Critical Threat
IP 196.251.115.108 is a high-risk address originating from the Netherlands under ASN AS401116 (NYBULA) with a maximum threat classification of 10/10, accumulating 326 total abuse reports with a dominant pattern of SSH brute-force activity detected by automated honeypot sensors throughout August 2025.
The IP's profile presents an atypical pattern: despite the highest possible threat rating and hundreds of reports, the activity frequency score is notably low at 0/10, with a current confidence score of only 58%. All 20 most recent reports specifically document SSH brute-force attempts, with detection attributed entirely to automated honeypot infrastructure rather than community reporting. The geographic location places this actor within Dutch network space managed by NYBULA. The reporting window spans only August 2025, indicating this represents a concentrated recent campaign or a newly catalogued threat actor entering the threat-intelligence ecosystem.
SSH brute-force attacks attempt to compromise servers by systematically guessing credentials against the Secure Shell service. A successful authentication grants the attacker command-line access to the target system, potentially escalating to root privileges and the ability to deploy persistent backdoors, exfiltrate sensitive data, or pivot deeper into internal networks. This threat category poses severe risk to any exposed SSH service relying on password-based authentication, as automated tools allow adversaries to cycle through credential combinations at scale with minimal cost per attempt.
Operators should immediately review authentication logs for connections originating from this address and consider implementing key-based authentication exclusively, configuring tools such as fail2ban to automatically block repeated authentication failures, moving SSH to a non-standard port to reduce automated scanning exposure, and disabling direct root login entirely. Where SSH access from external networks is not operationally required, upstream firewall rules should drop all traffic from this source address.
GB 
GE 
SI 
KR 
PL 
RO