Critical Alert
IP 103.153.191.173 is a high-risk address linked to SSH brute-force attacks, originating from Indonesia under network operator PT Wahyu Adidaya Network (AS140469), with a maximum threat level of 10/10 and 389 cumulative abuse reports filed through automated honeypot sensors. The concentration of reports in September 2025, combined with a confidence score of 61 percent, establishes this address as an active and persistent threat vector warranting immediate blocking at network perimeters.
The 389 total reports attributed to IP 103.153.191.173 were generated across 20 distinct automated honeypot sensors detecting both general hacking activity and specific SSH-based intrusion attempts. Honeypot events recorded SSH command input alongside confirmed SSH brute-force behavior, indicating systematic credential-guessing campaigns rather than opportunistic port scanning. Although the activity frequency metric registers at 0/10, the sheer volume of historical reports within a compressed timeframe demonstrates that this address has been repeatedly flagged for malicious SSH activity targeting exposed services.
SSH brute-force attacks represent one of the most common pathways to unauthorized server access, with threat actors automating authentication attempts against exposed SSH daemons to compromise systems with weak or default credentials. The real-world risk includes complete server takeover, lateral movement within networks, data exfiltration, and recruitment of breached hosts into botnets for subsequent attacks. This IP reputation degrades the security posture of any organization with SSH services accessible to Indonesian address space or exposed to the broader internet.
Site operators should immediately block IP 103.153.191.173 at firewall or intrusion prevention levels and consider implementing automated blocking via tools such as fail2ban for repeated authentication failures. Organizations should enforce key-based SSH authentication exclusively, disable root login, change the default SSH port to reduce automated targeting, and maintain prompt patching cycles for SSH daemons and underlying operating systems. Ongoing monitoring of abuse feeds and IP reputation databases will help identify if this address reappears from different network vantage points.
RO 
JP 
HK 
GB