Extreme Threat
IP 194.107.115.199 is a maximum-threat-level address originating from Uzbekistan that has been flagged in 1,944 abuse reports by automated honeypot sensors over approximately eight months. With a threat rating of 10 out of 10 and an activity frequency score of 8 out of 10, this address demonstrates sustained, high-volume SSH brute-force activity that places it among the most persistently malicious IPs observed in recent threat telemetry. The overwhelming majority of recent reports document systematic credential-guessing attempts targeting exposed SSH services, while isolated instances of general hacking activity and exploited-host signatures suggest this infrastructure may be operating as part of a broader attack campaign.
Automated honeypot sensors detected this activity across 20 distinct detection points between October 2025 and June 2026, yielding a confidence score of 75 percent. The IP routes through AS197984, operated by the State Unitary Enterprise Scientific Engineering and Marketing Researches Center UNICON.UZ, a state-affiliated entity in Uzbekistan. Sensor logs repeatedly captured fail2ban triggers with 25 to 28 violations per instance, alongside Suricata alerts documenting active SSH sessions on expected ports. The consistent pattern of brute-force detection across multiple independent sensors, combined with the exploited-host classification in two recent reports, indicates this address is either actively scanning for vulnerable servers or has itself been compromised and weaponized without the operator's knowledge.
SSH brute-force attacks represent a well-established intrusion vector in which threat actors use automated tools to rapidly cycle through username and password combinations until valid credentials are discovered. For any organization exposing port 22 to the internet, this activity creates an immediate risk of unauthorized server access, privilege escalation and data exfiltration. The sustained eight-month campaign from this address, combined with its high report volume and exploited-host indicators, suggests it is part of an organized scanning infrastructure rather than opportunistic noise. Servers running default SSH configurations with password-based authentication face the greatest exposure to such attacks, as successful compromise grants attackers a persistent foothold for further exploitation.
KR 
UA 
RO 
CO 
CH 
CA