Maximum Danger
IP 165.227.147.2 is a high-risk address operating from a DigitalOcean-managed network in Germany that has generated 163 abuse reports from automated honeypot sensors, with the overwhelming majority linked to SSH brute-force attack activity against exposed server login interfaces.
Analysis of the submitted reports reveals a concentrated threat picture: 20 distinct automated honeypot sensors flagged this IP between March 2026 reports, with the dominant threat categories being general hacking intrusion attempts and SSH-specific credential-guessing campaigns. The 69% confidence score indicates strong but not definitive attribution, and the zero activity frequency rating suggests the IP concentrates its attempts in short, aggressive bursts rather than maintaining a constant low-level presence. Operating from AS14061 (DigitalOcean-ASN), this address appears to be cycling through standard cloud infrastructure, a common pattern for scanning and attack campaigns that require disposable exit points.
SSH brute-force attacks represent one of the most prevalent threats facing publicly accessible Linux servers and network appliances with exposed Secure Shell services. Attackers systematically cycle through username-password combinations targeting default administrative accounts such as root, admin, and ubuntu, exploiting weak or reused credentials to gain unauthorized server access. Once inside, threat actors typically deploy cryptocurrency miners, establish persistent backdoors, pivot to internal network resources, or sell server access on criminal marketplaces. The volume of reports against IP 165.227.147.2 indicates an active, sustained campaign that poses genuine risk to any misconfigured SSH service without key-based authentication or strict access controls.
Site operators should immediately block or rate-limit this IP at the firewall level, implement fail2ban or equivalent intrusion prevention tools to automatically ban repeated authentication failures, and enforce key-based SSH authentication while disabling password authentication entirely. All exposed SSH services should run on non-standard ports, disable root login, and be protected by strong, unique credentials or certificate-based access only. Continuous monitoring of authentication logs and automated alerting for unusual login patterns will further reduce exposure to campaigns of this nature.
NL 
GB 
SG 
CA 
VN 
ES 
BD 
JP 
BY 
CH 
LK