Name: Threat Intelligence: 168.196.24.209
Creator: UnwantedIP
License: https://creativecommons.org/licenses/by/4.0/

Threat LevelCRITICAL72/1001 rule type

2 incidents on record · last seen 48d ago

PTR	N/A
Org / ASN	ISP GROUP SRL
Country	🇦🇷 Argentina
City	San Antonio Oeste, Rio Negro
Timezone	America/Argentina/Salta

Attack Analysis

Port 22 Honeypot Probe

This IP connected to a fake SSH honeypot — a port 22 listener that is not a real SSH server. This is an automated scanner fingerprinting targets before launching a brute-force campaign. Legitimate systems never probe port 22 without a specific reason; this activity is virtually 100% malicious.

Reports (2)

Date	Severity	Description
13 Aug 2026 - 06:59	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
13 Aug 2026 - 06:54	high	IDS: Suricata alert — Honeypot: probe to closed SSH port 22

Report for IP: 168.196.24.209

Attack Analysis

Reports (2)

Related IPs — Same /24 Block (168.196.24.0/24)