Maximum Danger
IP 45.148.10.240 is a critical-risk address originating from the Netherlands that has been flagged in 9,154 incident reports linked predominantly to SSH brute-force intrusion attempts. With a threat level score of 10 out of 10 and detection across 20 independent automated honeypot sensors, this IP represents an active, persistent threat to exposed SSH services worldwide. The activity, spanning October 2025 through May 2026, demonstrates sustained hostile intent over approximately eight months, with the overwhelming majority of reports (19 of 38 categorized threats) focused on credential-guessing attacks against SSH endpoints.
The 9,154 total reports arriving from 20 honeypot sensors give this IP an exceptionally high abuse score despite its relatively modest activity frequency rating of 2 out of 10. This pattern is characteristic of methodical, distributed attack campaigns rather than opportunistic scatter-gun scanning. The IP is registered to Techoff Srv Limited under ASN AS48090 in the Netherlands, and alongside the dominant SSH activity, 18 additional reports document general hacking reconnaissance and intrusion activity, with one report indicating the IP may itself be functioning as an exploited attack platform. The 71% confidence score reflects the certainty of malicious classification rather than uncertainty about the activity itself.
SSH brute-force attacks attempt to gain unauthorized server access through automated password guessing or exploitation of misconfigured SSH services. The Suricata signatures logged against this IP specifically reference active SSH sessions on expected ports, indicating successful handshake establishment with target honeypots before credential abuse commenced. For organizations with exposed SSH services on default or non-standard ports, such an IP poses a direct risk of unauthorized administrative access, data exfiltration, or lateral movement within internal networks. The presence of an "Exploited Host" classification alongside the brute-force activity suggests this address may itself be a compromised system repurposed as an attack launchpad, complicating attribution to its nominal network operator.
Site operators should immediately block IP 45.148.10.240 at the network perimeter firewall and implement fail2ban or equivalent dynamic denial-of-service tooling to automatically ban repeated SSH authentication failures. Switching to public-key-based authentication, disabling root login over SSH, and relocating SSH services to non-standard ports significantly reduces susceptibility to these automated credential-guessing campaigns. Continuous monitoring of authentication logs for connections originating from this address and regular review of intrusion detection signatures will help identify any successful breach attempts. Organizations discovering established sessions from this IP should treat the affected host as potentially compromised and initiate incident response procedures.
BG 
UA 
GB 
CO 
VN 
TH