Extreme Threat
IP 103.125.189.66 is a high-risk address with a maximum threat level of 10/10 that has generated 699 abuse reports with 94% confidence over approximately five months, with hacking activity identified as the dominant threat vector by automated honeypot sensors.
The address, registered in Vietnam and operated under AS135905 by VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, has been actively reported since September 2025 with consistent malicious activity continuing through January 2026, yielding an activity frequency rating of 8/10. The substantial total report volume of 699 incidents far exceeds typical background noise levels and indicates sustained, deliberate hostile behavior rather than incidental scanning. All 20 recent threat-category reports specifically documented hacking attempts, while the elevated activity frequency confirms this is not a transient or opportunistic actor but an actively engaged threat source. Detection was facilitated entirely through automated honeypot sensors, suggesting the attacking infrastructure employs systematic, automated methods to probe target systems.
Hacking activity in this context encompasses broad intrusion attempts, vulnerability exploitation, and unauthorized access vectors targeting internet-facing services. The volume and persistence of reports for this address suggest involvement in coordinated scanning operations or sustained brute-force campaigns designed to identify and compromise vulnerable systems. Such activity frequently precedes more targeted attacks, credential harvesting, or lateral movement within compromised networks, creating significant risk for any exposed service.
Site operators should immediately block this IP address at the firewall or network perimeter level given its maximum threat classification. Implementing automated intrusion prevention tools such as fail2ban can detect and neutralize repeated connection attempts characteristic of the observed activity. Exposed services should enforce strong authentication, implement rate-limiting, and maintain current security patches to reduce susceptibility to the exploitation techniques this address likely employs.
RO 
MX