Critical Threat
IP 103.174.103.249 is a critical-risk address originating from India and operated through IDIGITALCAMP WEB SERVICES (AS133719), strongly linked to SSH brute-force intrusion attempts against exposed servers. Despite a threat level rated 10 out of 10 and a substantial volume of 780 abuse reports, the activity frequency score of 0 out of 10 indicates that hostile contact events are sporadic rather than continuous, suggesting the address may cycle through targets on an intermittent schedule rather than maintaining persistent scanning pressure.
The IP accumulated all 780 reports across 20 automated honeypot sensors during February 2026 alone, with the dominant reported categories being general hacking activity (16 instances) and SSH-specific attacks (12 instances). Abstracted honeypot event logs confirm recurring SSH brute-force attempt patterns, where the address systematically probes authentication endpoints. The 66% confidence score reflects moderate certainty in the attribution, accounting for the possibility that shared or NATed infrastructure may occasionally produce ambiguous telemetry, though the consistency of the SSH targeting strongly supports a malicious classification.
SSH brute-force activity represents one of the most persistent and widely observed threat vectors targeting internet-facing Linux and network infrastructure. Attackers leverage automated tooling to cycle through credential combinations against port 22, exploiting weak or default passwords to gain unauthorized shell access. Once inside a server, threat actors typically install backdoors, pivot laterally into adjacent systems, or weaponize the compromised host for further scanning. The sheer volume of reports for this address, even concentrated within a single month, demonstrates intent to compromise any accessible SSH service within range of the scanning campaign.
Site operators running exposed SSH services should immediately block this address at the firewall or network edge, implement fail2ban or equivalent dynamic blocking to auto-ban repeat offenders, and enforce key-based authentication while disabling password-based login entirely. Changing the default SSH listening port, disabling root login, and enforcing strong passphrase policies further reduce the attack surface. Continuous monitoring of authentication logs for the credential patterns associated with brute-force campaigns remains essential for early detection of successful compromise attempts.
HK 
FR 
SE