Critical Threat
IP 176.65.149.220 is a critical-risk address operated by Pfcloud UG (AS51396) in the Netherlands, assessed at a threat level of 10/10 following 4,374 abuse reports from automated honeypot sensors over approximately ten months of sustained malicious activity. The IP demonstrates an activity frequency rating of 8/10, indicating near-continuous hostile operations since August 2025, with its most recent confirmed hostile contact recorded in June 2026.
The volume of reports — 4,374 from 20 separate honeypot sensors — and the 90% confidence score establish this as one of the most persistently active hostile addresses currently circulating in public threat feeds. All reported threat categorizations fall under general hacking activity, specifically involving unauthorized access attempts and intrusion operations. The network block is allocated to Pfcloud UG, a hosting provider whose infrastructure is frequently abused for hostile scanning and exploitation campaigns. The Netherlands routing provides geographic cover while masking the ultimate origin of the operator. Suricata IDS signatures specifically flagging SSH sessions on unusual ports indicate the address is being used for covert command-and-control style communication or stealthy brute-force authentication attempts rather than loud, opportunistic scanning.
SSH on non-standard ports is a well-documented technique used by threat actors to evade basic network monitoring and firewall rules that only allow traffic on port 22. This pattern strongly suggests the address is either part of a botnet node performing distributed authentication attacks against exposed SSH services, or is being used as a stepping stone for lateral movement after initial compromise. The sustained 10-month activity window indicates persistent, automated operations rather than opportunistic probes.
Network defenders should immediately block this address at the perimeter firewall and implement fail2ban or similar dynamic blocking tools to auto-blacklist repeated SSH authentication failures. All SSH services should be restricted to key-based authentication, non-standard ports should be avoided as the sole security measure, and rate-limiting should be applied to authentication endpoints. Continuous monitoring for inbound connections from this address and related infrastructure in the same ASN block is strongly advised.
SE 
IR 
FR 
UA