Critical Alert
IP 196.251.80.153 is a high-risk address originating from Seychelles and operated by CHEAPY-HOST (AS401120), assessed at a maximum threat level of 10/10 following 262 total abuse reports submitted through automated honeypot sensors between September and November 2025, with SSH-based intrusion attempts identified as the dominant malicious activity. The confidence score of 71% reflects substantial evidence linking this IP to coordinated credential-guessing campaigns against exposed Secure Shell services. Despite a low reported activity frequency of 0/10, the volume of distinct incident reports indicates persistent automated scanning behaviour rather than isolated probing, making this address a credible and ongoing threat to any publicly accessible SSH daemon.
Community reports and honeypot telemetry documented 262 separate incidents attributed to this single IP, with the most recent confirmed observations occurring in November 2025. Detection sources include 20 distinct automated honeypot sensors, confirming the IP's repeated targeting of SSH services across multiple monitored environments. Attack-pattern indicators extracted from these reports reference active fail2ban triggers on sshd, confirming that the IP generated sufficient anomalous authentication traffic to trigger defensive rule enforcement on at least one target system. The Seychelles origin and CHEAPY-HOST ASN designation align with patterns commonly observed from budget hosting providers frequently abused for anonymised scanning and brute-force operations.
SSH brute-force and credential-guessing attacks represent a well-documented initial-access vector used by threat actors to establish persistence on Linux servers and network appliances. Successful authentication against a weak or default SSH credential grants the attacker a foothold equivalent to direct console access, enabling data exfiltration, lateral movement within internal networks, cryptocurrency mining deployment, or use of the compromised host as a pivot point for further attacks. Even failed attempts are operationally valuable to attackers, as they enumerate valid username structures and test credential patterns across target ranges. The fail2ban evidence confirms that 196.251.80.153 engaged in high-volume automated authentication probing designed to exploit misconfigured or poorly monitored SSH deployments at scale.
NL 
RO 
GB 
JP 
LV 
KR 
TH