Significant Threat
IP 64.62.156.132, allocated to Hurricane Electric (AS6939) in the United States, presents a high-risk threat profile with a threat level of 8/10 and an 86% confidence score, supported by 476 abuse reports from 20 automated honeypot sensors. This address has been actively monitored since August 2025 with its most recent reports extending through June 2026, indicating persistent malicious behavior over a sustained period. The dominant activity involves systematic hacking attempts, specifically targeting IoT infrastructure and exploiting vulnerable services, making this one of the more consistently problematic addresses documented in recent threat intelligence feeds.
The evidence base for this assessment draws from multiple independent detection systems operated as honeypot sensors across diverse network segments, collectively generating 476 reports with an activity frequency rating of 8/10. Reported threat categories break down as follows: Hacking (18 recent reports), IoT Targeted (1 report), and Exploited Host (1 report). The attack-pattern telemetry associated with this address includes connection attempts against IoT and industrial control systems, exploitation attempts against Redis services, and TLS protocol anomalies flagged by detection rules monitoring for invalid record types. This combination of vectors suggests a sophisticated actor leveraging multiple attack methodologies rather than relying on a single exploitation technique.
The predominance of hacking activity linked to this IP represents a concrete threat to any exposed service accepting external connections. Specifically, the IoT-targeted component indicates attempts to compromise smart devices, routers, and networked sensors that often lack robust security controls, while the Redis exploitation attempts target a widely-deployed in-memory database that frequently runs with elevated privileges. The detection of TLS protocol anomalies further suggests this address may be involved in traffic manipulation or reconnaissance activities designed to identify vulnerable configurations. Organizations running unpatched or misconfigured services directly exposed to the internet face the highest risk from this threat actor's methodology.
RO 
PL