Severe Risk
IP 80.95.195.71, allocated to ICUK Computing Services Limited in the United Kingdom under ASN AS51561, is a critical-risk address with a maximum threat level of 10/10, supported by 606 total abuse reports from automated honeypot sensors. The dominant threat activity centers on SSH brute-force attempts, supplemented by broader hacking reconnaissance, indicating a sustained automated intrusion campaign against exposed Secure Shell services.
The detection data reveals 20 separate honeypot sensors contributed to the 606 reports filed during September 2025, establishing a concentrated timeframe for this campaign. While the activity frequency metric registers at 0/10, the sheer volume of reports within a single month demonstrates aggressive, automated targeting rather than isolated probing. The 60% confidence score reflects typical uncertainty inherent in community-sourced threat data, yet the consistency across multiple independent sensors substantially corroborates the malicious classification. Geographic attribution to the United Kingdom does not diminish the threat posed; threat actors routinely operate from infrastructure in well-connected regions with mature internet ecosystems.
SSH brute-force attacks represent one of the most common initial-access vectors in unauthorized server compromise, where automated tools systematically attempt credential combinations against exposed daemons. The concrete risk extends beyond successful authentication: even failed attempts generate authentication logs that can mask genuine traffic, exhaust system resources, and signal attacker persistence. When combined with the broader hacking activity classification referencing honeypot events and command-input attempts, the evidence suggests this IP participates in credential-stuffing workflows designed to harvest or escalate access across targeted infrastructure.
Site operators exposing SSH services should immediately implement defensive controls to mitigate this threat vector. Deploying key-based authentication eliminates the password-guessing attack surface entirely, while repositioning SSH to a non-standard port reduces automated target selection. Configuring fail2ban or equivalent log-analysis tools to dynamically ban repeat offenders after a threshold of failed attempts provides automated response without manual intervention. Ensuring regular credential rotation, disabling root login over SSH, and maintaining intrusion-detection monitoring on authentication logs will further harden exposure against the attack patterns evidenced by this address.
TR 
CO 
UA 
VN 
CA 
RO