Critical Threat
IP 117.176.131.191 is a critical-risk address operated by China Mobile Communications Group Co., Ltd. (ASN AS9808) that has been linked to sustained SSH brute-force attack campaigns, accumulating 179 total abuse reports from automated honeypot sensors with a 96% confidence rating.
Analysis of the submitted reports reveals a concentrated pattern of malicious activity spanning from December 2025 through June 2026, with an activity frequency rated 8 out of 10. The overwhelming majority of threat categorizations (16 Hacking, 4 SSH) correlate directly with evidence of repeated authentication attacks targeting secure shell services. Detections were logged across 20 separate automated honeypot sensors, indicating this IP address has been systematically probing multiple targets rather than conducting isolated opportunistic attacks. Fail2ban logging associated with these detections recorded 75 cumulative violations specifically attributed to SSH brute-force attempts, while network intrusion monitoring via Suricata confirmed active SSH sessions being established on commonly expected ports.
SSH brute-force attacks represent one of the most persistent and widespread threats facing internet-exposed Linux and network infrastructure. Attackers automate the submission of credential pairs against the SSH daemon, exploiting weak or default passwords to gain unauthorized server access. Successful compromise of a single SSH-accessible host can grant attackers persistent backdoor access, lateral movement capabilities across connected systems, and a foothold for deploying additional malicious payloads. The sustained volume of attacks observed from this IP demonstrates deliberate, automated reconnaissance against potentially vulnerable targets.
Network defenders should immediately block or rate-limit traffic from 117.176.131.191 at the firewall level and implement fail2ban or similar intrusion prevention tools to automatically ban repeat offenders. Organizations should enforce key-based SSH authentication exclusively, disable root login, and consider relocating SSH services to non-standard ports. Regular auditing of authentication logs for repeated failed login attempts from this address and implementation of network-level threat intelligence feeds will further reduce exposure to credential-based attacks originating from this high-risk source.
SE 
NL