Maximum Danger
IP 185.193.240.246, registered in North Macedonia and operated by Globalsat Dooel under ASN AS212645, is a high-risk threat actor with a perfect 10/10 threat level and an 8/10 activity frequency score, generating 492 total abuse reports from 20 independent automated honeypot sensors. The overwhelming majority of recent reports (19 out of 22 categorized incidents) document repeated SSH brute-force attempts, indicating a sustained, methodical campaign to compromise servers with open SSH services.
Detection data spanning from September 2025 through June 2026 reveals consistent, high-volume SSH intrusion activity originating from this address. Suricata sensors flagged multiple active SSH sessions on expected ports, while Fail2ban logging documented between 25 and 37 authentication violations per blocking event, demonstrating persistent credential-guessing behaviour that automated defences have repeatedly triggered. The confidence score of 78% reflects the certainty that this traffic represents deliberate malicious probing rather than accidental or incidental network activity.
SSH brute-force attacks systematically attempt to gain unauthorized server access by iterating through common username/password combinations until valid credentials are discovered. Even when individual attempts fail, the sheer volume exhausts server resources, creates log noise that can mask genuine incidents, and exposes any weak or default credentials to compromise. If successful, attackers typically deploy backdoors, cryptocurrency miners, or use the compromised host as a pivot point for further network intrusion, transforming the victim server into an additional threat vector.
Site operators should immediately block 185.193.240.246 at the firewall level given its confirmed malicious status. Enforcing key-based SSH authentication and disabling password-based login entirely eliminates the attack vector these attempts target. Moving SSH to a non-standard port reduces exposure to automated scanning. Implementing fail2ban with aggressive ban thresholds will automatically block repeat offenders like this address. Regular audit of authentication logs and enforcement of strong, unique credentials on any exposed SSH services are essential complementary measures.
TR 
FR 
GB 
UA 
CA 
RO