Name: Threat Intelligence: 89.109.50.16
Creator: UnwantedIP
License: https://creativecommons.org/licenses/by/4.0/

Threat LevelCRITICAL72/1001 rule type

2 incidents on record · last seen 10d ago

PTR	89-109-50-16.dynamic.mts-nn.ru
Org / ASN	AS12389 PJSC Rostelecom
Country	🇷🇺 Russia
City	Nizhniy Novgorod, Nizhny Novgorod Oblast
Timezone	Europe/Moscow

Attack Analysis

Port 22 Honeypot Probe

This IP connected to a fake SSH honeypot — a port 22 listener that is not a real SSH server. This is an automated scanner fingerprinting targets before launching a brute-force campaign. Legitimate systems never probe port 22 without a specific reason; this activity is virtually 100% malicious.

Reports (2)

Date	Severity	Description
20 Sep 2026 - 07:53	high	IDS: Honeypot probe — port 22 listener that is not a real SSH server — Honeypot: probe to closed SSH port 22
20 Sep 2026 - 07:50	high	IDS: Honeypot probe — port 22 listener that is not a real SSH server — Honeypot: probe to closed SSH port 22

Report for IP: 89.109.50.16

Attack Analysis

Reports (2)

Related IPs — Same /24 Block (89.109.50.0/24)