Elevated Risk
IP 176.120.22.13 is a high-risk Russian address associated with repeated SSH brute-force attacks, with automated honeypot sensors recording 679 abuse reports over a two-month window in early 2026.
The IP belongs to Proton66 OOO, a Russian network operator, and was first flagged in January 2026 with continued reporting activity through February 2026. All recent threat reports consistently cite SSH as the attack vector, with honeypot sensors detecting the address on multiple occasions. While the overall report volume is substantial at 679 incidents, the activity frequency metric suggests the most recent detection window shows limited fresh attempts, likely indicating the address has been blocked by defensive systems such as fail2ban on the targeted SSH daemons. The 63% confidence score reflects reasonable certainty that this traffic represents malicious scanning behavior rather than legitimate server access, though the exact timeline of the most recent activity cannot be precisely determined from the available data.
SSH brute-force attacks represent one of the most common pathways attackers use to gain unauthorized access to Linux servers and network infrastructure. Threat actors systematically attempt username and password combinations against exposed SSH services, exploiting weak or default credentials to establish a foothold on targeted systems. Once inside, attackers can deploy malware, exfiltrate data, or use the compromised server as a jumping-off point for further network intrusion. The volume of reports for IP 176.120.22.13 indicates sustained, automated scanning activity rather than opportunistic probing.
Network administrators should immediately block IP 176.120.22.13 at the firewall level and ensure fail2ban or equivalent intrusion prevention tools are actively monitoring SSH authentication logs. Enforcing key-based authentication exclusively, disabling root login, and moving SSH to a non-standard port will significantly reduce exposure to automated scanning. Continuous monitoring of authentication logs and implementing account lockout policies after repeated failed attempts provide additional layers of defense against this threat category.
SC 
RO