Severe Risk
IP 202.125.94.71 is a critical-risk address with a threat level of 10 out of 10 that has been linked to 799 abuse reports over approximately six months, predominantly for sustained SSH brute-force activity. The dominant threat profile involves repeated automated password-guessing attempts against exposed SSH services, with 20 distinct detection events logged by automated honeypot sensors and supplementary reports from the wider security community.
The IP address 202.125.94.71 originates from Indonesia and is associated with ASN AS46042, operated by Gunadarma University. Automated honeypot sensors first reported the address in December 2025, with activity persisting through May 2026. The sheer volume of reports—combined with the confirmed presence of active SSH sessions on expected ports and multiple fail2ban violations—indicates a systematic, high-frequency attack campaign rather than opportunistic scanning. While the activity frequency is scored at 1 out of 10 due to the concentrated nature of these attacks, the persistence and scale of the intrusion attempts represent a significant and ongoing threat to any exposed SSH infrastructure.
Analysis of reported threat categories reveals SSH activity as the dominant vector, accounting for the vast majority of the 799 abuse reports. The attack pattern notes confirm repeated SSH brute-force attempts alongside Suricata alerts indicating active SSH sessions on expected ports, suggesting either successful authentication or sustained credential-probing against honeypot targets. If these techniques succeed against legitimate servers, attackers gain command-line access enabling data exfiltration, lateral movement, malware deployment, or recruitment into botnets. The presence of exploitation markers further indicates the host itself may be compromised and leveraged as an attack platform without the operator's knowledge.
Site operators should immediately block 202.125.94.71 at the firewall or network perimeter to prevent further probing. Implementing automated abuse-response tools such as fail2ban will dynamically ban addresses that exceed configurable login-failure thresholds. Organizations should enforce key-based authentication exclusively, disable direct root login, and consider relocating SSH to non-standard ports. Continuous monitoring of authentication logs combined with intrusion detection deployment will help identify and block follow-up attempts from this or related sources.
TR 
FR 
GB 
UA 
CA 
MK 
RO