Elevated Risk
IP 87.251.64.145 is a high-risk address assessed at 8/10 threat level with a 93% confidence score, definitively linked to persistent SSH brute-force attacks against exposed servers. This US-based IP has generated 327 total abuse reports through automated honeypot sensors between April and June 2026, indicating sustained and aggressive scanning activity with an activity frequency rated 8/10. The volume and consistency of these reports establish a clear pattern of malicious probing behaviour rather than isolated incident noise.
Network reconnaissance reveals this address originates from AS200730, operated by ISAEV Igor, a network entity that has attracted significant negative reputation metrics across security communities. The honeypot telemetry shows the IP conducting continuous SSH brute-force campaigns, with recorded violations reaching 25 instances on monitored sshd services. This concentration of identical attack methodology across multiple detection points confirms coordinated, automated exploitation attempts targeting the SSH protocol as an entry vector into Linux-based infrastructure.
SSH brute-force attacks represent a critical initial-access threat, where adversaries systematically guess authentication credentials to compromise servers running OpenSSH or similar implementations. The real-world risk extends beyond successful unauthorized access: even failed attempts consume server resources, generate authentication logs, and reveal the existence of target systems to threat actors conducting broader reconnaissance. Successful compromise through weak or default credentials typically grants shell access, enabling lateral movement, data exfiltration or deployment of secondary payloads such as cryptocurrency miners and backdoors.
Network defenders should immediately block 87.251.64.145 at the firewall level and implement fail2ban to dynamically ban repeat offenders after configurable violation thresholds. SSH services should enforce key-based authentication exclusively, disable root login and change the default port from 22 to a non-standard alternative. Rate-limiting authentication attempts and enforcing strong password policies with regular rotation further reduce attack surface. Continuous monitoring of authentication logs for this IP address and similar scanning patterns from adjacent network ranges in AS200730 will help identify follow-up threat activity targeting previously scanned environments.
PL 
MX 
SC 
EG