Elevated Risk
The IP address 80.94.95.216 is a high-risk address associated with email spam activity, originating from Romanian network infrastructure and generating 160 abuse reports from automated honeypot sensors over a three-month observation window.
Analysis of the available telemetry reveals a consistent abuse pattern across the February–April 2026 reporting period. All 20 recent threat reports consistently flagged this address for email spam activity, yielding a threat-level score of 7 out of 10 with a 76% confidence rating. The address routes through AS204428 (operated by SS-Net), placing it within Romanian network space. Despite a low activity-frequency rating of 0 out of 10 in recent intervals, the sustained report volume over several months indicates persistent abuse rather than an isolated incident. Community and honeypot detection systems have reliably tracked this address, suggesting it operates as part of automated spam infrastructure rather than opportunistic scanning.
Email spam represents a concrete threat to exposed mail servers, as malicious actors commonly leverage compromised or spoofed SMTP endpoints to distribute phishing payloads, advertise fraudulent services, or deliver malware-laden attachments. When an external address repeatedly attempts SMTP relay or unauthorized message injection, it risks degrading mail-server performance, damaging sender reputation scores, and increasing the likelihood that legitimate correspondence is blocked or flagged as suspicious by downstream filters. Organizations with exposed SMTP services face the greatest exposure to this category of abuse.
Site operators should enforce strict SMTP authentication requirements and consider implementing allowlisting or deny-listing controls based on observed abuse patterns. Deploying and properly configuring SPF, DKIM, and DMARC records across managed domains significantly reduces the impact of spoofed email originating from addresses like this one. Incorporating the IP into existing defensive tools such as fail2ban or comparable log-analysis utilities can automate temporary blocking of repeated offenders. Subscribing to real-time threat-intelligence feeds and routing inbound mail through reputable filtering services adds an additional layer of protection against unsolicited bulk email.
CA 
CH 
UA 
GB