Critical Threat
IP 2.57.122.238 is a critical-risk address originating from Romania, operated by Unmanaged Ltd under ASN AS47890, that has been relentlessly conducting SSH brute-force attacks and related intrusion activity since November 2025, accumulating 13,894 abuse reports across 20 automated honeypot sensors with an activity frequency rated 8 out of 10 and a threat level of 10 out of 10.
Threat intelligence data shows 18 recent reports categorised as SSH activity, 14 as general hacking attempts, 3 as brute-force attempts, and 3 indicating this IP may itself be an exploited host being weaponised without its operator's knowledge. The detection timeline spans November 2025 through June 2026, indicating sustained, persistent offensive operations over at least seven months. Automated honeypot sensors consistently logged SSH brute-force patterns, with corresponding Suricata alerts confirming active SSH sessions on expected ports. Fail2ban blocks on RBL nodes further corroborate repeated authentication failure attempts targeting SSH services. The 71% confidence score reflects that while the threat pattern is unambiguous, attribution to a specific threat actor or coordinated campaign cannot be definitively established from the available data.
SSH brute-force attacks represent one of the most common and effective initial access vectors used by threat actors to compromise servers, deploy ransomware, exfiltrate data, or pivot deeper into network infrastructure. The sheer volume of reports (13,894) and sustained activity frequency demonstrate an automated, high-volume operation likely conducted via botnets or compromised infrastructure. The presence of "Exploited Host" classifications suggests this IP may simultaneously serve as both an attack platform and a compromised asset, indicating poor network hygiene or intentional permissive hosting by Unmanaged Ltd, which describes itself as an unmanaged service provider.
Site operators with publicly accessible SSH services should immediately block IP 2.57.122.238 at the firewall or network edge, implement key-based authentication in preference to password authentication, and ensure fail2ban or equivalent tools are configured to automatically block repeated authentication failures. Disabling root login, changing the default SSH port, and enforcing strong account lockout policies significantly reduce the effectiveness of such attacks. Operators receiving reports of internal compromised hosts should consider notifying the hosting provider regarding the exploited-host classifications associated with this address.
GB 
JP 
LV 
KR 
TH 
PL