High Risk
IP 130.12.181.99 is a high-risk address operating from German network infrastructure that has generated 1,316 abuse reports over a six-month period, indicating sustained and aggressive unauthorized access activity. The IP has earned a threat level of 8 out of 10 based on its consistent attack volume and a 94% confidence score from automated honeypot sensors, making it a reliable indicator of malicious intent that warrants immediate blocking by exposed service operators.
The address, registered to Netiface LLC under autonomous system AS36680, was first reported in January 2026 and remained active through June 2026, demonstrating persistent scanning and intrusion behavior over approximately half a year. Automated honeypot sensors detected the hostile activity on 20 separate occasions, with the dominant threat category being general hacking attempts. Report volume combined with an activity frequency rating of 8 out of 10 confirms this is not an opportunistic or transient source but rather an organized actor maintaining continuous engagement against target infrastructure.
The detected SSH session activity on an expected port reveals the IP is actively probing for accessible Secure Shell services, likely attempting credential guessing, exploiting known vulnerabilities, or establishing persistent shells on misconfigured servers. SSH brute-force and session hijacking represent serious threats because successful compromise grants attackers direct command-line access to systems, enabling data exfiltration, lateral movement within networks, cryptocurrency mining, or integration into botnets. Any exposed SSH service facing this IP faces repeated, automated intrusion pressure that could succeed against weak or default credentials.
Site operators should block 130.12.181.99 at the firewall or network edge immediately and implement fail2ban or similar tools to automatically ban repeated SSH authentication failures. Enforcing key-based authentication, disabling root login, and using non-standard SSH ports significantly reduces attack surface. Keeping SSH daemons patched, deploying intrusion detection systems, and monitoring authentication logs for patterns matching the observed probing activity will help defend against this persistent threat actor.
SI 
AE 
RO 
MX