Critical Alert
IP address 27.110.166.67 is assessed as a critical-risk address originating from the Philippines, with a 10/10 threat rating and 352 separate incident reports filed against it across automated honeypot sensors between November 2025 and May 2026. The dominant and sole threat category identified in recent activity is SSH brute-force attacks, accounting for all 20 of the most recent threat reports attributed to this address.
Detection data shows that 20 distinct automated honeypot sensors across the network recorded violations from this single source, with fail2ban logs confirming consistent SSH brute-force activity throughout the reporting period. The Philippine Long Distance Telephone Company operates the AS9299 autonomous system from which this activity originates, and while the activity frequency is moderate at 3/10, the sheer volume of historical reports and perfect alignment of recent categorizations indicate an established, persistent threat actor rather than opportunistic scanning.
SSH brute-force attacks represent one of the most common initial-access vectors employed by threat actors to compromise servers and gain persistent entry into target networks. By systematically attempting weak or default credential combinations against exposed SSH services, attackers using this method can establish footholds for data exfiltration, cryptocurrency mining, lateral movement or deployment of secondary payloads. The fail2ban violation logs attributed to 27.110.166.67 demonstrate sustained, high-volume attempts numbering in the hundreds of individual authentication failures, indicating a determined campaign rather than passive reconnaissance.
Network defenders should immediately block IP address 27.110.166.67 at the firewall level and implement fail2ban or equivalent intrusion-prevention tools configured with strict SSH policy to auto-ban repeat offenders. Organizations should enforce key-based authentication exclusively for SSH access, disable root login and consider moving SSH services to non-standard ports to reduce exposure. Continuous monitoring of authentication logs and implementation of account lockout policies provide additional layers of defense against credential-based attacks originating from this address.
BG 
FR 
RU 
UA