Elevated Risk
IP 65.49.1.152 is a high-risk address operating from a Hurricane Electric autonomous system in the United States, with 500 documented abuse reports spanning August 2025 through June 2026 and a dominant threat profile centered on hacking activity.
The IP has accumulated 500 reports with an activity frequency rating of 8 out of 10 and an 86 percent confidence score, indicating sustained and consistent malicious behavior over an approximately eleven-month observation window. All 20 recent threat-category reports specifically attribute the activity to hacking, including intrusion attempts, exploitation of vulnerabilities, and unauthorized access attempts. Detection data originates exclusively from automated honeypot sensors distributed across multiple networks, which flagged repeated connection attempts carrying exploit payloads or scanning signatures. The IP's placement within AS6939, operated by Hurricane Electric, places it within one of the largest Internet backbone providers in North America, suggesting the address likely originates from a compromised host or exit node rather than a legitimate business endpoint.
Hacking activity of this volume and persistence represents a concrete threat to any exposed service. Automated tools commonly associated with this IP likely conduct systematic reconnaissance and exploitation attempts against SSH, Telnet, HTTP interfaces, and other services configured with default or weak credentials. The sustained activity frequency indicates the address is part of an active scanning or compromise campaign rather than opportunistic noise. Organizations with publicly accessible interfaces face risk of unauthorized access, data exfiltration, or malware deployment if these attempts succeed.
Site operators should immediately block or rate-limit connections from this IP at the firewall or network edge. Deploying fail2ban, crowdsec, or similar dynamic blocking tools can automate this process based on login failure thresholds. All exposed services should enforce strong, unique credentials and disable unused administrative protocols. Implementing strict IP allowlisting where feasible, combined with continuous monitoring of authentication logs for brute-force patterns, will reduce the attack surface significantly.
GB 
RO 
AU