Extreme Threat
IP 196.189.155.89, allocated to Ethiopian Telecommunication Corporation under ASN AS24757, represents a critical threat with a 10/10 threat level and 77% confidence score. This Ethiopian address has accumulated 688 total abuse reports from 20 automated honeypot sensors across approximately eight months of activity spanning October 2025 through May 2026. The dominant threat category is SSH brute-force activity, accounting for 18 of the 23 categorized reports, supplemented by general hacking attempts and exploited-host classifications. With an activity frequency rated at 3/10, this address demonstrates persistent rather than sporadic malicious behaviour, indicating sustained automated scanning and credential-guessing campaigns targeting exposed SSH services worldwide.
The report corpus reveals a concentrated pattern of SSH brute-force attacks, with multiple detection events documenting sshd violations reaching 25 and 36 instances respectively. Suricata intrusion-detection sensors flagged active SSH sessions in progress on expected ports alongside ongoing brute-force attempts, while additional alerts explicitly categorized the activity as "SSH (exploited)" — a classification indicating that this address likely belongs to a compromised system weaponized for attack without its owner's knowledge. The volume of 688 total reports, while distributed across multiple sensors, signals that this IP has been extensively flagged by community monitoring infrastructure, substantially elevating its IP reputation risk for any organization operating exposed SSH endpoints.
SSH brute-force attacks constitute one of the most common initial-access vectors employed by threat actors to compromise servers and propagate further throughout a network. By systematically attempting credential combinations against port 22 or non-standard SSH ports, attackers seek to identify weak or default passwords enabling unauthorized shell access. Once inside, adversaries typically deploy persistence mechanisms, cryptocurrency miners or use the compromised server as a launchpad for attacking adjacent infrastructure. The exploited-host classification associated with this address suggests the underlying host itself may be compromised and remotely controlled, meaning the entity responsible — whether a criminal group or state-affiliated actor — likely has persistent access to conduct these operations at scale.
