Observed attack events
PUBLIC IP INTELLIGENCE
61.76.112.4IP Reputation
This IP was observed performing 2 SSH credential and probing events against FraudGuard honeypot infrastructure in the last 7 days, most recently on November 12, 2026 at 20:42 UTC.
What the evidence shows.
Activity observed by FraudGuard.
Overlapping windows, shown separately.
Observed attack events
Observed attack events
The API’s assessment score
The 24-hour, 7-day, and 30-day windows overlap. They are not a timeline and should not be added together. A dash means data was not returned.
The findings below describe activity attributed to this IP in FraudGuard’s telemetry.
Context for the recommendation.
Read the signals.
Understand the assessment.
Ace risk signals detected
FraudGuard ACE v2 detected active risk signals for this IP
Honeypot interaction observed
Interaction observed across FraudGuard honeypot infrastructure
Activity within 7 days
Activity observed within the last 7 days
Observed attack targets
1 attack type returnedThese services and destination ports were targets of observed activity. They are not a list of open ports on this IP.
| Observed behavior | Attack target | 24h events | 7d events | 30d events | Last observed |
|---|---|---|---|---|---|
| Ssh banner probe | SshSSH · Port 22 | 2 | 2 | 39 | Nov 12, 2026 · 20:42 UTC |
The infrastructure behind the IP.
Network and geographic context.
Location is approximate.
Network
- Autonomous system
- AS4766
- ASN organization
- Korea Telecom
- Internet provider
- KT
- Organization
- KT
- Network range
- 61.76.112.0/24
- Connection type
- Cable/DSL
Infrastructure & location
- Infrastructure type
- Unknown
- Provider
- Not available
- Country
- South Korea
- Region
- Busan
- City
- Busanjin-gu
- Time zone
- Asia/Seoul
Observation times & additional infrastructure signals
- First observed attack activity
- Oct 22, 2026 · 01:46 UTC
- Last observed attack activity
- Nov 12, 2026 · 20:42 UTC
- API response generated
- Nov 13, 2026 · 04:43 UTC
- Infrastructure last enriched
- Not available
- VPN infrastructure
- Not identified
- Tor exit
- Not identified
- Public proxy
- Not identified
- Residential proxy
- Not identified
- Hosting provider
- Not identified
- Mobile network
- Not identified
- Satellite network
- Not identified
- Shared exit
- Not identified
- AI agent infrastructure
- Not identified
Put IP intelligence
to work in your application.
One report helps you investigate. An API integration helps you evaluate the traffic your application sees, with an explanation you can use.
- 01
Evaluate IP traffic.
Send a public IP to ACE v2 from your server.
- 02
Understand the evidence.
Read the recommendation, risk, and observations together.
- 03
Use it in your workflow.
Bring the result into your application or security tools.
/ace/v2/ip/checkcurl --request POST 'https://api.fraudguard.io/ace/v2/ip/check' \
--user 'YOUR_API_USER:YOUR_API_PASSWORD' \
--header 'Content-Type: application/json' \
--data '{"ip":"61.76.112.4"}'A recommendation.
With reasons behind it.
FraudGuard’s proprietary honeypot network observes hostile activity firsthand. ACE connects those observations with infrastructure and network context to produce the assessment you see here.
This public report contains shared intelligence. Account-specific lists and private customer context are excluded. Assessments can change as new evidence arrives.
How FraudGuard IP intelligence worksYOUR APPLICATION. BETTER CONTEXT.
You’ve seen the intelligence.
Now make it part of your product.
Start exploring FraudGuard with a 14-day free trial.
