Notable Threat
IP 103.213.127.100 is a high-risk address originating from Nepal (NP) that has generated 158 abuse reports through automated honeypot sensors since February 2026, with the vast majority of activity linked to SSH brute-force intrusion attempts against exposed services. With a threat level of 8 out of 10 and a confidence score of 99%, this IP represents a persistent, automated scanning and credential-guessing threat that poses a concrete risk to any internet-facing SSH servers.
Network intelligence places the address within ASN AS45424, operated by Network Pool Allocated for HONS Network, and the sustained activity frequency rating of 8 out of 10 indicates repeated, systematic attacks rather than isolated probes. The 158 total reports across 20 independent honeypot detection points confirm broad scanning behaviour consistent with botnet-assisted operations. The dominant threat categories — SSH attacks at 15 reports and general hacking activity at 12 reports — align precisely with the honeypot event logs, which consistently document sshd brute-force attempts targeting the Secure Shell service.
SSH brute-force attacks systematically attempt to guess server credentials by cycling through common username-password combinations, exploiting weak or default passwords to gain unauthorized shell access. Once inside, threat actors can deploy malware, exfiltrate data, or use the compromised host as a pivot point for further network intrusion. The concentrated focus on SSH across multiple detection sensors suggests this IP is part of an automated dictionary-attack campaign rather than opportunistic single-target probing.
Site operators should block this IP at the firewall level and implement key-based authentication as the primary login method, eliminating password-based access entirely. Changing the default SSH port reduces exposure to automated scanners, while deploying tools such as fail2ban can dynamically ban IPs after a configurable number of failed login attempts. Intrusion detection monitoring and prompt application of security patches across all SSH-enabled hosts further harden defences against this class of persistent credential-guessing threat.
VN 
ES 
KR 
ET 
GB 
FR