Critical Threat
IP 170.64.177.49 is a high-risk address linked to SSH brute-force attacks, operating from DigitalOcean's Australian network (AS14061) with a threat level of 8/10 and 941 total abuse reports indicating sustained malicious activity.
According to data from 20 automated honeypot sensors, this address was first and last reported in March 2026, generating 34 recent threat reports dominated by Hacking (18) and SSH (16) categories. With an activity frequency score of 8/10 and a 94% confidence rating, the detection evidence is highly reliable. The IP's origin on DigitalOcean's infrastructure (AS14061) in Australia is notable because cloud provider IP ranges are frequently leveraged by threat actors due to their reputation for reliability and geographic diversity, making reputation-based filtering less effective for blocking this address.
SSH brute-force attacks involve automated attempts to guess server credentials by cycling through common username-password combinations, exploiting weak or default passwords on exposed SSH daemons. An address generating nearly a thousand reports from honeypot sensors is almost certainly part of a distributed scanning or credential-stuffing campaign. The concrete risk is unauthorized server access, followed by data theft, cryptocurrency mining, lateral movement within networks, or use of compromised systems as jumping-off points for further attacks. Even failed attempts consume server resources and generate security-noise that can mask more sophisticated intrusion attempts.
Administrators should block this IP immediately at the firewall level and implement fail2ban or equivalent tools to automatically ban repeated SSH authentication failures. Switching to key-based authentication eliminates the threat of password guessing entirely. Disabling root login over SSH and changing the default port reduces exposure to automated scanners. Continuous monitoring of authentication logs for this address and similar cloud-provider sources will help identify ongoing scanning patterns and potential breach attempts.
NL 
SG 
GB 
BG 
FR 
KR 
TM 
VN 
UA