Elevated Risk
IP 137.184.95.216 is a high-risk address operating from DigitalOcean's infrastructure in the United States that has been linked to sustained hacking activity, generating 2,123 abuse reports across automated honeypot sensors over approximately nine months. With a threat level of 8 out of 10 and an activity frequency rated 8 out of 10, this IP represents a persistent intrusion threat that site operators should treat with considerable caution.
The volume of reports filed against 137.184.95.216 is notably elevated for a single attacking address, with 20 distinct hacking incidents formally logged against this DigitalOcean ASN 14061 endpoint. Detection sensors captured "attack connection" attempts alongside Suricata alerts indicating protocol mismatch anomalies, a technique frequently employed to probe firewall rules, identify exposed services, or trigger errors in intrusion-detection systems. The consistent reporting from September 2025 through June 2026 demonstrates that this IP has maintained its hostile scanning behaviour over an extended operational window, suggesting either deliberate sustained targeting or an automated campaign that continues to cycle through reconnaissance routines.
The protocol mismatch technique observed in the detection logs is a recognised reconnaissance method where an attacker sends packets claiming to use one application-layer protocol while transport characteristics suggest another. This approach can reveal whether a target is running services that are ostensibly firewalled, expose the presence of load balancers or reverse proxies, or trigger signature-based detection systems into revealing their rule configurations. When combined with general hacking activity, this pattern indicates an adversary engaged in service enumeration and vulnerability mapping rather than opportunistic noise.
Operators maintaining publicly accessible services should implement rate-limiting on authentication endpoints, enforce certificate-based or multi-factor authentication for remote access, and ensure intrusion-detection rules are updated to flag protocol anomalies originating from single source addresses. Blocking or challenge-stepping traffic from AS14061 ranges with elevated abuse histories provides an additional defensive layer without relying solely on IP blacklisting.
NL 
GB 
HK 
RO 
IT