Critical Threat
IP address 103.8.59.250, registered in Indonesia and operated by Prime Link Communication, PT under autonomous system AS45707, is a critical-risk threat actor with a maximum threat-level score of 10 out of 10 and 100 percent confidence in malicious attribution. The address generated 200 total abuse reports across automated honeypot sensors between January and June 2026, with an activity frequency rated 8 out of 10, indicating sustained and persistent hostile behaviour over a six-month observation window. The dominant threat category is SSH-based intrusion, supplemented by broader hacking activity.
Detection data from 20 independent automated honeypot sensors recorded 200 total reports, with 16 reports specifically categorised as SSH attacks and 4 categorised as general hacking attempts. Internal detection logs document 25 separate fail2ban violations tied to sshd, consistent with sustained brute-force authentication attacks against exposed SSH services. A Suricata alert additionally flagged an active SSH session in progress on an unexpected port, suggesting the host has successfully established at least one foothold on a targeted system. The six-month reporting window from January through June 2026 demonstrates that this activity is not isolated or opportunistic but represents deliberate, continuous targeting of remote access infrastructure.
SSH brute-force attacks exploit the ubiquitous presence of misconfigured or weakly credentialed SSH servers by systematically testing username and password combinations until access is granted. The detection of an established SSH session on a non-standard port is particularly significant, as it indicates the attacker pivoted past initial authentication and is now operating within a compromised environment, potentially deploying further payloads, harvesting data or establishing persistent backdoor access. Combined with general hacking probes, this IP demonstrates a comprehensive intrusion methodology that threatens both the confidentiality and integrity of any exposed server running an SSH daemon.
Site operators should immediately block 103.8.59.250 at the network perimeter firewall and implement fail2ban or equivalent log-based rate-limiting to automatically ban repeat offenders after a configurable threshold of failed authentication attempts. All SSH services should enforce key-based authentication exclusively, disable root login and change the default port to reduce surface area. Intrusion detection systems should be tuned to alert on SSH sessions originating from unexpected ports, and operators should audit existing systems for any signs of unauthorised access coinciding with this IP's activity window. Regular patching and adherence to hardening benchmarks will further reduce susceptibility to the broader hacking activity documented in these reports.
FR 
NL 
UA 
BE 
RO