High Risk
IP 18.218.118.203, an Amazon-02 (AS16509) address hosted in the United States, is a high-risk threat actor with a threat level of 8/10 and a confidence score of 96%, amassing 1,949 abuse reports across automated honeypot sensors between February and May 2026. The dominant activity involves active hacking attempts and reconnaissance probes, indicating sustained, deliberate hostile operations rather than incidental scanning.
The report volume of nearly two thousand detections across a four-month window, sourced from twenty distinct honeypot sensors, underscores a persistent campaign. The pattern of reported activity includes CiscoASA port scan probes, TLS invalid-record-type anomalies suggesting protocol-level manipulation, and explicit malware or exploit-related connection attempts. While the overwhelming majority of recent categorizations are Hacking-related, the presence of Exploited Host and Port Scan classifications confirms this address engages in multi-vector reconnaissance and attack execution, consistent with an automated attack infrastructure or a compromised host being used as a launch platform.
Hacking activity of this intensity poses a direct risk to any exposed service. Port scanning serves as reconnaissance to map open services and identify vulnerable entry points, while the associated exploit and malware activity patterns suggest the actor is attempting to leverage those vectors for unauthorized access or payload delivery. An address with this reputation, generating multiple daily connections across numerous target sensors, signals an active scanner or bot participating in broad-scale exploitation campaigns.
Site operators should block or heavily rate-limit traffic from this IP at the firewall level and monitor logs for any matching connection patterns. Enforcing strong authentication on exposed services, deploying tools such as fail2ban to automatically block repeated login attempts, and ensuring all software is patched against known vulnerabilities will reduce the attack surface. Organizations receiving connections from this address should treat them as hostile and investigate any associated compromise indicators promptly.
ZA 
IE 
GB