Significant Threat
IP 143.110.239.2 is a high-risk address with a threat level of 8 out of 10, linked to sustained hacking and web application attack activity detected by automated honeypot sensors. With 11,571 total abuse reports and an activity frequency rated 8 out of 10, this DigitalOcean-hosted IP represents a persistent, high-volume threat actor operating from the United States across network AS14061. The sustained volume of reports spanning from September 2025 through June 2026 indicates consistent malicious behavior rather than opportunistic scanning.
The IP has accumulated substantial abuse report history with recent detections indicating primary focus on hacking attempts and web application reconnaissance. Automated honeypot sensors flagged the address 20 times for connection probes matching web application fingerprinting patterns. The sheer volume of historical reports combined with recent activity suggests an automated scanning infrastructure rather than isolated manual probing. DigitalOcean's cloud infrastructure is frequently leveraged by threat actors due to its reputational flexibility and global reach, making IP 143.110.239.2's presence within this ASN a notable concern for defenders reviewing their external attack surfaces.
Hacking activity associated with this IP encompasses exploitation attempts and unauthorized access probing against exposed services, while the web application attack vector indicates systematic scanning for vulnerabilities such as injection flaws, cross-site scripting, and file inclusion weaknesses in internet-facing applications. The real-world risk manifests as credential compromise, data exfiltration, or complete system compromise if any vulnerable service is identified and successfully exploited. Attackers operating from cloud infrastructure like DigitalOcean benefit from anonymized origins and scalable resources that enable continuous, high-frequency scanning campaigns against broad target ranges.
Defenders should immediately block or rate-limit traffic from this IP at the firewall level and monitor logs for any matching source activity. Implementing fail2ban or similar intrusion prevention tools can automatically update firewall rules based on authentication failures and suspicious request patterns. Keep all systems and web applications fully patched, deploy a web application firewall to filter malicious requests, and conduct regular security audits to eliminate the OWASP Top 10 vulnerabilities that this category of attacker specifically targets. Restricting administrative interfaces to known IP ranges and enforcing strong authentication mechanisms significantly reduces the attack surface available to this threat actor.
NL 
GB 
UA 
RO 
BG 
KZ 
FR 
PS 
VN