Critical Alert
IP address 170.254.229.191, registered to Media Commerce Partners S.A in Colombia (ASN AS27951), presents a maximum threat level of 10/10 based on 1,163 abuse reports spanning October 2025 through May 2026. This address has been consistently flagged by automated honeypot sensors as a prolific source of SSH brute-force attacks, with a threat confidence score of 73% indicating substantial corroboration across multiple detection points. The volume and persistence of malicious activity from this IP warrant immediate blocking by any organization exposing SSH services to the internet.
Detection data collected over approximately seven months reveals sustained, automated attack behaviour originating from this Colombian IP address. All 1,163 reports attribute the activity to SSH-related threats, with honeypot sensors consistently documenting repeated authentication guessing attempts. The attack pattern logs indicate dozens of violations per monitored instance, suggesting an aggressive, high-volume scanning and brute-forcing campaign rather than isolated probing. The network operator, Media Commerce Partners S.A, has not implemented effective remediation despite prolonged abuse reporting, leaving the infrastructure responsible for continuous internet-wide SSH exploitation attempts.
SSH brute-force attacks represent one of the most common initial-access vectors in server compromise campaigns. Threat actors leverage automated tools to cycle through credential combinations against publicly accessible SSH daemons, exploiting weak or default passwords to gain unauthorized shell access. Once inside, attackers typically deploy backdoors, cryptocurrency miners or use compromised servers as launchpads for further intrusions. The concentrated, repetitive nature of the observed traffic confirms a deliberate, systematic effort to identify vulnerable SSH endpoints across the internet rather than random opportunistic scanning.
Organizations with exposed SSH services should block 170.254.229.191 at the network perimeter immediately and monitor logs for any matching connection attempts. Enforcing key-based authentication exclusively, moving SSH to a non-standard port, and implementing automated threat-response tools such as fail2ban will substantially reduce exposure to similar brute-force campaigns. Regular audits of authentication logs and the adoption of rate-limiting on SSH connection attempts provide additional layers of defence against credential-guessing attacks originating from high-risk IP addresses like this one.
UA 
GB 
CA 
VN