Maximum Danger
IP 193.24.211.95 presents a critical threat rating of 10/10 with 404 total abuse reports filed against this Germany-hosted address, making it one of the most actively malicious IPs currently circulating in public threat feeds. Operated by Data Campus Limited on network AS215929, this address has been detected conducting sustained SSH brute-force attacks and general hacking activity since April 2026, with the most recent reports logged in May 2026. The high confidence score of 94% and activity frequency rated at 8/10 confirm persistent, automated attack behavior rather than isolated probing.
Detection data from 20 separate automated honeypot sensors consistently flagged this IP engaging in SSH brute-force password guessing and establishing unauthorized SSH sessions on standard ports. Suricata telemetry revealed spurious retransmissions characteristic of scripted credential stuffing campaigns, and the combination of Hacking, SSH, and Exploited Host threat classifications suggests this address may simultaneously be launching attacks while potentially operating as a compromised platform itself. The volume of distinct sensor detections indicates distributed scanning patterns typical of botnet-assisted operations.
SSH brute-force activity represents one of the most common initial access vectors exploited by threat actors to compromise servers, deploy ransomware, or establish persistent footholds within enterprise networks. With 18 confirmed SSH-related reports and an additional 20 hacking-category incidents, this address poses a concrete risk to any internet-facing SSH services, particularly those using password-based authentication or default configurations. Organizations with exposed SSH daemons face immediate credential compromise risk if targeted by this actor.
Site operators should immediately block IP 193.24.211.95 at the network perimeter and implement fail2ban or equivalent rate-limiting solutions to automatically ban repeated authentication failures. Transitioning SSH services to key-based authentication, disabling root login, and moving default SSH ports significantly reduces susceptibility to credential-based attacks. Continuous monitoring of authentication logs and implementing intrusion detection rules for anomalous SSH session patterns provides additional defense-in-depth against this attack profile.
RO 
MX