Critical Alert
IP 109.107.189.250 is a maximum-threat-level address operated by Aeza Group LLC in Russia that has been directly linked to SSH brute-force intrusion attempts, with 160 independent abuse reports confirming sustained automated attack behavior targeting secure shell services. The IP carries a 10/10 threat classification and was first flagged by automated honeypot sensors in January 2026, indicating active hostile infrastructure under continuous observation.
The IP resides on ASN AS216246 operated by Aeza Group LLC, a Russian hosting provider, and has accumulated 160 total reports from automated honeypot sensors that detected the hostile activity. Community reporting and honeypot telemetry corroborate that the dominant threat vectors are hacking intrusion attempts and SSH credential-guessing attacks, collectively accounting for 35 of the most recent threat categorizations. The detection window spans January 2026, with no documented decrease in observed malicious behavior. The 62% confidence score reflects moderate certainty that all attributed activity originates from this single source, though the volume of independent sensor reports strengthens confidence in the assessment.
SSH brute-force attacks represent one of the most prevalent automated threats facing publicly accessible servers, where adversaries systematically iterate username and password combinations to guess valid shell credentials. This IP's activity pattern indicates scanning infrastructure designed to identify and compromise poorly secured SSH daemons by systematically attempting common credential pairs. The real-world risk extends beyond unauthorized server access to potential data exfiltration, lateral movement within networks, and deployment of secondary payloads such as cryptocurrency miners or backdoors. Servers exposed to the internet with password-based authentication face immediate compromise risk when targeted by infrastructure of this nature.
Site operators should implement immediate defensive controls: enforce key-based SSH authentication exclusively while disabling password-based login entirely, configure fail2ban or equivalent intrusion-prevention tools to automatically block repeated authentication failures, and consider relocating SSH services to non-standard ports to reduce automated scanning exposure. Regular audit of authentication logs, implementation of strong password policies, and maintenance of current security patches across all internet-facing systems are essential to mitigating risks posed by IP addresses exhibiting this level of hostile activity.
FI