Extreme Threat
IP 85.11.183.27 is a critical-risk address operated by PebbleHost Ltd in the United Kingdom (ASN AS212027) that has been linked to 793 reported hacking incidents detected by automated honeypot sensors between February and May 2026. With a threat level of 10/10 and a confidence score of 94%, this IP represents a significant and persistent threat to exposed network services worldwide.
The volume and consistency of malicious activity associated with 85.11.183.27 are substantial. All 20 most recent reports uniformly categorize the activity as hacking, with the IP generating reports across a four-month window at a frequency rating of 8/10. Detection came exclusively from automated honeypot sensors, which identified connection attempts consistent with intrusion and exploitation behaviour. The IP's assignment to PebbleHost Ltd, a hosting provider, suggests the address may be part of a larger infrastructure used to distribute automated attack tools rather than a single-purpose malicious endpoint.
The specific attack patterns observed include anomalous TLS record types flagged by Suricata intrusion detection rules. Invalid TLS record types are a common indicator of reconnaissance probes, malformed packet injection attempts, or attempts to trigger vulnerabilities in TLS implementation stacks. Combined with general hacking classification, this suggests 85.11.183.27 is conducting systematic vulnerability scanning and exploitation attempts against target systems, potentially searching for unpatched services or misconfigured endpoints that accept unexpected input.
Network defenders should treat connection attempts from 85.11.183.27 as hostile and block the address at the firewall or network edge. Implementing rate-limiting on authentication endpoints and using tools such as fail2ban or equivalent threat-response automation can mitigate brute-force and scanning activity. Ensuring all systems receive timely patches, disabling unnecessary services, and deploying intrusion detection signatures capable of identifying anomalous TLS traffic will reduce exposure to the exploitation vectors this IP attempts to leverage.
RO 
FR 
SE 
TR