Critical Alert
IP 193.104.58.61 is a critical-risk address originating from Ukraine that has been reliably linked to sustained SSH compromise activity, with 226 abuse reports confirming repeated unauthorized access attempts and active sessions on expected SSH ports. The IP operates within AS25369 under Hydra Communications Ltd and carries a perfect 10/10 threat score, making it unambiguously dangerous to any exposed service.
The intelligence picture is built from 20 automated honeypot sensors that collectively logged 226 reports between August 2025 and March 2026. While the reported activity frequency score is low, the volume of distinct reports across multiple categories — Hacking (20), SSH (16), and Exploited Host (4) — demonstrates persistent, multi-vector engagement over an eight-month window. Suricata alerts recovered from sanitized attack-pattern data reveal a clear escalation pattern: automated honeypots first detected SSH brute-force attempts, progressed through logged SSH sessions on expected ports, and ultimately observed active SSH command activity. This sequence strongly suggests the IP is actively exploiting SSH services rather than merely scanning for them, with the "Exploited Host" classification indicating the source system itself may be compromised and repurposed as an attack platform without its operator's knowledge.
SSH brute-force activity represents one of the most prevalent real-world threats to internet-exposed servers, as attackers systematically attempt credential combinations to gain shell access. When combined with active session detection on standard SSH ports, this pattern indicates the operator has likely succeeded in compromising at least one target and is using that foothold for lateral movement, data exfiltration, or further propagation. The "Exploited Host" classification adds a secondary concern: the IP address itself may belong to an unwitting victim organization whose infrastructure is being weaponized, amplifying the potential blast radius of any successful intrusion.
Site operators with SSH services accessible from the internet should immediately block 193.104.58.61 at the network perimeter or firewall level. Implement key-based authentication exclusively and disable password-based SSH login entirely to neutralize credential-guessing campaigns. Deploy fail2ban or equivalent intrusion-prevention tools to dynamically ban repeat offenders, and ensure root login over SSH is disabled. Given the confirmed "Exploited Host" classification, operators may also consider notifying the upstream provider — Hydra Communications Ltd — to facilitate remediation of the compromised source system.
FR 
NL 
VN 
ES 
BD 
JP 
BY 
CH 
LK