Notable Threat
IP 185.196.9.127 is a high-risk address with a threat level of 8/10 that has been linked to SSH brute-force intrusion attempts, accumulating 157 total abuse reports across automated honeypot sensors in a two-month window between February and March 2026. The sheer volume of reports and a confidence score of 100 percent indicate this is not an isolated incident but sustained, deliberate hostile activity targeting exposed SSH services.
Detection data confirms that automated honeypot sensors across 20 distinct reporting sources logged repeated SSH brute-force events attributed to this single IP address. The IP is registered to Global-Data System IT Corporation operating under ASN 42624 and geolocated to the United Kingdom, though the origin of the attacking infrastructure may differ from the registered location. With an activity frequency rating of 8/10, the address has demonstrated consistent persistence, generating an average of multiple reports per day over its active period. Fail2ban logs corroborate these findings, showing sshd-related violation patterns consistent with automated credential-guessing campaigns.
SSH brute-force attacks represent one of the most common initial-access vectors used by threat actors to compromise Linux servers and network appliances. By systematically attempting username and password combinations against an exposed SSH daemon, attackers can eventually guess weak credentials and gain unrestricted shell access to a target system. Once inside, they can deploy backdoors, exfiltrate data, or use the compromised host as a pivot point for lateral movement across a network. The scale of 157 reports for this single IP suggests the operator is running a coordinated, automated scanning and attack campaign rather than opportunistic probing.
Network defenders should immediately block or rate-limit connections from 185.196.9.127 at the firewall level and monitor logs for any successful authentication events from this address. Replacing password-based SSH authentication with asymmetric key pairs eliminates the attack vector entirely, while repositioning the SSH daemon to a non-standard port reduces exposure to automated scanners. Deploying fail2ban or similar intrusion-prevention tools to dynamically ban repeat offenders after a configurable number of failed login attempts provides an additional automated defensive layer. All SSH services should enforce strong credential policies, disable direct root login, and maintain up-to-date patch management to close known vulnerabilities that brute-force toolkits sometimes exploit in tandem with credential guessing.
SC 
CH 
BG 
FR 
LU 
LK 
AU 
JP