Maximum Danger
IP 103.59.95.177 is a critical-risk address operated from Indonesia under AS136052 (PT Cloud Hosting Indonesia) that has generated 194 abuse reports with a 98% confidence score, indicating with near certainty that this host is engaged in persistent SSH brute-force attacks targeting servers worldwide. The volume of hostile activity and threat level of 10/10 make this one of the most actively malicious IPs currently circulating in threat-intelligence feeds.
Detection across 20 automated honeypot sensors documented 194 incidents spanning February and March 2026, with an activity frequency rating of 8/10 — reflecting continuous, high-volume engagement rather than opportunistic or sporadic probes. The reported threat categories break down to 17 general hacking incidents and 12 specifically categorized as SSH attacks, with honeypot logs capturing repeated sequences of brute-force attempts followed by automated honeypot-triggered responses. The network is physically located in Indonesia and routed through a commercial hosting provider, a common pattern for threat actors leveraging cloud infrastructure for anonymity and scalability.
SSH brute-force attacks work by rapidly cycling through username and password combinations to guess valid server credentials, exploiting weak or default passwords on exposed SSH daemons. Even a single successful authentication grants the attacker a foothold on the target system, enabling data theft, lateral movement within networks, or deployment of secondary payloads such as backdoors and cryptominers. The honeypot event logs associated with this IP show repeated, automated cycles of credential guessing followed by command-input attempts — behaviour consistent with tools designed to compromise SSH services at scale.
Operators exposing SSH services to the internet should immediately restrict access using firewall rules or network access control lists, limiting inbound connections to trusted IP ranges only. Implementing key-based authentication in place of password logins eliminates the attack vector entirely, while tools such as fail2ban can automatically block IPs after a configurable number of failed authentication attempts. Disabling root login over SSH and changing the default port from 22 further reduces exposure to automated scanning. Continuous monitoring of authentication logs for unusual patterns and timely patching of SSH daemons against known vulnerabilities provide additional defensive depth against this class of threat.
BG 
RO 
JP 
FR 
BE 
AR