Maximum Danger
IP 103.174.114.164 is a critical-risk address operated by PT Cloud Hosting Indonesia in Indonesia (AS136052) that has been repeatedly linked to SSH brute-force attacks, with automated honeypot sensors filing 1061 abuse reports against this single IP over approximately seven months between October 2025 and May 2026.
The substantial abuse volume stems from concentrated automated honeypot detections and community reporting, with 20 separate sensor sources flagging this address. Fail2ban sensors documented multiple violation events across different server instances, while Suricata alerts confirmed active SSH brute-force sessions targeting expected SSH ports. The pattern shows persistent, high-volume credential attacks with a 71% confidence score and a maximum 10/10 threat rating despite only a 4/10 activity frequency, indicating that when this IP is active it targets services with significant intensity.
SSH brute-force attacks represent a concrete and widespread threat to any publicly accessible server running the SSH daemon, with attackers systematically cycling through username and password combinations to gain unauthorized shell access. Successful authentication grants adversaries a foothold on the target system, potentially enabling data exfiltration, malware deployment or use of the compromised host as a stepping stone for further intrusions. The reported "Exploited Host" classification raises the possibility that this address may belong to a compromised Indonesian cloud server being weaponised without its owner's knowledge, though it could equally represent deliberately provisioned attack infrastructure.
Site operators running exposed SSH services should immediately block this IP at the firewall level and consider deploying automated dynamic blocking tools such as fail2ban to respond to repeated authentication failures without manual intervention. Key-based authentication eliminates the password-guessing attack vector entirely, while relocating SSH to a non-standard port reduces automated target discovery. Disabling root login over SSH and enforcing multi-factor authentication provide additional hardening layers. Organisations are encouraged to monitor authentication logs for patterns consistent with the attack signatures detected and to consider notifying PT Cloud Hosting Indonesia given the volume of suspicious traffic originating from their network allocation.
RO 
GB 
JP 
LV 
KR 
TH 
PL