Critical Alert
IP 14.63.196.175, registered to Korea Telecom on the AS4766 network in South Korea, is a critical-risk address that community reports and automated honeypot sensors have flagged with a threat level of 10 out of 10 and a confidence score of 85 percent. The IP has accumulated 318 total abuse reports across 20 independent detection sources since first being reported in November 2025, with the most recent activity logged in June 2026, indicating sustained hostile behavior over approximately seven months. The dominant threat profile centers on SSH brute-force activity, corroborated by multiple Suricata signatures and repeated Fail2ban trigger events recording 25 to 31 violations per instance, alongside additional general hacking probes and indicators suggesting the host itself may be exploited and acting as an unwitting attack platform.
The volume and consistency of reports make it clear that 14.63.196.175 is not a transient or misconfigured endpoint but an active component in an ongoing credential-attack campaign targeting exposed SSH services across the internet. The repeated Fail2ban logs document sustained, high-volume password-guessing sessions, while Suricata alerts confirm that SSH sessions were successfully initiated on expected ports, consistent with automated brute-force tooling establishing footholds in weakly secured servers. The presence of "Exploited Host" categorization alongside the brute-force activity raises the additional concern that this address may represent a previously compromised machine being weaponized by a threat actor rather than a dedicated attack server, meaning the nominal origin could itself be a victim needing remediation.
For operators with SSH services directly accessible from the internet, blocking 14.63.196.175 at the network perimeter is a straightforward and immediately effective first step given the near-unanimous threat consensus. Beyond blocklisting, enforcing key-based authentication exclusively, relocating SSH from its default port, and disabling direct root login eliminate the primary attack surface that this IP is targeting. Deploying or tuning intrusion-prevention tools such as fail2ban to lock out repeated authentication failures within a short window will further degrade the viability of credential-stuffing campaigns originating from this address or others like it. Organizations should also review authentication logs for any successful or near-successful connections from 14.63.196.175, as even a single established session on a weakly configured host could represent a full compromise requiring forensic follow-up.
GB 
RO