Maximum Danger
IP 80.94.95.118 is a critical-risk address operating from Romania that has been persistently conducting SSH brute-force intrusion attempts since August 2025, accumulating 477 abuse reports across 20 automated honeypot sensors with a threat level of 10 out of 10.
Recorded activity spans approximately eleven months, from August 2025 through June 2026, placing this IP well within the recent reporting window. The network is registered to SS-Net under autonomous system AS204428, and the volume of 477 reports combined with an activity frequency score of 8 out of 10 indicates sustained, aggressive targeting rather than opportunistic scanning. Detection signatures from network intrusion monitoring systems, including Suricata ruleset alerts, specifically identified SSH brute-force patterns against expected service ports, confirming the intent to compromise exposed Secure Shell services through credential-guessing attacks. The 72% confidence score reflects substantial corroborating evidence across multiple sensor sources.
SSH brute-force attacks represent one of the most common initial-access vectors against internet-facing Linux servers and network infrastructure. Attackers systematically cycle through username and password combinations to guess valid credentials, and a successful compromise grants remote command execution with the privileges of the compromised account, often leading to full system takeover, data exfiltration or deployment of secondary payloads. This IP's concentrated focus on SSH, as evidenced by the dominant threat category across 40 reported incidents, demonstrates a deliberate, methodical campaign rather than generic port scanning.
Operators running exposed SSH services should treat IP 80.94.95.118 as definitively hostile and block it at the network perimeter firewall. Strong authentication hygiene is essential: disable password-based login entirely in favor of public-key cryptography, rename the default port 22 to a non-standard value, and enforce fail2ban or equivalent tools to automatically ban IPs after a small number of failed authentication attempts. Rate-limiting incoming connections to port 22 and implementing two-factor authentication for privileged accounts further reduces the practical risk from this class of attack.
UA 
GB 
CO 
CA 
VN