Critical Threat
IP 45.228.8.33 is a high-risk address assessed at a threat level of 10/10 that has generated 1,075 abuse reports from automated honeypot sensors, with the dominant activity involving SSH brute-force attempts targeting servers with exposed SSH services. The IP originates from Brazil and is routed through AS267062 operated by W-NET TELLECOM EIRELI ME.
Analysis of the available telemetry data reveals an extremely active threat actor with 1,075 reports consolidated across 20 separate automated honeypot sensors, yielding a confidence score of 94% regarding the malicious nature of this activity. The Suricata detection system identified the IP repeatedly establishing SSH sessions on commonly expected ports and executing brute-force authentication attacks. All reported activity falls within the single month of April 2026, demonstrating sustained and focused scanning behavior throughout that period. The presence of both general hacking probes and specific SSH attack signatures indicates a persistent automated campaign rather than opportunistic scanning.
SSH brute-force attacks represent a well-documented attack methodology where threat actors systematically attempt authentication against servers listening on port 22 or alternative SSH ports. These attacks exploit weak or default credentials to gain unauthorized entry into Linux-based systems, cloud infrastructure and network devices. Detection signatures from Suricata confirmed active SSH sessions in progress on expected ports alongside explicit brute-force attempt markers, indicating the IP is actively engaged in credential stuffing operations against exposed SSH endpoints. The volume of reports combined with a threat level of 10/10 signals severe risk for any internet-facing SSH service that accepts password-based authentication.
Immediate defensive measures include implementing key-based authentication as the sole login method, deploying fail2ban or similar intrusion prevention tools to automatically block repeat offenders, and restricting SSH access through firewall rules or security group configurations. Organizations should monitor authentication logs for the originating IP and consider implementing multi-factor authentication for privileged access. Regular review of SSH server configurations and immediate investigation of any successful authentication from this address is strongly advised.
FR 
RO 
MX