Critical Alert
IP 193.32.162.145 is a critical-risk address originating from Romania that has been flagged 479 times by automated honeypot sensors over approximately nine months, with the vast majority of activity linked to sustained SSH brute-force attacks and broader hacking reconnaissance. With a threat level of 10 out of 10 and an activity frequency rating of 8 out of 10, this IP represents one of the most consistently malicious automated threats observable in public telemetry data.
Detection data collected from 20 separate automated honeypot sensors spanning August 2025 through May 2026 documents 17 SSH-related incidents and 16 general hacking attempts, alongside a single report of the address functioning as an exploited host. Suricata intrusion-detection alerts explicitly document repeated SSH brute-force attempts, including sessions detected on expected SSH ports and stream packets bearing invalid timestamps—a signature consistent with automated password-guessing toolkits. The network is registered to Unmanaged Ltd operating AS47890 in Romania, suggesting either a deliberately unmanaged infrastructure purpose-built for malicious activity or a compromised system being weaponized by third parties.
SSH brute-force attacks systematically attempt to guess server credentials by cycling through common username-password combinations, exploiting systems that retain weak or default authentication settings. Successful compromise grants attackers persistent command-level access, enabling data exfiltration, malware deployment or incorporation of the victim machine into a botnet. The presence of exploited-host indicators suggests this IP may simultaneously serve as both an attack origin and a target of prior compromise, amplifying its danger to any exposed SSH service.
Operators running publicly accessible SSH services should block this address at the firewall level, implement fail2ban or equivalent rate-limiting rules to throttle repeated authentication failures, and enforce key-based authentication while disabling root login. Regular monitoring of authentication logs for patterns matching this source address and prompt application of security patches to SSH daemons will further reduce exposure to credential-stuffing campaigns.
SE 
MU 
IR 
GB