High Risk
IP 87.251.64.144 is a high-risk address that automated honeypot sensors and community reports have flagged with a threat level of 8/10, linked to persistent SSH brute-force attack activity targeting servers worldwide.
Security monitoring systems recorded 319 total abuse reports attributed to this IP over a concentrated detection window spanning April 2026 through June 2026, with a notably high activity frequency score of 8/10. The IP originates from a network operated by ISAEV Igor under ASN 200730 in the United States. All 20 of the most recent threat reports specifically document SSH (Secure Shell) intrusion attempts, detected exclusively through automated honeypot infrastructure. Fail2ban sensors captured multiple sshd authentication failures, with at least 25 violations logged against protected services during the observation period, indicating sustained and systematic credential-guessing campaigns rather than opportunistic scanning.
SSH brute-force attacks represent one of the most common initial-access vectors in server compromise, where threat actors systematically attempt username and password combinations against exposed SSH daemons to gain unauthorized shell access. The concentration of violations observed against honeypot sensors suggests the address is part of an active scanning operation, likely leveraging wordlists of common credentials to compromise misconfigured or poorly hardened Linux and network devices. Successful authentication grants attackers persistent remote access, enabling data exfiltration, malware deployment, or lateral movement within compromised infrastructure.
Site operators running publicly accessible SSH services should immediately implement defensive controls: enforce key-based authentication and disable password-based login entirely, change the default SSH port to reduce automated targeting, and deploy tools such as fail2ban to automatically block IPs demonstrating brute-force behavior. Regularly auditing authorized keys, restricting root login, and monitoring authentication logs for unusual source addresses will further reduce exposure to credentials-based intrusion attempts of this nature.
PL 
MX 
SC 
EG