High Risk
IP 160.119.76.4 is a high-risk address originating from Seychelles that has been extensively reported for fraudulent VoIP activity alongside diverse attack patterns including IoT exploitation attempts, web application probing, and SMTP abuse. With 776 abuse reports and a threat level of 8/10, this IP presents a significant danger to exposed services.
Automated honeypot sensors filed all 776 reports across a concentrated two-month window from May 2026 to June 2026, indicating deliberate and sustained hostile activity rather than opportunistic scanning. The dominant threat category—Fraud VoIP, representing the bulk of recent reports—signals systematic attempts to exploit telecommunications infrastructure for financial gain. Supporting attack vectors including SSH brute-force attempts, web application probes, and IoT-targeted connections reveal a multi-vector threat actor pursuing multiple intrusion pathways simultaneously. The AS49870 network operated by Alsycon B.V. in Seychelles has generated enough hostile traffic to warrant blocking at the network perimeter.
Fraudulent VoIP activity exploits phone systems to initiate unauthorized calls, frequently routing through premium-rate numbers to generate revenue for threat actors. When combined with IoT exploitation attempts and web application probing, this IP demonstrates the behavior of a coordinated campaign seeking entry points across diverse service types. Each successful compromise could extend the attacker's infrastructure for further abuse, botnet recruitment, or subsequent fraud operations.
Network defenders should immediately block 160.119.76.4 at the firewall level and monitor for similar activity from adjacent IP space within AS49870. Implement strict call authentication protocols for VoIP systems and consider disabling international or premium-rate dialing unless business-critical. Deploy fail2ban or equivalent tools to automatically block repeated SSH authentication failures. Maintain up-to-date signatures across intrusion detection systems and apply security patches promptly to minimize vulnerability to exploitation attempts.
NL 
MU 
MX 
UA 
RO 
EG