Maximum Danger
IP 176.65.149.230 is a maximum-threat address operated by Pfcloud UG in the Netherlands that has generated 4,749 abuse reports from automated honeypot sensors since August 2025, with SSH probing activity on non-standard ports representing the dominant threat category. With a threat level of 10/10 and activity frequency rated 8/10, this IP demonstrates persistent, high-intensity malicious behavior requiring immediate defensive action.
Network telemetry places 176.65.149.230 within AS51396, operated by Pfcloud UG, a Netherlands-based infrastructure provider. The IP has accumulated reports consistently over a ten-month window from August 2025 through June 2026, with 20 distinct threat reports logged against the hacking category alone. Detection across 20 separate automated honeypot sensors confirms this is not an isolated incident but sustained, multi-source observed hostile activity. The Suricata signature "ET INFO SSH session in progress on Unusual Port" indicates the address is actively attempting to establish secure-shell connections on ports deviating from the standard TCP 22, a known evasion technique.
Hacking activity encompasses unauthorized access attempts, vulnerability exploitation, and intrusion probing against exposed services. When an attacker routes SSH sessions through non-standard ports, they are specifically attempting to bypass firewall rules, evade signature-based detection, and target misconfigured systems that expose administrative interfaces. The volume and persistence of reports against 176.65.149.230 suggest an automated scanning campaign capable of cataloguing and exploiting vulnerable entry points across a wide target surface.
Network defenders should immediately block 176.65.149.230 at the firewall level and monitor for any subsequent spoofed or rotated variants originating from AS51396. Enforcing key-based authentication for SSH, relocating the service to non-standard ports, and implementing fail2ban or similar dynamic blocking tools will substantially reduce exposure. Regular audits of exposed administrative interfaces and timely patching of SSH daemons remain critical hardening measures against this class of threat.
SE 
IR 
FR 
UA