Name: Threat Intelligence: 185.89.157.230
Creator: UnwantedIP
License: https://creativecommons.org/licenses/by/4.0/

Threat LevelCRITICAL72/1001 rule type

3 incidents on record · last seen 27d ago

PTR	N/A
Org / ASN	ATU AL Network
Country	🇦🇱 Albania
City	Allambres, Berat County
Timezone	Europe/Tirane

Attack Analysis

Port 22 Honeypot Probe

This IP connected to a fake SSH honeypot — a port 22 listener that is not a real SSH server. This is an automated scanner fingerprinting targets before launching a brute-force campaign. Legitimate systems never probe port 22 without a specific reason; this activity is virtually 100% malicious.

Reports (3)

Date	Severity	Description
2 Sep 2026 - 17:48	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
2 Sep 2026 - 17:47	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
2 Sep 2026 - 17:44	high	IDS: Suricata alert — Honeypot: probe to closed SSH port 22

Report for IP: 185.89.157.230

Attack Analysis

Reports (3)

Related IPs — Same /24 Block (185.89.157.0/24)