This IP address has been reported a total of
176
times from
116 distinct
sources.
103.191.178.42 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Automated report: SSH brute force detected. This IP exceeded the allowed number of failed login atte ...
show moreAutomated report: SSH brute force detected. This IP exceeded the allowed number of failed login attempts (3 attempts).
show less
Attempted credential compromise using three username/password pairs (345gs5662d34/345gs5662d34, wfp/ ...
show moreAttempted credential compromise using three username/password pairs (345gs5662d34/345gs5662d34, wfp/3245gs5662d34, wfp/wfp) via libssh 0.9.6. Two commands executed across separate sessions: (1) SSH key injection attack—removed existing .ssh directory, recreated it, and injected a public RSA key (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx) to establish persistent remote access; (2) File attribute manipulation using chattr and lockr commands targeting .ssh directory to prevent removal or modification, hardening persistence against administrative remediation. Attack pattern indicates automated credential spraying with immediate post-compromise SSH key planting and immutability flagging. No malware downloads or lateral movement observed within captured session windows. Persistence achieved through SSH public key installation combined with file locking mechanisms.
show less
2026-06-13T23:04:13.325465 prodgateway sshd-session[55737]: pam_unix(sshd:auth): authentication fail ...
show more2026-06-13T23:04:13.325465 prodgateway sshd-session[55737]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.191.178.42
2026-06-13T23:04:15.055990 prodgateway sshd-session[55737]: Failed password for invalid user zoom from 103.191.178.42 port 34728 ssh2
2026-06-13T23:06:06.973858 prodgateway sshd-session[55748]: Invalid user logserver from 103.191.178.42 port 37256
...
show less
2026-06-13T20:40:29.900084+00:00 hyperion sshd[421424]: pam_unix(sshd:auth): authentication failure; ...
show more2026-06-13T20:40:29.900084+00:00 hyperion sshd[421424]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.191.178.42
2026-06-13T20:40:31.808820+00:00 hyperion sshd[421424]: Failed password for invalid user stc from 103.191.178.42 port 55442 ssh2
2026-06-13T20:42:26.370467+00:00 hyperion sshd[421593]: Connection from 103.191.178.42 port 38382 on 91.121.149.190 port 1122 rdomain ""
2026-06-13T20:42:27.327391+00:00 hyperion sshd[421593]: Invalid user export from 103.191.178.42 port 38382
2026-06-13T20:42:27.331406+00:00 hyperion sshd[421593]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.191.178.42
2026-06-13T20:42:29.440512+00:00 hyperion sshd[421593]: Failed password for invalid user export from 103.191.178.42 port 38382 ssh2
2026-06-13T20:44:20.793020+00:00 hyperion sshd[421757]: Connection from 103.191.178.42 port 50038 on 91.121.149.190 port 1122 rdomain ""
2026-06-13T20:44:21.752008+00:00 hyper
...
show less
2026-06-13T20:28:02.857107+00:00 mia.updn.io sshd[193791]: Failed password for invalid user merkur f ...
show more2026-06-13T20:28:02.857107+00:00 mia.updn.io sshd[193791]: Failed password for invalid user merkur from 103.191.178.42 port 38584 ssh2
2026-06-13T20:37:35.222853+00:00 mia.updn.io sshd[231569]: Invalid user bulten from 103.191.178.42 port 44718
2026-06-13T20:37:35.225786+00:00 mia.updn.io sshd[231569]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.191.178.42
2026-06-13T20:37:37.579424+00:00 mia.updn.io sshd[231569]: Failed password for invalid user bulten from 103.191.178.42 port 44718 ssh2
2026-06-13T20:39:40.236442+00:00 mia.updn.io sshd[240085]: Invalid user stc from 103.191.178.42 port 46098
...
show less
Brute-Force
SSH
Anonymous
2026-06-13T22:37:16.846407 prodgateway sshd-session[55567]: pam_unix(sshd:auth): authentication fail ...
show more2026-06-13T22:37:16.846407 prodgateway sshd-session[55567]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.191.178.42
2026-06-13T22:37:18.924613 prodgateway sshd-session[55567]: Failed password for invalid user bulten from 103.191.178.42 port 60250 ssh2
2026-06-13T22:39:22.251676 prodgateway sshd-session[55579]: Invalid user stc from 103.191.178.42 port 51308
...
show less
2026-06-13T20:42:50.178027+01:00 hetzner-1 sshd[3941671]: Invalid user gazeta from 103.191.178.42 po ...
show more2026-06-13T20:42:50.178027+01:00 hetzner-1 sshd[3941671]: Invalid user gazeta from 103.191.178.42 port 39012
2026-06-13T20:44:54.815137+01:00 hetzner-1 sshd[3941708]: Invalid user vm2 from 103.191.178.42 port 49776
2026-06-13T20:47:08.501655+01:00 hetzner-1 sshd[3941710]: Invalid user websrv from 103.191.178.42 port 55824
...
show less
Brute-Force
SSH
Anonymous
2026-06-13T19:33:41.677883+00:00 de-fra2-nat641 sshd[3401041]: Invalid user ham from 103.191.178.42 ...
show more2026-06-13T19:33:41.677883+00:00 de-fra2-nat641 sshd[3401041]: Invalid user ham from 103.191.178.42 port 60312
2026-06-13T19:43:20.474006+00:00 de-fra2-nat641 sshd[3401420]: Invalid user gazeta from 103.191.178.42 port 37922
2026-06-13T19:45:24.618606+00:00 de-fra2-nat641 sshd[3401436]: Invalid user vm2 from 103.191.178.42 port 35670
...
show less