Maximum Danger
IP 210.90.155.178, registered to Korea Telecom's AS4766 network in South Korea, is a critical-risk address with a threat level of 10 out of 10 based on 229 total abuse reports and 82% confidence of malicious intent. The dominant activity linked to this IP is SSH brute-force probing, with 20 recent automated honeypot sensors confirming repeated attempts to compromise exposed SSH services through credential-guessing attacks over a reporting window spanning November 2025 through May 2026.
Community-driven and automated honeypot detection systems logged this address performing sustained SSH brute-force operations, with documented evidence showing 25 violations against sshd on monitored honeypot sensors. While the activity frequency of 4 out of 10 suggests intermittent rather than continuous attack campaigns, the volume of unique reports and the persistent nature of the observed behaviour over a six-month period indicate this is not an isolated incident but rather an established pattern of systematic probing. Korea Telecom's residential and business customer base makes it a common origin for both compromised endpoints and legitimate enterprise traffic, complicating reputation-based filtering alone.
SSH brute-force attacks represent one of the most common initial-access vectors in server compromise, where adversaries systematically guess weak or default credentials to gain shell access. Successful authentication grants attackers remote code execution capabilities, enabling data exfiltration, cryptocurrency mining, lateral movement within networks, or recruitment into botnets. The automated nature of these attacks means exposed SSH services—particularly those listening on default ports with password-based authentication enabled—face constant dictionary-based credential stuffing around the clock.
Operators with exposed SSH services should immediately restrict authentication to key-based mechanisms, change the default listening port, and disable direct root login. Deploying intrusion-prevention tools such as fail2ban can automatically ban source IPs after a threshold of failed login attempts, significantly reducing the effectiveness of brute-force campaigns. Rate-limiting incoming connections to port 22 and monitoring authentication logs for unusual patterns or high failure rates will further harden exposure. Blocking or throttling traffic originating from AS4766 at the perimeter firewall, particularly if enterprise connectivity does not require direct South Korean origin traffic, provides an additional layer of defence against this persistent threat actor.
JP 
IR 
GB