Critical Alert
IP 187.210.77.100, registered to UNINET in Mexico (AS8151), is a critical-risk address with a 93% confidence score and a perfect 10/10 threat rating, primarily engaged in sustained SSH brute-force attacks against honeypot sensors and community-reported targets. This IP has accumulated 193 abuse reports across multiple detection systems, with activity frequency rated 8/10, indicating continuous and aggressive engagement in credential-guessing campaigns over a four-month period from February through May 2026.
The detection profile for 187.210.77.100 draws from 20 automated honeypot sensors, which collectively logged 193 separate reports across three distinct threat categories: SSH attacks dominating at 19 recent reports, followed by general hacking activity at 10 reports and a single exploited-host indicator. Pattern analysis of sanitized detection logs reveals repeated sshd brute-force attempts, with violation counts ranging from 25 to 35 per detection cycle, alongside Suricata alerts flagging SSH sessions on non-standard ports consistent with automated attack tooling. The consistent volume and variety of detection sources strongly suggest this is not an isolated incident but rather sustained, deliberate scanning behaviour originating from infrastructure within the Mexican UNINET network.
SSH brute-force attacks represent one of the most common and effective initial-access vectors in modern threat landscapes. Attackers systematically attempt username and password combinations against exposed SSH daemons, exploiting weak or default credentials to gain unauthorized server access. Once inside, threat actors typically deploy backdoors, cryptocurrency miners or use the compromised host as a pivot point for deeper network intrusion. The detection of exploited-host characteristics alongside brute-force activity raises the possibility that 187.210.77.100 itself may be part of a botnet or proxy chain, amplifying its risk profile beyond that of a simple scanning endpoint.
Network operators should immediately block 187.210.77.100 at the firewall level and monitor for any associated traffic patterns across their infrastructure. Deploying key-based authentication exclusively for SSH access, relocating the SSH daemon to a non-standard port and implementing rate-limiting rules using tools such as fail2ban will substantially reduce exposure to credential-guessing campaigns of this nature. Intrusion detection signatures covering SSH brute-force patterns and regular audit of authentication logs will further harden defensive posture against similar addresses.
SC 
EG