Extreme Threat
IP 165.245.141.230 is a maximum-threat-level address originating from DigitalOcean's AS14061 network in the United States, associated with 390 total abuse reports and confirmed SSH brute-force intrusion activity detected by multiple automated honeypot sensors.
Analysis of the available data reveals a high-volume threat actor with 390 reported incidents and an activity frequency rating of 8 out of 10. The IP was first reported in February 2026 and remains active within the same reporting window, indicating persistent rather than transient malicious behavior. Detection occurred through three separate automated honeypot sensors, lending credibility to the threat classification despite the moderate 51% confidence score. The DigitalOcean ASN14061 network has been implicated, which is noteworthy as cloud provider infrastructure is frequently abused by threat actors seeking to obfuscate their origin through compromised or rented cloud instances. The dominant reported threat categories of SSH and general hacking activity align with the honeypot-generated attack patterns documenting repeated SSH brute-force attempts.
SSH brute-force attacks represent a prevalent and persistent threat vector targeting publicly accessible servers with exposed SSH daemons. Attackers systematically attempt combinations of common usernames and weak passwords to gain unauthorized shell access, effectively granting them full system control upon successful authentication. The scale of 390 reports for a single IP address suggests automated, high-volume credential guessing campaigns that could overwhelm poorly configured servers within hours. Successful compromise enables data exfiltration, lateral movement within networks, deployment of secondary payloads such as cryptocurrency miners or ransomware, and long-term persistent access. Organizations with internet-facing SSH services without proper hardening face immediate risk from this category of automated attack.
Site operators should implement key-based authentication exclusively for SSH access, eliminating password-based login entirely. Changing the default SSH port from 22 to a non-standard port reduces automated scanning exposure. Deploying tools like fail2ban enables automated blocking of IPs exhibiting brute-force behavior patterns. Additionally, disabling direct root login and enforcing strong passphrase policies for all accounts significantly elevates the difficulty for credential-guessing campaigns. Continuous monitoring of authentication logs and implementing rate-limiting rules at the firewall level provide additional defensive layers against this threat category.
NL 
GB 
CA 
FR 
LU 
AE