Maximum Danger
IP 103.99.144.99, originating from India and operated by Kerala Vision Broad Band Private Limited, represents a critical cybersecurity threat with a danger rating of 10 out of 10 and a 95% confidence score based on 171 total abuse reports. This address has been flagged across 20 independent automated honeypot sensors with sustained activity frequency rated 8 out of 10, indicating persistent and aggressive malicious behavior over a four-month observation window from February to May 2026.
The overwhelming majority of recent reports—16 of 20 documented threat events—classify the activity as SSH-related intrusion attempts, with an additional 4 reports documenting general hacking behavior. Detection systems logged multiple Suricata alerts indicating active SSH sessions being established on non-standard ports consistent with brute-force reconnaissance patterns. Fail2ban monitoring systems recorded no fewer than 25 violations from this single source, definitively confirming repeated automated credential-guessing attacks targeting the SSH service. The sustained volume and persistence of these attempts across the four-month reporting period demonstrates a deliberate, systematic campaign rather than opportunistic scanning.
SSH brute-force attacks pose a direct and severe risk to any exposed Linux or Unix-based server. Attackers use automated tools to systematically guess authentication credentials, and once successful, they gain shell access enabling data exfiltration, malware deployment, lateral network movement, or conversion into a botnet node. The detection of active SSH sessions on unexpected ports suggests this actor may also be employing techniques designed to evade standard detection, potentially testing for backdoor access or non-standard service configurations.
Organizations exposing SSH services to the internet should immediately audit their access controls and authentication mechanisms. Key-based authentication should replace password-based access entirely, and the default TCP port 22 should be changed to a non-standard alternative. Implementing automated threat-response tools such as fail2ban or equivalent solutions can dynamically block IPs after a configurable number of authentication failures. Root login over SSH should be disabled, and intrusion detection systems should be configured to alert on non-standard SSH session patterns. Continuous monitoring and regular review of authentication logs remain essential for identifying and mitigating similar threats originating from this or related addresses.
BG 
CA 
FR 
PE 
MX 
LV 
MY