Extreme Threat
IP 185.246.130.20 is a high-risk address associated with extensive SSH brute-force attack campaigns and is flagged as an exploited host, presenting a severe threat to any exposed SSH services on the internet. With 1,124 total abuse reports across automated honeypot sensors and a threat level of 10 out of 10, this IP has demonstrated persistent malicious activity over approximately eight months from October 2025 through June 2026, with an activity frequency rated 8 out of 10. The concentration of report categories—SSH attacks and exploited host classifications dominating the most recent submissions—indicates that this address is not merely probing but actively compromising or being leveraged as an attack platform.
The volume and consistency of reports against 185.246.130.20 paint a clear picture of automated, high-intensity hostile activity. Twenty separate automated honeypot sensors detected this IP engaging in repeated SSH brute-force attempts, generating 19 reports categorized as SSH attacks and 8 as exploited host activity alongside 19 general hacking reports. The network is registered in Sweden and operated by w1n ltd under ASN AS42237, and the sustained detection pattern spanning nearly the entire available reporting window demonstrates that this host has maintained its malicious operations despite sustained exposure to the security community. The detection signatures include Suricata alerts flagging broken acknowledgment packets commonly associated with TCP manipulation during credential stuffing, as well as direct detection of active SSH sessions on expected ports.
SSH brute-force attacks represent one of the most common and effective initial access vectors used by threat actors to compromise servers and network infrastructure. By systematically guessing common username and password combinations, attackers using this technique attempt to gain unauthorized shell access to exposed systems. When an IP is classified as an exploited host, it indicates that the address itself may be compromised and operating under the control of external threat actors, effectively weaponizing it as part of a botnet or attack relay. The real-world risk to any organization running an exposed SSH service is direct: successful authentication grants attackers a foothold for data exfiltration, lateral movement, deployment of additional payloads, or use of the compromised system for further attacks against other targets.
UA 
RO 
GB 
MA