Elevated Risk
IP 167.99.141.235, a DigitalOcean (AS14061) address originating from Germany, is a high-risk entity that has generated 1,100 abuse reports over approximately six months, with SSH brute-force attacks and general hacking activity representing the dominant threat categories and a threat level assessed at 8 out of 10.
Analysis of the available data reveals this address was first reported in September 2025 with continued activity through March 2026, accumulating reports from 20 distinct automated honeypot sensors. The reported threat breakdown shows Hacking (15 reports), SSH attacks (8 reports), VoIP fraud (3 reports), an exploited host indicator (3 reports), and web application probing (2 reports). Network-level context confirms the IP belongs to DigitalOcean's autonomous system, a common platform for both legitimate cloud infrastructure and malicious operations due to its global reach and relative anonymity. The activity frequency score of 0/10 indicates intermittent rather than continuous attacks, consistent with automated scanning campaigns that cycle through targets over time. Detection mechanisms, including Suricata-based intrusion alerts, captured multiple instances of SSH session establishment on expected ports and evidence of successful exploitation events, raising concerns beyond mere attempted intrusions.
The primary threat posed by IP 167.99.141.235 involves credential-based attacks against exposed SSH services, where adversaries systematically attempt common username and password combinations to gain unauthorized server access. This activity represents one of the most prevalent initial access vectors in real-world breaches, as servers with weak, default, or dictionary-based passwords remain widespread across internet-facing infrastructure. The presence of exploited host reports suggests at least one successful compromise occurred, transforming this address into a confirmed active threat rather than merely a probing entity. Secondary attack patterns involving web application reconnaissance and VoIP fraud activity indicate the operator is running multi-vector campaigns that target different vulnerability classes simultaneously, maximizing the chances of finding an exposed entry point.
NL 
GB 
CA 
UA 
FR 
KR