Critical Alert
IP 212.72.14.244 is a maximum-threat-level address associated with 1,270 incident reports that indicate it is functioning both as an exploited compromise and an active attack platform conducting SSH brute-force operations against remote services. Originating from Oman and operating within the Oman Telecommunications Company (S.A.O.G) network (ASN AS28885), this IP has been flagged across 20 automated honeypot sensors between January and April 2026, with recent activity concentrated in SSH-related intrusion categories.
The report volume of 1,270 incidents across a four-month window underscores sustained malicious intent, while the activity frequency rating of zero suggests burst-pattern behaviour rather than constant bombardment. Among the most recent reports, Hacking activity accounts for 13 incidents, SSH brute-force attempts comprise 12, and three separate Exploited Host designations confirm the system itself has been compromised and is being leveraged without the operator's knowledge. The detection footprint spans multiple automated honeypot sensors, indicating the IP has been observed attacking diverse infrastructure rather than a single target.
The combination of SSH brute-force activity with confirmed Exploited Host status is particularly concerning. This IP appears to be running an SSH service that has itself been compromised, turning the host into an automated attack platform capable of launching credential-guessing campaigns against external servers. Attack-pattern analysis shows repeated SSH session initiations and brute-force attempts, consistent with automated tools designed to compromise SSH daemons through dictionary-based password attacks or the exploitation of vulnerable SSH configurations. For any organization running exposed SSH services, this IP represents both a direct attack vector and evidence of a compromised system being weaponized at scale.
Site operators should immediately block IP 212.72.14.244 at the firewall or network perimeter, and consider implementing key-based authentication for SSH access while disabling root login to eliminate the primary credential-guessing target. Deploying automated dynamic blocking tools such as fail2ban can detect and quarantine repeated authentication failures in real time. Changing the default SSH listening port reduces the surface area for automated scanning campaigns. Organizations with SSH services exposed to the internet should also audit access logs for any authentication attempts originating from this address and review authentication failure thresholds as part of a broader hardening strategy.
SC 
RO 
HK