Maximum Danger
IP address 72.79.42.117 is a high-risk US-based address associated with SSH brute-force intrusion activity, holding a threat level of 10 out of 10 based on 2,126 abuse reports submitted through 20 automated honeypot sensors between October 2025 and May 2026. The volume of reports and the maximum threat classification make this IP a confirmed danger to any exposed SSH service.
The data reveals sustained malicious intent despite a low activity frequency rating of 1 out of 10, suggesting the operator behind this address conducts targeted rather than opportunistic attacks. Network registration records place the address within AS701, operated by UUNET, a major United States internet backbone provider. The reported threat categories show a clear dominance of SSH attacks at 19 instances, supplemented by general hacking activity and a single exploited host classification. Suricata sensor alerts confirmed multiple instances of SSH brute-force attempts and active SSH sessions established on non-standard ports, indicating successful authentication bypass in honeypot environments.
SSH brute-force attacks systematically attempt to guess server credentials through rapid, repeated login attempts against the SSH daemon. The concrete risk involves unauthorized server access, which grants attackers root-level control to deploy malware, exfiltrate data, establish persistent backdoors, or pivot further into a network. The presence of Suricata alerts signaling established SSH sessions confirms that credential-guessing succeeded in controlled honeypot deployments, demonstrating the real-world effectiveness of this campaign against misconfigured or weakly protected systems.
Site operators should immediately block IP address 72.79.42.117 at the network perimeter firewall to prevent further intrusion attempts. Deploying automated threat-response tools such as fail2ban to dynamically ban repeat offenders after a configurable number of failed authentication attempts provides layered protection. Switching to public-key authentication, disabling root login, and moving SSH to a non-standard port materially raises the difficulty for automated attack tooling. Regular monitoring of authentication logs for unusual patterns from this address and routine review of access controls will further reduce exposure to credential-based threats.
KR 
UA 
UZ 
RO 
CO 
CH 
CA