High Risk
IP 196.251.80.143 is a high-risk address assessed at 8/10 threat level with 185 cumulative abuse reports, primarily linked to automated SSH brute-force activity targeting server authentication endpoints.
Automated honeypot sensors logged 20 distinct SSH intrusion attempts attributed to this IP over a three-month observation window spanning September to November 2025, yielding a moderate confidence rating of 69 percent. The address originates from the Seychelles (country code SC) and is routed through ASN AS401120 operated by CHEAPY-HOST, a network provider associated with transient hosting infrastructure commonly abused for scanning and credential attacks. Despite a high volume of aggregate reports, the reported activity frequency score of 0/10 indicates this particular threat pattern has subsided, though the historical pattern remains relevant for threat evaluation and defensive tuning.
SSH brute-force attacks represent one of the most persistent threats facing exposed server infrastructure, where adversaries deploy automated tooling to systematically test credential combinations against listening daemons. Successful authentication grants direct command-level access to the underlying system, enabling data theft, malware deployment, lateral movement across networks, or recruitment into botnet operations. The attack pattern detected from this source aligns with opportunistic scanning campaigns that cast wide nets across publicly reachable IP space, exploiting services that retain default or weak authentication configurations.
Defensive practitioners should ensure SSH services enforce public-key authentication exclusively, disable root login, and relocate the service to a non-standard port to reduce automated targeting surface. Deploying fail2ban or equivalent dynamic firewall rules to block sources generating repeated authentication failures provides an effective automated shield. Continuous monitoring of authentication logs, coupled with network-level rate limiting on port 22, significantly degrades the viability of brute-force operations against exposed endpoints.
NL 
FR 
HK 
TW 
PE 
GB