Critical Threat
IP 171.25.158.47 is a critical-risk address linked to sustained SSH brute-force attacks, with 227 abuse reports and a confirmed 10/10 threat level supported by automated honeypot detection across multiple sensors spanning five months of documented malicious activity.
The Swedish IP, registered to AS35100 under operator Patrik Lagerman, has been actively targeting SSH services since January 2026, with the most recent reports received in May 2026. Automated honeypot sensors have logged 20 separate confirmations of brute-force login attempts originating from this address. Abstracted fail2ban telemetry reveals escalating violation counts across multiple honeypot instances, indicating persistent and repeated authentication attack campaigns rather than isolated scanning. The IP reputation for this address has been severely degraded by this concentrated, deliberate focus on compromising SSH credentials.
SSH brute-force attacks systematically attempt to gain unauthorized server access by cycling through username and password combinations, exploiting weak or default credentials on exposed SSH daemons. This attack vector poses a direct threat to any internet-facing Linux or Unix server running an accessible SSH service, as successful authentication grants the attacker a functional shell with the compromised user's privileges. The documented pattern of escalating violation counts demonstrates an active, determined adversary willing to sustain repeated login attempts over extended periods against multiple targets.
Site operators should immediately block IP 171.25.158.47 at the firewall level and monitor authentication logs for any matching connection attempts. Deploying fail2ban or equivalent intrusion-prevention tools to automatically ban IPs with excessive failed login attempts is strongly recommended. SSH configurations should enforce key-based authentication exclusively, disable direct root login, and consider moving the service to a non-default port to reduce exposure. Organizations with publicly accessible SSH services should implement account lockout policies and consider geographic or IP-based access restrictions where feasible.
RO