Maximum Danger
IP address 196.251.116.113 is a critical-risk address that generated 1,391 independent abuse reports from 20 distinct automated honeypot sensors between August and November 2025, with the dominant threat vector being SSH brute-force and credential-guessing activity.
Network attribution places this address within AS401116, operated by NYBULA and geolocated to the Netherlands — a jurisdiction that, despite robust data-protection laws, hosts numerous transit and hosting providers frequently exploited as anonymization layers by threat actors. The reported activity spanned approximately four months, indicating sustained rather than opportunistic engagement. The 63% confidence score reflects partial source corroboration across the honeypot network, while the fail2ban trigger logged for sshd confirms that connection attempts targeted exposed SSH daemons specifically. Although current activity frequency is assessed at zero, the historical report volume underscores the scale of the threat posed during the active window.
SSH brute-force activity of this volume and persistence presents a concrete risk to any internet-facing server running default SSH configurations. Automated attack tooling typically cycles through dictionaries of common usernames and weak passwords, attempting to establish authenticated sessions at scale. Successful compromise grants attackers persistent command-line access, enabling data exfiltration, lateral movement within networks, cryptomining deployment, or incorporation into botnets. The volume of 1,391 reports from honeypot infrastructure suggests this address conducted thousands of login attempts across targeted deployments during the reporting window.
Operators should implement key-based authentication exclusively, disable password authentication entirely, and configure fail2ban to auto-block repeat offenders after a small number of failed attempts. I recommend relocating SSH to a non-standard port, disabling root login, and enforcing strict allowlisting via firewall rules. Continuous monitoring of authentication logs remains essential to detect anomalous patterns before successful intrusion occurs.
SC 
RO