High Risk
IP 137.184.190.194 is a high-risk address operating from DIGITALOCEAN-ASN infrastructure in the United States, with a threat level of 8/10 based on 2785 reported incidents logged between September 2025 and June 2026. This IP presents a significant danger due to sustained, high-frequency hacking activity combined with deliberate targeting of internet-of-things infrastructure, suggesting an organized campaign rather than opportunistic scanning.
Analysis of the 2785 reports, sourced from 20 automated honeypot sensors distributed across multiple networks, reveals a pronounced pattern of intrusion activity. The majority of recent threat reports (17 instances) classify the behavior under general hacking categories, including exploitation attempts and unauthorized access probes. An additional 3 recent reports document explicit IoT-targeted activity. The detected attack patterns include connection attempts, IoT/ICS targeting, and notably, encrypted SSH session establishment on non-standard ports — a technique commonly employed to maintain persistent access while evading basic network monitoring. With an activity frequency rated 8/10 and a confidence score of 79%, the volume and consistency of these reports strongly corroborate malicious intent.
The dominant threat category — hacking activity with IoT targeting — indicates a dual-purpose operation. Intrusion attempts against exposed services can lead to unauthorized system access, data exfiltration, or deployment of secondary payloads. Simultaneously, targeting IoT and connected devices exploits known weaknesses in smart infrastructure, including unpatched firmware, default credentials, and misconfigured network services. The detection of SSH sessions on unexpected ports further suggests this actor may be establishing command-and-control channels or exfiltrating data from compromised endpoints while appearing to conduct legitimate remote administration.
Network defenders should immediately block 137.184.190.194 at the firewall level and monitor outbound traffic for any beaconing patterns. Hardening SSH configurations — enforcing key-based authentication, restricting cipher suites, and monitoring for sessions on non-standard ports — significantly reduces exposure. Implementing fail2ban or similar dynamic blocking tools on exposed services adds an automated defensive layer. Organizations with IoT deployments should enforce network segmentation, replace default credentials, and maintain firmware update cycles to limit the attack surface this actor seeks to exploit.
NL 
GB