Notable Threat
IP 64.23.214.73 is a high-risk address with a threat level of 8/10 that has generated 6,793 abuse reports from automated honeypot sensors, indicating sustained malicious activity originating from a DigitalOcean-hosted network in the United States.
The IP, operating through AS14061 (DigitalOcean-ASN), was first reported in September 2025 and most recently reported in June 2026, representing approximately nine months of continuous hostile activity. With an activity frequency rating of 8/10 and an 86% confidence score, this address has been flagged across 20 separate honeypot sensor installations. The dominant threat categories are Hacking activity (19 recent reports) and Exploited Host designation (1 recent report), with detected attack patterns including unauthorized connection attempts and malware or exploit delivery.
Hacking activity indicates that this IP has been actively conducting intrusion attempts, scanning for vulnerabilities, and attempting to exploit weaknesses in exposed services, while the Exploited Host classification suggests the address itself may belong to a compromised system being weaponized without its owner's knowledge. The combination of these threat categories, paired with the high volume of reports and consistent activity over nine months, points to a persistent and automated threat actor leveraging this infrastructure for malicious purposes. Attackers frequently repurpose compromised cloud-hosted servers as launchpads for secondary attacks precisely because they offer stable uptime and flexible network egress.
Site operators should block IP 64.23.214.73 at the firewall or network edge immediately, particularly on services exposed to the public internet. Implementing rate-limiting on authentication endpoints and enforcing strong credential policies will reduce the effectiveness of any intrusion attempts that do reach live systems. Deploying fail2ban or equivalent dynamic blocklist tools can automate the blocking process based on repeated hostile patterns. Organizations should also monitor for any inbound connections from this address in network logs and consider notifying DigitalOcean's abuse team given the Exploited Host classification, as the legitimate operator may be unaware their infrastructure is being misused for malicious activity.
NL 
GB 
RO 
PL