Severe Risk
IP 152.42.165.179 is a high-risk address with a maximum 10/10 threat rating that has been extensively linked to SSH brute-force and general hacking activity. This DigitalOcean-operated IP, geolocated to Singapore and routing through AS14061, accumulated 921 abuse reports across 20 automated honeypot sensors during a four-month window spanning November 2025 through February 2026, with the dominant threat vector being SSH intrusion attempts.
The detection data reveals sustained hostile activity originating from this address, with honeypot systems logging repeated authentication failures and suspicious command-input patterns that triggered automated blocking responses. Fail2ban systems recorded multiple SSH connection events from this IP, indicating systematic credential-guessing campaigns rather than opportunistic probing. The 10/10 threat level reflects the severity and persistence of the observed behavior, while the moderate 65% confidence score acknowledges inherent uncertainty in attributing all automated scanning activity with absolute certainty. Despite a recent activity frequency score of 0/10 suggesting the address may be temporarily dormant, the substantial historical report volume establishes a clear threat profile centered on automated SSH infiltration attempts.
SSH brute-force attacks represent one of the most common pathways for unauthorized server access, with attackers systematically cycling through credential combinations against exposed services. Successful authentication grants shell-level access, enabling data exfiltration, malware deployment, or use of the compromised host as a pivot point for lateral movement. The observed attack patterns from IP 152.42.165.179 demonstrate persistence and automation consistent with organized scanning infrastructure rather than isolated manual attempts.
Administrators with publicly accessible SSH services should enforce key-based authentication exclusively and disable password-based login to eliminate credential-guessing vectors. Implementing automated abuse-detection tools such as fail2ban, applying rate-limiting on SSH connections, and restricting access via firewall rules to trusted IP ranges significantly reduces exposure. Changing the default SSH listening port, disabling direct root login, and maintaining vigilant authentication-log monitoring further harden defenses against the threat pattern this IP represents.
NL 
GB 
TR 
FR 
NP 
VN 
DO 
MZ 
FI 
ZM