Critical Threat
IP 36.104.144.114 is a high-risk address originating from Chinanet (AS4134) in China that has been extensively linked to SSH brute-force attacks, with a threat level of 10/10 and 874 total abuse reports across 20 automated honeypot sensors. This IP was first reported in October 2025 and remained active through May 2026, demonstrating persistent scanning behaviour over approximately seven months with an activity frequency rated 8/10. The combination of maximum threat scoring, heavy reporting volume, and consistent detection across multiple sensor types makes this address a clear candidate for immediate blocking at the network perimeter.
Analysis of honeypot logs reveals that the dominant threat pattern involves repeated SSH brute-force attempts, with multiple fail2ban sensors recording violations ranging from 10 to 25 per instance. Suricata intrusion detection systems flagged active SSH sessions in progress on expected ports alongside TCP checksum anomalies, suggesting automated tooling configured to conduct credential stuffing against exposed SSH services. The activity frequency score of 8/10, combined with reports spanning from October 2025 through May 2026, indicates sustained, high-volume attack operations rather than isolated scanning. The geographic origin through Chinanet's large-scale broadband infrastructure places this IP within one of the world's largest ISP networks, consistent with scanning activity that typically originates from compromised residential or commercial endpoints.
SSH brute-force attacks represent one of the most common initial access vectors for threat actors seeking to compromise servers and deploy further payloads such as cryptocurrency miners, ransomware or data exfiltration tools. The detected activity pattern — automated password guessing against port 22 — targets any exposed SSH daemon, particularly those retaining default configurations or weak credentials. Successful authentication grants attackers root-level control, enabling lateral movement within a network, data theft, or conversion of the compromised host into a secondary attack platform. The "Exploited Host" classification in recent reports further suggests this address may itself be operating from a previously compromised system, compounding the risk profile.
HK 
FR 
SE