Substantial Risk
IP 101.36.114.209 is a critical-risk address with a threat level of 10/10, originating from South Korea and associated with AS135377 under the operator UCLOUD INFORMATION TECHNOLOGY HK LIMITED. This IP has accumulated 246 total abuse reports from automated honeypot sensors, with 21 confirmed threat incidents recorded in recent months, making it a significant source of malicious network activity that demands immediate defensive action.
The IP was first reported in December 2025 and most recently in May 2026, indicating persistent hostile behavior over approximately six months. With an activity frequency rated at 3/10, the attacks are methodical rather than high-volume floods, suggesting deliberate targeting rather than opportunistic scanning. Detection data shows this address was flagged through 20 separate automated honeypot sensors, and the reported categories include general hacking activity and exploited host behavior. Network telemetry further revealed unsafe SMBv1 protocol usage and malware-related exploit activity, indicating the host may be compromised and operating as a staging point for further attacks without the owner's knowledge.
The dominant threat category, hacking activity, encompasses intrusion attempts, vulnerability exploitation, and unauthorized access efforts against exposed services. The presence of SMBv1 protocol activity is particularly concerning as this legacy protocol contains multiple known vulnerabilities that attackers actively exploit for lateral movement and remote code execution. When combined with the exploited host classification, the evidence suggests this IP may be part of a botnet or under the control of threat actors who are leveraging a compromised system to conduct further attacks, effectively hiding behind an innocent intermediary while targeting other networks.
Site operators should block IP 101.36.114.209 at the network perimeter immediately and implement rate-limiting on exposed authentication endpoints to mitigate credential-based attacks. Ensuring all systems run current security patches, particularly addressing SMBv1 vulnerabilities, is essential. Deploying intrusion detection systems and monitoring tools such as fail2ban can help identify and neutralize repeated attack patterns. Additionally, organizations may consider notifying the hosting provider regarding the exploited host classification so the legitimate system owner can remediate their compromised infrastructure and prevent further abuse.
NG 
HK 
JP 
TW 
BG 
RU 
GE 
TH