Critical Alert
IP 152.32.215.203 is a high-risk address originating from Hong Kong that has been linked to SSH brute-force attacks, accumulating 216 total abuse reports with a critical threat score of 10 out of 10. The IP operates through ASN AS62610 under the network operator ZEN-DPS, and automated honeypot sensors detected the hostile activity spanning from November 2025 through March 2026.
The dataset reveals that this address generated a substantial volume of incident reports, with 20 of the most recent reports specifically categorising the threat as SSH-related brute-force attempts. Detection came exclusively from automated honeypot infrastructure, indicating systematic, automated scanning behaviour rather than opportunistic manual probing. The attack-pattern logs corroborate multiple failed authentication violations targeting SSH services, with fail2ban sensors on sshd modules recording repeated login attempts consistent with credential-stuffing campaigns. While the activity frequency score of 0 out of 10 suggests the IP may exhibit periods of dormancy between offensive surges, the consistent report volume and persistent nature of the observed activity indicate an established threat actor operating from this infrastructure.
SSH brute-force attacks pose a direct and serious risk to any exposed Linux or Unix-based servers accepting remote connections. Attackers systematically attempt username and password combinations to gain unauthorised shell access, potentially escalating privileges to root and compromising sensitive data, deploying malware or establishing persistent backdoor access. The automated nature of these attacks means that servers exposed to the internet with weak or default credentials can be breached within hours or days, making them a preferred initial access vector for ransomware operators and data exfiltration campaigns.
Site operators should immediately block IP 152.32.215.203 at the firewall level and implement fail2ban or similar intrusion-prevention tools to automatically ban repeated SSH authentication failures. Network defenders should enforce key-based authentication exclusively, disable root login over SSH, change the default port from 22 to a non-standard port and apply strict rate-limiting on authentication endpoints. Continuous monitoring of authentication logs for unusual source IPs and geographic anomalies will further reduce exposure to this and similar threats.
MC 
UA 
GB 
SE