Maximum Danger
IP 46.147.113.91 is a high-risk address operating from Russian infrastructure that presents a maximum threat level due to sustained, automated SSH brute-force activity generating 527 abuse reports across a nine-month observation window.
Automated honeypot sensors recorded this address conducting repeated SSH intrusion attempts between September 2025 and May 2026, with 20 distinct reports specifically categorising the malicious traffic as SSH attacks. The detection confidence stands at 76 percent, and the activity frequency of 6 out of 10 indicates persistent rather than sporadic engagement. The IP routes through AS57378, operated by JSC ER-Telecom Holding, a major Russian internet service provider whose infrastructure has been previously associated with automated scanning and credential attacks originating from residential broadband ranges.
SSH brute-force attacks represent one of the most common initial access vectors deployed against publicly exposed servers worldwide. Attackers systematically attempt combinations of default and weak credentials to compromise management interfaces, and successful access provides unrestricted control over the target system. The attack pattern logs document consistent sshd targeting with multiple violation events, indicating a methodical, automated campaign rather than opportunistic probing. Residential IP addresses like this one are frequently leveraged to bypass simple geographic IP blocking, as the traffic originates from a seemingly legitimate consumer connection rather than a known datacenter range.
Defensive measures should be implemented immediately for any service exposed to this address. Operators should enforce key-based authentication exclusively for SSH access, eliminating password-based login entirely. Deploying fail2ban or equivalent intrusion prevention tools to automatically block repeated authentication failures will disrupt the attack cycle. Changing the default SSH listening port reduces automated scanning exposure, and disabling direct root login eliminates a primary attack target. Continuous monitoring of authentication logs and implementing rate-limiting on SSH connection attempts will further reduce exposure to credential-guessing campaigns originating from addresses like 46.147.113.91.
RO 
HK 
ID 
TW 
MC 
UA