Severe Risk
IP 207.46.224.84 is a high-risk address with a maximum threat rating of 10/10, extensively documented through 414 abuse reports and linked primarily to sustained SSH brute-force intrusion activity targeting exposed servers. The IP originates from Microsoft's network infrastructure in Singapore, and its activity has been continuously recorded across multiple automated honeypot sensors over a five-month window from October 2025 through February 2026, indicating persistent automated scanning behavior rather than isolated probe attempts.
Analysis of the report corpus reveals 414 total incidents generated by 20 distinct honeypot sensors, with SSH brute-force attacks constituting the dominant threat vector alongside general hacking probes. The activity frequency score of 8/10 and the consistent monthly reporting pattern demonstrate that this address is actively engaged in credential-guessing campaigns against publicly accessible SSH services. The 77% confidence score reflects the clear attack signature observed across multiple independent detection points, leaving little ambiguity about the malicious intent behind the observed traffic. Network attribution to AS8075 (Microsoft's global ASN) is noteworthy because cloud provider infrastructure is frequently abused either through compromised instances or by attackers seeking to mask their origin behind reputable network ranges.
SSH brute-force attacks represent a concrete and immediate threat to any exposed server because successful authentication grants attackers a direct command-line foothold on the target system. Automated attack toolkits typically cycle through common username-password combinations at high velocity, exploiting weak or default credentials to gain unauthorized access. Once inside, adversaries can exfiltrate data, deploy secondary payloads, pivot laterally across internal networks, or enroll compromised hosts into botnets. The scale of activity documented here, with hundreds of attack events logged by honeypot infrastructure, indicates that this IP is part of coordinated scanning operations designed to identify and exploit vulnerable SSH endpoints at internet scale.
Site operators running publicly accessible SSH services should treat this IP and its network range as hostile. Implementing key-based authentication eliminates the credential-guessing attack surface entirely, while tools such as fail2ban can automatically block repeated authentication failures. Disabling root login over SSH, changing the default port, and enforcing strong password policies add layered defenses. Continuous monitoring of authentication logs for unusual source IPs and geographic anomalies, combined with network-level rate limiting on port 22, will significantly reduce exposure to the scanning behavior documented in these reports.
NL 
AU 
JP 
IE 
HK 
CA 
SE 
TR 
FR 
GB 
UA 
MK