Maximum Danger
IP 196.251.80.165 is a critical-risk address operated through Seychelles-based CHEAPY-HOST infrastructure that has generated 306 abuse reports in automated honeypot sensors over a concentrated two-month window, with its activity dominated by SSH brute-force intrusion attempts and broader hacking probes that warrant immediate defensive action.
Public abuse databases logged 306 reports against this address between September 2025 and November 2025, sourced from 20 distinct automated honeypot sensors that detected consistent malicious activity. The detection record specifically documents repeated SSH daemon (sshd) authentication failures that triggered fail2ban blocks, confirming active credential-guessing campaigns against exposed SSH services. With a threat level scored at 10 out of 10 and a 70 percent confidence rating in the malicious classification, the evidence aligns consistently with an established pattern of hostile network behavior originating from CHEAPY-HOST's AS401120 autonomous system in the Seychelles.
The predominant threat category consists of SSH attacks, which exploit the ubiquitous Secure Shell protocol to guess server credentials or exploit known SSH vulnerabilities for unauthorized access. These automated campaigns typically cycle through common username-password combinations at high speed, and each successful compromise grants attackers a foothold for data theft, cryptocurrency mining, lateral network movement or deployment of secondary malware. The accompanying general hacking reports indicate this address may also participate in broader vulnerability scanning and exploitation attempts beyond credential stuffing.
Administrators with publicly accessible SSH services should treat this IP address as definitively hostile and block it at the network perimeter. Enforce key-based authentication exclusively, disable root login over SSH and consider relocating the service to a non-standard port to reduce exposure. Deploying or configuring fail2ban to dynamically ban repeat offenders provides an additional automated layer of defence, while maintaining comprehensive audit logs of authentication failures from this source enables forensic tracking. Regular system patching and intrusion detection monitoring remain essential baseline practices against the exploitation vectors this address represents.
NL 
RO 
UG 
HK 
GB 
FR