Substantial Risk
IP 80.94.95.169, registered to SS-Net in Romania under ASN AS204428, is a high-risk address with a threat level of 8/10 and an 88% confidence score, accumulating 1,001 abuse reports across automated honeypot sensors over a concentrated reporting window. The volume of reports significantly outpaces the reported activity frequency, suggesting this IP has been flagged repeatedly for persistent or batched malicious operations rather than sustained continuous activity.
Detection data from 20 separate honeypot sensors identified the address engaging in general hacking intrusions (17 recent reports), alongside single instances of web application probing, exploitation activity, and IoT targeting. The abstract attack-pattern indicators—attack connections, web app probes, malware and exploit behavior, and directed IoT activity—reveal a multi-vector threat profile. The network's geographic origin in Romania and its association with SS-Net provide contextual background, though the operator's specific profile remains limited in public intelligence sources. The first and last reported dates fall within March and April 2026, indicating active engagement during that reporting period.
The dominant hacking category encompasses a broad range of intrusion attempts, vulnerability exploitation, and unauthorized-access activities that pose concrete risks to exposed services. Web application attacks compound this risk by targeting application-layer weaknesses, while exploitation activity suggests the deployment of malware or weaponized payloads. IoT targeting indicates the IP may be leveraged in campaigns against internet-of-things devices, which often lack robust security controls. Combined, these patterns suggest this address is used by an actor—or compromised host—capable of executing diverse offensive operations.
Site operators should block IP 80.94.95.169 at the firewall or network edge and monitor inbound traffic from this address for any attempted connections. Implementing rate-limiting and strong authentication mechanisms—particularly on services exposed to the internet—reduces the effectiveness of intrusion attempts. Deploying a web application firewall provides an additional layer of defense against application-layer probes. Regularly auditing exposed services, enforcing prompt patching cycles, and using intrusion-detection tools such as fail2ban or equivalent solutions help mitigate exploitation risks from addresses exhibiting this activity profile.
AM 
NO