Severe Risk
IP 193.104.58.60, registered in Ukraine and operated through Hydra Communications Ltd (AS25369), is a high-risk threat actor with a 10/10 threat level and a substantial body of evidence supporting its malicious intent. With 196 independent abuse reports spanning September 2025 through March 2026 and detections across 20 automated honeypot sensors, this address has been consistently flagged for aggressive intrusion activity. The dominant threat profile centres on SSH brute-force attempts and general hacking reconnaissance, alongside a smaller cluster of indicators suggesting the source may itself be running on a previously compromised host.
The report corpus for IP 193.104.58.60 reveals a clear concentration on SSH-focused attack patterns. Suricata alerts consistently document active SSH sessions in progress on expected SSH ports, with the majority of classified reports categorised as Hacking (20 reports) and SSH (17 reports). A smaller subset of 3 reports classifies the behaviour as Exploited Host, indicating that at least one reliable detection source observed operational characteristics consistent with an attack platform hosted on a previously compromised system rather than a dedicated attacker infrastructure. Despite the high report volume, the activity frequency score of 0/10 suggests that reported events are concentrated rather than evenly distributed across the observation window, which is consistent with targeted scanning bursts rather than continuous broad-spectrum assault. The 65% confidence score reflects the inherent uncertainty of classifying IP behaviour without direct packet inspection, but the sheer volume of independent sensor corroboration elevates the reliability of the assessment.
SSH brute-force activity represents a concrete, real-world threat to any internet-facing server running the SSH daemon on standard ports. Attackers automating credential-guessing against weak or default passwords can achieve lateral movement and server takeover within minutes on unhardened systems. The Suricata signatures logged against this address indicate that active sessions were being established — not merely connection attempts — which implies that authentication may have succeeded on some targets or that the attacker was conducting interactive enumeration. The Exploited Host classification further raises the possibility that the origin IP itself is a burned asset, recycled by threat actors who have already pivoted to fresh infrastructure, making the effective lifespan of any single-source block potentially short-lived.
FR 
NL 
VN 
ES 
BD 
JP 
BY 
CH 
LK