Severe Risk
IP 122.173.28.147 is a critical-risk address assessed at 10/10 threat level, classified as an Exploited Host based on 199 total abuse reports submitted through automated honeypot sensors in September 2025. The IP originates from Bharti Airtel's AS24560 network in India and represents a compromised end-user connection being weaponised for malicious activity without the owner's knowledge.
Detection data from automated honeypot sensors documented the Exploited Host classification across 20 individual reports during September 2025, with an aggregate volume of 199 total reports associated with this address. The 63% confidence score reflects moderate analytical certainty in the classification, acknowledging that some characteristics align with legitimate traffic patterns. The reported activity frequency of 0/10 suggests that while historical abuse has been documented, active malicious operations may have subsided at the time of the most recent assessment. The IP traces to Bharti Airtel Ltd. Telemedia Services in India, indicating the compromised system belongs to a residential or small-business broadband subscriber rather than a hosting provider.
An Exploited Host designation indicates that unauthorized parties have gained control of the endpoint and are deploying it as an attack platform, typically to conduct scanning, exploitation attempts or to relay malicious traffic while concealing the true source. The reported malware and exploit activity means this compromised machine is actively participating in operations that could target other networks or services across the internet. The risk extends beyond the compromised system itself, as it may be used to generate distributed attacks that are harder to attribute and block due to the residential ISP origin of the traffic.
Site operators should block IP 122.173.28.147 at the network edge as a precautionary measure given the critical threat rating. Implementing fail2ban or similar intrusion-prevention tools can automatically detect and mitigate repeated malicious connection attempts. Operators are encouraged to log and monitor for any incoming connections from this address to identify potentially exploited internal resources. If sustained blocking is not feasible, implementing strict rate-limiting on exposed services and enforcing strong multi-factor authentication across administrative interfaces provides meaningful defence against the exploitation techniques associated with compromised host activity.
