Elevated Risk
IP 87.121.84.119 is a high-risk address operated by Vpsvault.host Ltd under ASN AS215925 in the United States, definitively linked to sustained SSH brute-force attacks as confirmed by 162 independent abuse reports with a 97 percent confidence score. The IP has been repeatedly flagged by automated honeypot sensors across 20 distinct detection points, with activity concentrated in April 2026 and showing characteristics of a multi-jail recidivist offender.
Analysis of the reported threat categories reveals SSH-related activity dominating the dataset with 18 reports, supplemented by 4 reports each for general hacking and brute-force authentication attempts. The detection data from automated honeypot sensors documents extreme violation counts, including instances of 132 and 128 authentication failures attributed to a single source, alongside multiple recidive-jail triggers indicating this actor repeatedly targets the same infrastructure. The activity frequency score of 3 out of 10 suggests persistent rather than burst-pattern behaviour, consistent with methodical credential-stuffing campaigns rather than opportunistic scanning.
SSH brute-force attacks represent a concrete and immediate threat to any exposed Secure Shell service, as successful authentication grants attackers direct command-line access to servers, enabling data exfiltration, lateral movement within networks, deployment of secondary payloads, and establishment of persistent backdoors. The volume of violations observed for this address indicates automated tooling capable of sustaining hundreds of authentication attempts against targeted systems. When conducted from a dedicated VPS infrastructure as indicated by the network operator, these attacks benefit from reliable connectivity and can easily pivot to new targets upon detection.
Network defenders should immediately block or rate-limit traffic from this address at the firewall level and monitor inbound authentication logs for similar patterns. Deploying key-based authentication exclusively, moving SSH to a non-standard port, and implementing fail2ban with aggressive recidive-jail settings will substantially reduce exposure. Enforcing multi-factor authentication on all SSH access and disabling root login eliminates the primary attack surface that this IP has demonstrated consistent interest in exploiting.
KR 
SC