Extreme Threat
IP 102.218.89.110 is a critical-risk address originating from Uganda that has been linked to sustained SSH brute-force attacks, with automated honeypot sensors recording 956 reports across 20 detection points since December 2025, indicating an ongoing and persistent threat to exposed SSH services worldwide.
The IP, operating under ASN AS328939 managed by SIL6-AS, demonstrates an activity frequency rating of 8 out of 10 and a threat level of 10 out of 10, placing it among the highest-risk entries in threat-intelligence databases. The dominant threat category is SSH-based intrusion activity, accounting for 19 of the most recent reports, while secondary categories include general hacking attempts (8 reports) and exploitation indicators (4 reports). Honeypot telemetry reveals repeated SSH brute-force attempts, SSH command execution activity, and multiple Suricata alerts confirming active SSH sessions on expected ports. Fail2ban logs specifically document 25 to 26 violations per detection instance across multiple intervals, demonstrating consistent and high-volume credential-guessing campaigns targeting SSH daemons.
SSH brute-force attacks represent one of the most common initial-access vectors in network intrusions, where threat actors systematically attempt username and password combinations to compromise servers running exposed SSH daemons. The volume and persistence of activity detected from this address suggest an automated attack infrastructure rather than opportunistic scanning, likely leveraging dictionary-based or leaked-credential lists to maximise success probability. When combined with the "exploited host" classification, this pattern indicates the IP may belong to a compromised system being weaponised by threat actors without the owner's knowledge, amplifying the risk that blocking alone may prove insufficient without provider-level intervention.
Site operators running exposed SSH services should immediately block this IP at the firewall or network edge, implement fail2ban or equivalent intrusion-prevention tools to dynamically ban repeat offenders, and enforce key-based authentication while disabling root login and changing the default port. Regular monitoring of authentication logs for unusual patterns, combined with rate-limiting on SSH connection attempts, will substantially reduce exposure to brute-force campaigns originating from this or similar addresses.
KR 
UA 
RO 
MX 
FR 
CA