Critical Threat
IP 93.123.109.114 is a critical-risk address originating from Bulgaria that has been persistently engaged in SSH brute-force intrusion attempts, accumulating 723 abuse reports across 20 distinct automated honeypot sensors with a 100% detection confidence score over a six-month observation window spanning December 2025 through May 2026.
The network infrastructure hosting this activity is registered to Techoff Srv Limited operating under ASN AS48090, and the sustained volume of 723 reports represents an exceptionally high abuse footprint for a single address. Detection data from automated honeypot sensors consistently flagged the address for SSH brute-force patterns, with accompanying Suricata signature alerts confirming active SSH sessions on expected ports. The activity frequency score of 8 out of 10 indicates this is not opportunistic or transient behavior but rather a sustained, methodical campaign of credential-guessing attacks targeting exposed Secure Shell services.
SSH brute-force activity represents one of the most prevalent and persistent threats facing internet-exposed servers worldwide, as attackers systematically cycle through credential combinations to compromise accounts with weak or default passwords. The pattern detected on this address aligns precisely with coordinated authentication attacks, where each successful guess could grant adversaries direct command-line access to critical systems, enabling data exfiltration, malware deployment, or lateral network movement. With 19 recent reports each for both general hacking and SSH-specific activity, the threat profile confirms a focused, automated assault on SSH authentication mechanisms.
Site operators running publicly accessible SSH services should immediately implement defensive controls including key-based authentication in lieu of password-only access, rate-limiting connection attempts, and deploying automated threat-detection tools such as fail2ban to block repeat offenders. Changing the default SSH port reduces automated target acquisition, while disabling direct root login and enforcing account lockout policies after failed attempts significantly raise the barrier for successful credential-based intrusions. Continuous monitoring of authentication logs and blocking this address at the firewall level are strongly recommended given the confirmed malicious intent.
TW 
CA