obfuscated traffic to evade basic detection signatures.
RO