Maximum Danger
IP 193.46.255.86 is a critical-risk address originating from Romania that has been identified as an active platform for SSH brute-force intrusion attempts, with 392 abuse reports filed against it across a three-month surveillance window and a threat confidence score of 94 percent.
The IP address, registered to Unmanaged Ltd under ASN AS47890 in the Romanian address space, was first flagged by automated honeypot sensors in March 2026 and continues to generate reports through June 2026. The sustained reporting activity, combined with an activity frequency rating of 8 out of 10, indicates persistent rather than opportunistic behaviour. Network detection sensors consistently logged Suricata alerts signalling SSH brute-force attempts and active SSH sessions on expected ports, alongside ICMP unreachable messages administratively prohibiting communications — a pattern consistent with a compromised host being operated as a launch platform by a remote threat actor. Of the recent threat categorisations, Hacking activity accounts for 20 reports, SSH-targeted attacks for 18, and Exploited Host classifications for 5, suggesting this address may itself be a victimised system repurposed for malicious scanning.
SSH brute-force activity represents a concrete and immediate threat to any internet-facing server accepting password-based authentication. Automated tooling cycles through common credential combinations at scale until access is obtained, enabling subsequent lateral movement, data exfiltration or the deployment of secondary payloads. The repeated Suricata detection of "SSH session in progress" patterns against honeypot infrastructure confirms that credential-guessing cycles are being actively executed from this address, with ICMP administrative restrictions indicating the host may be operating behind a filtering boundary while still maintaining outbound attack capability.
Administrators managing publicly accessible SSH services should treat this IP as definitively hostile. Enforce key-based authentication exclusively and disable password-based login entirely. Implement fail2ban or equivalent dynamic blocking to automatically reject repeated connection attempts from misbehaving sources. Consider restricting SSH access to known IP ranges via firewall rules or access-control lists. Finally, if this address appears in logs for infrastructure you operate, block it unconditionally and monitor for any successful authentication anomalies, as the "Exploited Host" classification suggests the source system itself may be compromised without its owner's awareness.
FR 
SE 
TR