Critical Alert
IP 203.228.30.198, registered to Korea Telecom's network in South Korea, presents a severe threat level of 10/10 based on 358 abuse reports logged between September 2025 and June 2026. This address has been flagged across 20 automated honeypot sensors with an activity frequency rated at 6 out of 10, indicating sustained and persistent malicious behaviour over an extended nine-month period.
The overwhelming majority of detections centre on SSH brute-force attack activity, which accounts for the vast proportion of the 358 total reports. Sensor logs document repeated fail2ban triggers against sshd services, with violation counts ranging from 25 to 37 per incident, alongside Suricata alerts noting active SSH sessions established on expected default ports. The presence of exploited-host and general hacking categories alongside the dominant SSH pattern suggests this address may be operating compromised infrastructure being leveraged as an automated attack platform, rather than a single attacker manually conducting probes.
SSH brute-force attacks pose a concrete and immediate risk to any exposed server listening on port 22 or commonly used alternative ports. Attackers systematically attempt credential combinations against these endpoints, and successful authentication grants full shell access to the underlying system. Once compromised, servers can be weaponised for further intrusion campaigns, data exfiltration, cryptomining, or inclusion in botnets, creating cascading risk across interconnected infrastructure. The sustained frequency of activity from 203.228.30.198 indicates it is almost certainly part of an automated scanning and exploitation campaign rather than opportunistic probing.
Operators should block 203.228.30.198 at the firewall level and implement fail2ban to automatically ban repeated SSH authentication failures. Enforcing key-based authentication exclusively, disabling root login, and moving SSH to a non-standard port significantly reduces exposure. Keeping systems patched and monitoring for unusual SSH session activity on expected ports will further harden defences against this class of threat.
UA 
BD