Maximum Danger
IP 111.228.14.125 is a maximum-threat-level address operated from China Telecom's Beijing Tianjin Hebei Big Data Industry Park Branch that has generated 186 abuse reports over six months, overwhelmingly focused on SSH brute-force attacks and active exploitation attempts against exposed servers.
The 186 total reports across 20 automated honeypot sensors represent sustained malicious activity spanning January through June 2026. The dominant threat category is SSH-related intrusion, with detection signatures indicating active sessions being established on expected SSH ports, repeated credential-guessing patterns, and stream anomalies consistent with exploitation or coordinated attack traffic. The detection of "Exploited Host" signatures alongside direct hacking attempts suggests this address may simultaneously function as an attack platform and potentially serve compromised infrastructure within a broader threat operation.
SSH brute-force attacks present severe real-world risk to any exposed server with password-based authentication. Automated tools can cycle through credential combinations rapidly, often compromising poorly configured systems within minutes. The detection of active sessions in progress on expected ports indicates persistent access attempts rather than opportunistic scanning, while stream-level anomalies suggest the host may be leveraged for man-in-the-middle or session-hijacking operations against legitimate SSH connections.
Immediate defensive measures should include blocking 111.228.14.125 at network perimeter devices and implementing key-based authentication for SSH access while disabling password authentication entirely. Deploying fail2ban or equivalent rate-limiting tools will automatically block repeated connection attempts from this and similar addresses. Organizations should monitor SSH authentication logs for any matching source addresses, change default credentials, and consider moving SSH services to non-standard ports to reduce exposure surface.
BG 
CH