Critical Alert
IP 180.76.114.78 is a critical-risk address assessed at threat level 10/10, classified as an exploited host operating from Baidu Netcom Science and Technology Co. Ltd. infrastructure in China, with 397 total abuse reports and a dominant pattern of Redis-targeting activity detected by automated honeypot sensors. The IP has been under active community scrutiny from August 2025 through April 2026, with the last confirmed reports filed in April 2026, indicating sustained malicious behaviour over an extended monitoring window.
Detection data shows 20 automated honeypot reports specifically categorizing this address as an exploited host, while aggregate community reports total 397, yielding a 60% confidence score that acknowledges some uncertainty in attribution. The network belongs to AS38365 operated by Beijing Baidu Netcom Science and Technology Co. Ltd., a major Chinese technology and cloud services provider. Despite a high volume of historical reports, the activity frequency metric of 0/10 suggests the IP's recent operational tempo has diminished, though the confirmed Redis attack pattern and exploited host classification indicate this address was previously weaponised to compromise external Redis deployments.
The exploited host designation means 180.76.114.78 functions as a compromised attack platform, likely a misconfigured or vulnerable server that threat actors have taken control of to launch Redis exploits without the owner's knowledge. Redis attacks exploit authentication weaknesses or unprotected instances to extract data, deploy payloads or establish persistence within target environments. The real-world risk is that this IP participated in automated campaigns scanning and attacking internet-facing Redis servers at scale, and residual compromise activity may persist undetected depending on remediation status of the exploited host itself.
Site operators should block 180.76.114.78 at the firewall or network perimeter, particularly on ports associated with Redis and related services, and implement fail2ban or comparable dynamic blocking tools to respond to continued probing. Exposed Redis instances should enforce authentication, bind to localhost or authorised interfaces only, and apply network-level access controls to limit exposure. Security teams are encouraged to review logs for inbound connections from this IP and consider notifying Baidu Netcom's abuse team to facilitate remediation of the compromised host, thereby removing the source from active threat circulation.
CA 
PL 
RU 
TW