Maximum Danger
IP 111.61.229.78 is a high-risk address operated by Hebei Mobile Communication Company Limited in China that has generated 1,057 abuse reports between December 2025 and May 2026, with automated honeypot sensors flagging it primarily for SSH brute-force attacks and confirmed exploitation of SSH services.
The IP demonstrates a threat frequency rating of 8 out of 10 and a 70% confidence score based on reports from 20 automated honeypot sources. Suricata alerts specifically document SSH brute-force attempts and confirmed exploitation of SSH services, indicating that this address has been actively leveraged for unauthorized server access rather than merely scanning. The AS24547 network is associated with Hebei Mobile Communication Company Limited, and the sustained volume of reports over a five-month period suggests persistent, automated attack infrastructure originating from this single address.
SSH brute-force attacks represent a critical threat to any publicly exposed server because they systematically attempt to crack authentication through credential guessing, giving attackers a direct pathway to command-line access. When exploitation is confirmed rather than merely attempted, it indicates that an attacker has already successfully compromised a target, enabling data exfiltration, lateral movement within networks, deployment of secondary payloads, or use of the compromised host for further attacks. The pattern observed suggests this IP is actively involved in credential compromise campaigns against SSH services worldwide.
Site operators should immediately block this IP at the firewall or network edge and implement automated rate-limiting using tools such as fail2ban to disrupt brute-force patterns. Enforcing key-based authentication for SSH access, disabling direct root login, and configuring non-standard SSH ports substantially reduces exposure to these attacks. Continuous monitoring of authentication logs and deployment of intrusion detection systems helps identify and respond to attempted access. If any SSH compromise is suspected, immediate forensic investigation and credential rotation are essential.
KR 
GB 
HK