Maximum Danger
IP 163.7.8.178 is a high-risk address originating from Indonesia with a threat level of 10/10, assessed with 94% confidence, and has accumulated 162 total abuse reports from automated honeypot sensors within a three-month window between March and May 2026.
The address resolves to Byteplus Pte. Ltd. operating autonomous system AS150436 and has demonstrated sustained malicious activity at a frequency rated 8/10. Detection data from twenty distinct honeypot sensors reveals a primary focus on SSH-related intrusion, with Suricata alerts confirming active SSH sessions in progress alongside documented brute-force authentication attempts against expected SSH ports. The report distribution spans Hacking (19 reports), SSH (12 reports), and Exploited Host (3 reports), indicating this IP is actively conducting credential-guessing campaigns against exposed SSH services while also exhibiting patterns consistent with a compromised or maliciously operated host within the Byteplus network.
SSH brute-force attacks represent a significant threat to any internet-exposed Linux or Unix servers listening on the default SSH port. Attackers systematically attempt common username/password combinations to gain unauthorized shell access, potentially achieving full system compromise, data exfiltration, or recruitment into botnets. The Suricata signatures indicating an active SSH session in progress combined with brute-force attempt reports suggest this IP is persistently probing target systems until access is obtained, making immediate blocking essential for any organization running accessible SSH endpoints.
Site operators should block 163.7.8.178 at the network perimeter immediately and implement fail2ban or equivalent intrusion-prevention tools to automatically ban repeated authentication failures. Hardening SSH configurations by disabling root login, enforcing key-based authentication over passwords, and changing the default port will substantially reduce exposure. Continuous monitoring of authentication logs for source IP 163.7.8.178 and regular review of honeypot abuse feeds will help maintain situational awareness regarding this persistent threat actor within the Byteplus AS150436 network.
SG 
HK 
RO 
AM