Severe Risk
IP 176.65.149.212 is a critical-risk address linked to sustained SSH intrusion activity originating from Netherlands-based hosting infrastructure, with 3,936 abuse reports logged across a six-month window. The address presents a maximum threat rating of 10/10 and demonstrates consistent hostile behavior at an 8/10 frequency level, placing it among the most actively hostile sources observable in public threat-feeds.
Automated honeypot sensors across multiple detection points have tracked 176.65.149.212 for six months, from December 2025 through June 2026, with a concentrated cluster of 20 recent hacking-classified reports. All recent threat categorizations converge on unauthorized access attempts, specifically targeting SSH services. Forensic analysis reveals a Suricata signature detecting anomalous SSH communication on non-standard ports, complemented by generic connection attempts. The Netherlands network segment (AS51396, operated by Pfcloud UG) suggests involvement of cloud or hosting infrastructure.
SSH brute-force and credential-stuffing campaigns pose significant risk to exposed services. The detected SSH session on an unusual port indicates this actor is probing for misconfigured deployments that deviate from standard port 22, seeking targets with weaker monitoring. With 92% confidence in malicious classification and persistent scanning behavior, this IP demonstrates deliberate, automated targeting of authentication mechanisms. Sustained activity spanning six months suggests either dedicated infrastructure or an actor cycling through compromised endpoints to maintain operational continuity.
Site operators should immediately block 176.65.149.212 at the network perimeter and monitor for additional hostile addresses originating from AS51396. Deploying fail2ban or equivalent tooling to dynamically update firewall rules based on failed authentication attempts provides automated defense. Enforcing key-based authentication, disabling password-based SSH login entirely, and restricting root access substantially reduces the attack surface. Continuous monitoring of authentication logs for this IP address enables rapid detection of ongoing reconnaissance or intrusion attempts.
SE 
IR 
FR 
UA