Severe Risk
IP 221.139.88.149 is a critical-risk address originating from South Korea that has been flagged in 168 abuse reports for sustained SSH brute-force attacks and broader intrusion activity, with honeypot sensors confirming repeated exploitation attempts against SSH services. The volume of reporting, maximum threat score and detection across multiple automated sensors collectively paint a picture of persistent credential-attack infrastructure rather than opportunistic scanning.
Network intelligence places this IP within AS9318, operated by SK Broadband Co Ltd in South Korea, with activity documented between February 2026 and May 2026. The 168 total reports break down across three primary categories: SSH brute-force attempts (20 reports), general hacking/intrusion activity (19 reports), and exploited-host behaviour (9 reports). Activity frequency of 8/10 indicates ongoing, sustained offensive operations rather than isolated burst activity, and the 20 distinct honeypot sources confirm distributed detection across sensor networks. The coexistence of exploited-host tags alongside active attack signatures suggests this address may be running attack tooling while simultaneously showing indicators of compromise itself.
SSH brute-force attacks remain one of the most common initial-access vectors for server compromise. Automated tools cycle through username/password combinations against exposed SSH daemons, exploiting weak or default credentials to gain shell access. Once inside, attackers deploy cryptocurrency miners, ransomware, or pivot deeper into networks. The "exploited" designation on several Suricata alerts associated with this IP suggests that whatever SSH service it contacted was itself already compromised, indicating either a chained botnet node or a compromised residential connection being weaponised without the owner's knowledge.
Site operators exposing SSH to the internet should immediately block this IP at the firewall level and implement key-based authentication to eliminate password-based login entirely. Adjusting the default SSH port reduces automated scanning exposure, while tools such as fail2ban can dynamically ban repeat offenders after a configurable violation threshold. Enabling intrusion-detection monitoring and reviewing authentication logs for any matching attempts during the February–May 2026 window will help determine whether any probing succeeded.
BG 
FR 
LU 
LK 
AU 
GB 
JP