Substantial Risk
IP 64.62.156.38 is a high-risk address linked to sustained hacking activity, having generated 491 abuse reports since August 2025 with a threat level rated 8 out of 10 and activity frequency at 8 out of 10, indicating persistent automated scanning behaviour against exposed network services.
The IP is geolocated in the United States and routes through Hurricane Electric's network (AS6939), a major tier-one backbone provider known for carrying diverse internet traffic. Automated honeypot sensors recorded 20 recent reports, all categorizing the activity as general hacking attempts. The detection systems flagged protocol detection anomalies including one-directional protocol-only traffic and bidirectional protocol mismatches, patterns commonly associated with reconnaissance probes and vulnerability scanning tools that send malformed or unexpected network packets to identify misconfigured or exploitable services.
Hacking activity encompasses a broad spectrum of intrusion techniques, including attempts to exploit unpatched vulnerabilities, brute-force authentication attacks, and probing for exposed administrative interfaces. The protocol detection irregularities observed suggest the scanning host is testing network boundaries and service fingerprints rather than conducting targeted exploitation. With 491 total reports logged across an eleven-month window, the consistent report volume demonstrates an automated campaign that systematically surveys network endpoints for potential entry points.
Site operators should treat connections from this address as hostile and implement immediate defensive controls. Deploying authentication hardening measures such as key-based authentication, two-factor authentication, and account lockout policies reduces the risk from credential-guessing attempts. Rate-limiting and automated blocking tools such as fail2ban can effectively neutralise repeated connection attempts without impacting legitimate traffic. Ensuring all systems remain current with security patches, maintaining strict firewall rules, and monitoring intrusion detection alerts for anomalous traffic patterns from this source will further reduce exposure to the scanning behaviour documented in the abuse reports.
GB 
RO 
AU