Moderate Risk
IP 185.196.11.84, allocated to Swiss network operator Global-Data System IT Corporation under ASN AS42624, presents a moderate threat profile scoring 5 out of 10, with the dominant risk being email spam distribution detected by automated honeypot sensors during November 2025.
Security telemetry gathered from 20 automated honeypot sensors accumulated 2,841 total abuse reports, though the measured activity frequency remains at zero out of ten, suggesting episodic rather than continuous engagement. The reports were consolidated within a single month, November 2025, indicating concentrated scanning or testing activity during that period. Switzerland's jurisdiction and the corporate ASN ownership suggest this address may function as a residential proxy or VPN exit node rather than a directly compromised host, which would explain the spam classification without corresponding sustained traffic patterns.
Email spam represents a persistent threat vector where mass-distributed unwanted messages serve as delivery mechanisms for phishing lures, credential harvesting pages, or malware payloads. Even at moderate volumes, spam originating from a given IP can damage sender reputation, trigger blocklist inclusions, and expose recipients to social engineering attacks. The confidence score of 55 percent reflects uncertainty about whether this address is actively participating in spam campaigns or merely being swept up in broader scanning activity targeting SMTP services exposed to the internet.
Site operators should implement and enforce SPF, DKIM and DMARC authentication protocols to validate incoming message legitimacy and prevent domain spoofing. Deploying reputable email filtering services that analyse message content and sender reputation provides additional protection. Monitoring for inbound connection attempts from this address and similar Swiss netblocks, combined with fail2ban or equivalent connection-limiting tools, can reduce exposure to scanning behaviour. Finally, auditing public blocklist registrations for this IP ensures timely detection if it becomes widely blacklisted.
SC 
GB 
UA