Critical Threat
IP 103.134.154.55 is a critical-risk address operated by Cloud Host Pte Ltd in Singapore that has been linked to sustained SSH brute-force attacks, with 184 abuse reports logged by automated honeypot sensors over approximately six months. The IP carries a threat level of 10/10 and a confidence score of 76%, with the overwhelming majority of recent reports categorizing the activity as SSH-related intrusion attempts. Detection systems across 20 separate honeypot sensors have recorded multiple waves of attack traffic, with firewall and intrusion-detection systems flagging repeated sshd brute-force violations. The combination of high report volume, consistent activity spanning November 2025 through May 2026, and a threat level at the maximum scale makes this address a confirmed danger to any exposed SSH service. This is not an isolated incident or a single scanning probe — the pattern reflects deliberate, automated credential-guessing campaigns targeting Secure Shell endpoints.
The evidence base is substantial and consistent with organized attack infrastructure. Automated honeypot sensors detected 19 SSH-focused reports alongside 3 general hacking intrusion attempts and 2 reports indicating the address may itself function as an exploited host platform. Suricata intrusion-detection systems flagged active SSH sessions on expected ports, confirming that the attacking endpoint maintains persistent connections during its brute-force attempts rather than using simple high-volume flooding. Fail2ban systems recorded multiple sshd violation events, indicating that the SSH service was actively rejecting authentication attempts — the attack was in progress rather than successful on those specific targets. The 2/10 activity frequency suggests the attacking campaigns occur in periodic bursts rather than constant traffic, which is typical of credential-stuffing tools that rotate through wordlists. Cloud Host Pte Ltd operates the AS138608 autonomous system, and while the geographic origin is Singapore, the compromised or rented infrastructure pattern is consistent with bulletproof hosting environments used for attack operations.
ID 
CA 
CH 
UA 
GB