Significant Threat
IP 18.116.101.220 is a high-risk address operating from Amazon's infrastructure (AS16509, AMAZON-02) in the United States, with a threat level of 8/10 and a confidence score of 89% based on 2732 total reports filed across automated honeypot sensors between February and July 2026. The dominant threat category is general hacking activity, which accounts for the overwhelming majority of recent reports, indicating sustained, high-volume intrusion attempts originating from or passing through this IP address.
The volume and consistency of reports over this six-month period are particularly noteworthy. This IP has been flagged 2732 times, with an activity frequency rating of 8/10, suggesting continuous rather than opportunistic malicious engagement. Detection systems recorded multiple attack patterns associated with this address, including protocol anomalies detected by intrusion-analysis tools, Redis-targeted attack vectors, and scanning activity using recognized reconnaissance tools. The presence of exploited-host and IoT-targeted classifications alongside the primary hacking reports indicates this IP may simultaneously serve as both an attack platform and a potential vector for propagating malicious activity to poorly secured connected devices.
The hacking activity attributed to this IP represents a concrete risk to any exposed service accepting connections from the broader internet. The detected attack patterns suggest automated exploitation attempts against misconfigured or vulnerable services, with specific targeting of Redis deployments indicating interest in database compromise or lateral movement. The port-scan activity confirms active reconnaissance, during which the address systematically probes external infrastructure for open attack surfaces before deploying additional payloads. For organizations with internet-facing services, this IP represents a known source of hostile probing that could precede credential compromise, data exfiltration, or system takeover.
Site operators should block this IP at the network perimeter using firewall rules or intrusion-prevention systems capable of automated blocking based on threat-intelligence feeds. Any exposed Redis instances should be secured with strong authentication, TLS encryption, and binding to localhost interfaces only. Implementing fail2ban or equivalent log-analysis tools can automatically detect and respond to brute-force patterns. Regular monitoring of connection logs for this IP address and similar sources will help identify ongoing targeting and allow timely defensive response.
IL 
ZA 
JP 
IE 
GB 
SE 
UA 
SC