Elevated Risk
IP 143.198.150.150, a DigitalOcean-hosted address in the United States (ASN AS14061), presents a high-risk threat profile with a threat level of 8 out of 10 and a confidence score of 85 percent. This IP has accumulated 7,850 abuse reports sourced from 20 automated honeypot sensors, indicating sustained, high-frequency malicious activity spanning approximately nine months between September 2025 and June 2026.
The detection data reveals persistent and aggressive intrusion-oriented behavior. All 7,850 reports attribute the activity to general hacking categories, encompassing various unauthorized access attempts and vulnerability exploitation patterns. The high report volume relative to the number of detection sources (averaging roughly 392 reports per sensor) suggests this address is engaged in systematic, automated scanning or exploitation campaigns rather than opportunistic or transient malicious traffic. As a cloud-hosted DigitalOcean IP, this address may represent a compromised cloud instance repurposed for hostile activity, a bootstrapped attack platform, or an attacker operating from within the DigitalOcean infrastructure.
General hacking activity as documented in these reports includes diverse intrusion methodologies such as credential guessing, vulnerability probing, and exploitation attempt patterns against exposed services. For organizations running publicly accessible services such as SSH, RDP, web applications, or administrative interfaces, this type of activity represents a concrete risk of unauthorized access, data exfiltration, or further lateral movement within a compromised network. The sustained frequency of reports indicates the source remains active and continues its scanning operations.
Site operators should implement immediate defensive measures. Deploying intrusion prevention tools such as fail2ban or similar rate-limiting utilities can automatically block repeated connection attempts from this address. Enforcing strong, unique credentials and disabling default or administrative accounts on exposed services significantly reduces the effectiveness of credential-based attacks. Maintaining current patches and hardening configurations for all internet-facing services limits exploitability. Organizations should also monitor logs for connection patterns associated with the reported activity and consider blocking DigitalOcean address ranges at the network perimeter if cloud-hosted infrastructure is not part of their legitimate operations.
NL 
GB 
CA 
RO