Extreme Threat
IP address 195.178.110.218 is a high-risk address operating from Bulgaria under ASN AS48090 (Techoff Srv Limited), with a threat level of 10/10 and an 81% confidence score based on 693 total reports from 20 automated honeypot sensors spanning November 2025 through April 2026. The dominant activity consists of SSH brute-force intrusion attempts and evidence of host exploitation, indicating that this IP is actively used to compromise remote servers by guessing credentials or exploiting SSH configurations. Despite a low activity frequency rating of 0/10, the sheer volume of reports and consistent detection over a five-month period confirm persistent malicious intent.
The detection data reveals repeated Suricata alerts flagging active SSH sessions in progress on expected ports alongside brute-force attempts, a pattern consistent with automated credential-stuffing campaigns against publicly accessible SSH services. The "Exploited Host" classification in three recent reports further suggests that this IP may itself be operating from a previously compromised system, which is common in bulletproof hosting or scanning infrastructure. All 693 reports originate from automated honeypot sensors, indicating that the activity is systematic and not isolated to a single monitoring point. The geographic attribution to Bulgaria and the AS48090 network context provide additional signals for blocklisting decisions by operators hosting services in the targeted region.
SSH brute-force attacks remain one of the most prevalent initial-access vectors in real-world intrusions, allowing threat actors to gain unauthenticated shell access to servers and subsequently deploy malware, exfiltrate data or pivot deeper into a network. When an IP is also flagged as exploited, it suggests the attack infrastructure itself may be partially or fully controlled by a threat actor, increasing the risk that blocking the address alone will only temporarily disrupt targeting. The consistent use of expected SSH ports in the detected attack patterns indicates that the attacker is not employing significant obfuscation, relying instead on high-volume automation to exploit poorly configured or unpatched SSH deployments.
RO