Critical Threat
IP 147.45.50.147 represents a critical threat with a 10/10 threat level and an extensive abuse history spanning six months, with 3,671 total reports filed across automated honeypot sensors. Operating from the Netherlands under ASN AS215540 (Global Connectivity Solutions Llp), this address has been persistently engaged in SSH brute-force attacks against exposed services since November 2025, with the most recent activity confirmed in May 2026. The volume of reports and the sustained nature of the malicious behavior indicate a dedicated attack infrastructure rather than opportunistic scanning.
The data supporting this assessment comes from 20 separate automated honeypot sensors that collectively documented thousands of interaction attempts. Fail2ban logging from targeted systems recorded multiple violation clusters, with specific incidents showing 25 and 10 violations per event window, all categorised as SSH brute-force attacks. Suricata intrusion detection systems additionally flagged active SSH sessions being established on expected ports, suggesting the attacker was either conducting reconnaissance or had achieved partial authentication success. The 74% confidence score reflects the high certainty of malicious intent despite the lack of complete attribution to a specific threat actor.
SSH brute-force attacks target the Secure Shell protocol that administrators rely on for remote server management. Attackers systematically attempt credential combinations against exposed SSH daemons, exploiting weak or default passwords to gain unauthorised server access. Successful compromise grants attackers persistent access to internal networks, enabling data exfiltration, malware deployment, or use of the compromised machine as a pivot point for further attacks. With 3,671 reported interactions, IP 147.45.50.147 has demonstrated sustained, high-volume targeting of SSH services with clear intent to achieve unauthorised entry.
Site operators with publicly accessible SSH services should immediately block this IP address at the firewall or network edge. Enforcing key-based authentication instead of password-based login eliminates the attack vector entirely. Implementing fail2ban to automatically ban IPs after repeated failed authentication attempts provides an additional layer of protection. Changing the default SSH port from 22 to a non-standard port reduces exposure to automated scanning. Disabling root login and enforcing strong, non-default passwords for all accounts further hardens services against credential-guessing campaigns of this nature.
US 
SC 
FR 
TR 
LT 
PT 
BG 
PL 
CH 
AM 
NO 
GR 
GB 
UA 
MX 
RO