Severe Risk
IP 103.171.188.76 is a maximum-risk address linked to sustained SSH brute-force and hacking activity, with 253 abuse reports filed against this Indian IP originating from MAHABAL NET SERVICE PROVIDER PRIVATE LIMITED infrastructure between February and March 2026.
The evidence base for this threat assessment draws from 20 automated honeypot sensors that detected Suricata alerts flagging active SSH brute-force attempts and confirmed attack connections originating from this address. While the confidence score stands at 64%, the sheer volume of reports combined with the 10/10 threat level designation paints a concerning picture. The activity window spans February through March 2026, indicating a deliberate, persistent campaign rather than transient scanning. Geographically located in India and operating through AS139543, this IP represents infrastructure within a commercial service provider network that is being actively weaponized against SSH services worldwide. The dominant reported category is general hacking activity at 20 instances, supplemented by isolated SSH-specific and exploited-host reports.
SSH brute-force attacks systematically attempt to compromise server credentials by iterating through authentication pairs until access is gained. The real-world risk extends far beyond initial access: once inside, threat actors routinely establish persistent backdoors, exfiltrate data, deploy secondary payloads, or leverage the compromised host as a launchpad for further attacks. The confirmed "Exploited Host" classification suggests this IP may itself be part of a larger compromised infrastructure chain, multiplying its potential impact across multiple targets. The low activity frequency score alongside high report volume indicates this operator favors persistent, low-and-slow attack patterns designed to evade conventional detection thresholds.
Site operators should immediately block 103.171.188.76 at firewall and network perimeter levels. Deploying fail2ban or equivalent intrusion-prevention tools will automatically detect and ban repeated SSH authentication failures from this and similar addresses. Hardening measures including disabling root login, enforcing key-based authentication over passwords, and changing the default SSH port significantly reduce exposure to these credential-guessing campaigns. Ongoing monitoring of authentication logs for patterns associated with this IP remains essential, and if traffic analysis suggests the address belongs to a legitimate Indian business, notifying the hosting provider about the compromise warrants consideration.
SG 
KR 
PH 
CA 
HU 
TR 
AE 
SE 
ID 
SD 
MX