High Risk
IP 103.76.120.219 is a high-risk address originating from Indonesia that has been linked to repeated SSH brute-force intrusion attempts, with automated honeypot sensors recording 310 separate incident reports across a concentrated activity window in February 2026.
The IP address, allocated to AS136052 and operated by PT Cloud Hosting Indonesia, was first flagged by automated honeypot sensors in February 2026 and has since accumulated a substantial volume of abuse reports, indicating persistent and systematic probing behaviour rather than opportunistic scanning. The 20 reporting honeypot nodes detected multiple SSH brute-force attempts alongside SSH command-input activity, suggesting the threat actor cycled between credential guessing and issuing remote commands on any accessible systems. With a confidence score of 100 percent and a threat level of 8 out of 10, the data points to a deliberate, focused campaign rather than generalised network noise.
SSH brute-force attacks represent one of the most common initial-access vectors for server compromise. Threat actors systematically attempt username and password combinations against exposed SSH daemons until valid credentials are discovered, enabling full command-level access to the target system. The detection of command-input activity alongside the brute-force attempts indicates that the actor is not merely scanning but is actively testing compromised or misconfigured environments. In production environments with exposed SSH services, this pattern can lead to data exfiltration, malware deployment, lateral movement within networks, or the weaponisation of compromised servers for further attacks.
Operators with publicly accessible SSH services should immediately block or rate-limit traffic from IP 103.76.120.219 at the firewall level. Key-based authentication should replace password authentication entirely, the default SSH port should be changed, and root login over SSH should be disabled. Deploying tools such as fail2ban or equivalent intrusion-prevention systems will automatically ban IPs exhibiting brute-force behaviour. Keeping SSH daemons and underlying operating systems fully patched, combined with continuous monitoring of authentication logs, will significantly reduce the risk of successful compromise from this or similar threat actors.
BG 
FR 
LU 
LK 
AU 
GB 
JP