Critical Threat
IP 101.47.50.76 is a critical-risk address operating from Singapore through Byteplus Pte. Ltd. (AS150436) that has generated 228 abuse reports from automated honeypot sensors, indicating sustained SSH intrusion activity. With a threat level of 10 out of 10, this IP represents a significant danger to any exposed Secure Shell services and warrants immediate defensive action.
Analysis of the report corpus shows all activity clustered within December 2025, with 20 distinct threat-category instances specifically classified as hacking attempts. Every report originated from automated honeypot sensors deployed across the network, capturing repeated SSH connection attempts that targeted honeypot infrastructure. Despite an activity frequency metric of 0 out of 10, the sheer volume of reports and maximum threat classification indicate concentrated, deliberate scanning behaviour rather than passive reconnaissance. The 78% confidence score reflects strong attribution data linking this address to malicious infrastructure, while the Singapore origin and Byteplus ASN provide network-contextual framing for the observed activity.
The dominant threat category—hacking activity targeting Secure Shell services—represents one of the most common initial-access vectors attackers use to compromise servers. These honeypot detections almost certainly reflect automated credential-guessing or brute-force attempts against exposed SSH daemons, a technique that reliably yields access to poorly configured or weakly authenticated systems. Real-world risk includes complete server compromise, lateral movement within networks, data exfiltration, and persistent backdoor deployment. Attackers automating this process typically cycle through dictionary-based username and password combinations at scale, making any SSH service with default or trivial credentials a high-probability target.
Site operators should implement immediate blocking or rate-limiting for this address at the network perimeter firewall. Enforcing key-based SSH authentication exclusively, disabling password authentication entirely, and deploying fail2ban or equivalent dynamic firewall rules will substantially reduce exposure. Port 22 should never be exposed to untrusted networks without strict source-IP allowlisting where feasible. Continuous monitoring of authentication logs for unusual login patterns from this address range will support early detection of any attempted re-engagement.
HK 
UA 
RO 
GB 
BG 
KZ 
FR 
PS