Severe Risk
IP 103.181.143.216, registered in Indonesia and operated by PT Cloud Hosting Indonesia under ASN AS136052, represents a critical threat asset with a maximum threat level rating of 10 out of 10. This address has accumulated 494 abuse reports from twenty separate automated honeypot sensors over approximately seven months between October 2025 and May 2026, with the overwhelming majority of detections specifically documenting SSH brute-force activity. Despite a relatively low activity frequency score of 2 out of 10, the sheer volume of reported incidents combined with confirmed exploited-host status elevates this IP to an immediate blocking priority for any organisation exposing Secure Shell services to the internet.
The detection data reveals a sustained and systematic campaign of automated credential-attack activity originating from this address. Sensors documented repeated Fail2ban trigger events indicating tens of violation events per detection cycle, alongside Suricata alerts flagging active SSH sessions on expected ports and explicit ssh brute-force signatures. While the activity frequency remains modest, the consistency of these reports spanning multiple months demonstrates persistent rather than opportunistic behaviour. The geographic origin in Indonesia places this IP within a region that security teams frequently flag for inbound attack traffic, and the hosting-provider context suggests this address may belong to either a dedicated attack infrastructure node or a compromised system being weaponised without the owner's awareness.
SSH brute-force attacks remain one of the most prevalent initial-access vectors in internet-facing environments, with automated tooling capable of cycling through thousands of credential combinations per hour. When successful, such attacks grant attackers persistent command-line access to servers, enabling data exfiltration, malware deployment, lateral movement through internal networks, and long-term persistent compromise. The confirmed exploited-host classification for IP 103.181.143.216 indicates that security systems have positively identified this address as operating under hostile control, meaning legitimate services or endpoints may have already been compromised and are now participating in further attacks against other targets across the internet.
KR 
GB 
HK