Critical Alert
IP 5.187.35.21 is a critical-risk address operated by Amarutu Technology Ltd and linked to 156 confirmed abuse reports from automated honeypot sensors across the Netherlands, with hacking intrusion attempts and web application probing accounting for the majority of detected hostile activity between October and December 2025.
The reporting window spans three months, during which 20 distinct honeypot sensors registered events attributed to this address, yielding a threat level of 10 out of 10 and a confidence score of 74 percent. The distribution of threat categories reveals a clear focus on general hacking intrusion activity (17 confirmed instances) supplemented by targeted web application attacks (3 confirmed instances). The network operator, Amarutu Technology Ltd, operates AS206264 infrastructure within Dutch jurisdiction, a hosting environment frequently associated with transient malicious infrastructure due to its accommodating abuse posture. The near-zero activity frequency metric suggests a lull in recent propagation, though the substantial cumulative report volume indicates an established history of hostile scanning and exploitation attempts rather than isolated opportunistic traffic.
The dominant hacking category encompasses automated vulnerability scanning, credential guessing, and exploitation of known software weaknesses across exposed services. Web application attacks detected from this source specifically probe forOWASP Top 10 exposures such as remote file inclusion, cross-site scripting vectors, and configuration weaknesses that could yield unauthorized access to application layers. Combined, these techniques enable adversaries to progress from initial reconnaissance to full system compromise without requiring manual intervention, making even brief exposure to this IP a meaningful security event for unhardened targets.
Network defenders should immediately block or rate-limit traffic originating from this address at the firewall or load-balancer level, particularly onSSH, RDP, HTTP and HTTPS entry points. Implementing fail2ban or equivalent dynamic blockade tools on authentication endpoints reduces the effectiveness of brute-force campaigns. Deploying a web application firewall signature set tuned to the observed probe patterns adds a protective layer, and disabling unnecessary services while enforcing strong authentication policies on exposed interfaces limits the attack surface available to this scanning infrastructure.
SC 
BG 
UA 
RO 
SE 
HK 
FR