Maximum Danger
IP 176.65.149.64 is a critical-risk address linked to 5,920 abuse reports and sustained hacking activity originating from the Pfcloud UG network (AS51396) in the Netherlands, representing one of the most hostile IP addresses documented in public threat-intelligence feeds. With a threat level of 10 out of 10 and an activity frequency rating of 8 out of 10, this address has demonstrated consistent malicious behavior spanning approximately one year, from August 2025 through July 2026.
Automated honeypot sensors generated all 20 report sources documenting this address, revealing a high-volume campaign of connection attempts consistent with unauthorized access probing. The Pfcloud UG autonomous system is the registered network operator, and the geographic origin traces to the Netherlands, a jurisdiction frequently associated with both bulletproof hosting services and legitimate cloud infrastructure that threat actors occasionally abuse. The sustained report volume over twelve months indicates persistent infrastructure rather than a transiently compromised host, suggesting the IP is deliberately allocated to ongoing malicious operations.
The dominant threat category of hacking encompasses intrusion attempts, vulnerability exploitation, and unauthorized access campaigns. Detected attack patterns include attempts to establish SSH sessions on non-standard ports, a technique designed to evade security controls that rely solely on monitoring default service ports. This behavior indicates the operator is actively probing for exposed SSH services to brute-force credentials or exploit authentication weaknesses, posing a concrete risk to any internet-facing Linux or network management infrastructure with default SSH configurations.
Site operators should immediately block or aggressively rate-limit traffic from this IP at the network perimeter firewall. Implementing fail2ban or equivalent dynamic blocking tools will automate the response to repeated authentication failures. SSH services should be hardened by enforcing key-based authentication, disabling password-based login entirely, and configuring monitoring rules to alert on any SSH traffic traversing non-standard ports. Regular review of authentication logs for source IP 176.65.149.64 will help identify any successful or attempted breaches.
SE 
IR 
BG 
GB 
RO