Severe Risk
IP 185.192.96.169 is a high-risk address linked to SSH brute-force attacks, assessed at a critical 10/10 threat level with 884 total abuse reports across automated honeypot sensors. The IP originates from Contabo GmbH's German network infrastructure, with activity detected throughout October 2025 at a moderate 64% confidence. The dominant threat pattern involves repeated attempts to gain unauthorized server access through credential guessing against exposed SSH services.
The report volume of 884 incidents across 20 distinct honeypot sensors indicates this address has been extensively flagged for automated intrusion activity, primarily categorized as Hacking (11 recent reports) and SSH (9 recent reports). The specific attack pattern identified includes honeypot events and SSH brute-force attempts, suggesting sustained scanning behaviour rather than isolated probes. Contabo GmbH operates as a large European hosting provider, and IPs within this AS range are frequently associated with aggressive automated scanning campaigns due to the nature of budget hosting environments.
SSH brute-force attacks pose a concrete risk to any exposed server with password-based authentication enabled. Attackers systematically attempt credential combinations against SSH daemons to compromise accounts, particularly those with weak or default passwords. The volume of 884 reports suggests persistent, high-frequency scanning activity that could successfully breach unprotected or poorly configured servers. While the 0/10 activity frequency may indicate reduced recent activity, the extensive historical report volume means this address should not be considered safe to permit.
Defensive measures should include deploying automated tools such as fail2ban to block repeated authentication failures, implementing key-based SSH authentication exclusively while disabling password authentication entirely, and restricting root login access. Site operators should audit exposed SSH services regularly, enforce strong credential policies, and monitor authentication logs for unusual patterns originating from this IP range.
FR 
RO 
BG 
GB 
TH 
HK 
CZ