Critical Threat
IP address 80.94.95.221 is a critical-risk address originating from Romania, assigned to network operator SS-Net (ASN AS204428), with a threat level of 10 out of 10 and 452 total abuse reports filed through automated honeypot sensors over approximately six months of sustained hostile activity.
The IP has been observed engaging in persistent intrusion attempts, with 452 reports accumulated between November 2025 and May 2026, yielding an activity frequency rating of 8 out of 10. Detection sources span 20 distinct automated honeypot sensors distributed across multiple monitoring points, indicating this address is systematically probing a wide range of targets. The overwhelming majority of recent reports — 18 of the 20 most recent categorizations — classify the activity as general hacking, encompassing unauthorized access attempts and exploitation vectors. The remaining two reports categorize the IP as an exploited host, suggesting the infrastructure itself may be compromised and operating under adversarial control without the owner's awareness.
The dominant hacking activity observed from 80.94.95.221 includes repeated connection attempts targeting exposed services, pattern-of-behaviour indicators consistent with reconnaissance and vulnerability probing, and Redis-directed attack sequences. Suricata intrusion detection systems flagged this address for stream-level anomalies featuring malformed acknowledgment packets, a technique commonly employed to evade detection or exploit stateful inspection weaknesses. This combination of vectors points to an attacker leveraging a possibly compromised Romanian host to conduct distributed probing and exploitation campaigns against services exposed to the internet.
Administrators with services accessible from this IP space should block 80.94.95.221 at the network perimeter and implement geolocation-based restrictions if Romanian source traffic is not expected. Deploy fail2ban or equivalent dynamic blockade tools to automatically reject repeated connection attempts targeting Redis or other observed attack surfaces. Enforce strong authentication, disable unnecessary services, and ensure all exposed software remains current with security patches. Providers operating within AS204428 should consider reaching out to SS-Net regarding the reported activity from this address.
HK 
IT