Critical Alert
IP 93.123.109.192, allocated to Bulgarian network operator Techoff Srv Limited (AS48090), is a critical-risk address with a threat level of 10/10, linked overwhelmingly to SSH brute-force intrusion activity across automated honeypot sensors. The IP generated 804 total abuse reports over a four-month window between February and May 2026, with the dominant threat category being SSH-targeted attacks, indicating systematic attempts to compromise exposed SSH services through credential guessing.
Detection data gathered from 20 separate honeypot sensors reveals consistent, multi-wave attack patterns, with honeypot sensors logging repeated SSH brute-force violations alongside general hacking attempts and brute-force activity against authentication systems. Fail2ban telemetry confirms multiple distinct attack waves, including recidive offenders flagged across multiple jail types, suggesting the source persistently returned after initial blocks. The 78% confidence score reflects high certainty that this traffic represents genuine malicious activity rather than misconfiguration, while the 0/10 activity frequency metric indicates that while historical abuse was substantial, current detection volume has tapered since May 2026.
SSH brute-force attacks represent one of the most prevalent initial-access vectors in internet threat landscaping, where automated tooling systematically cycles through credential pairs against exposed SSH daemons. Successful authentication grants attackers command-level access to target systems, enabling data exfiltration, malware deployment, cryptomining, or lateral movement within networked environments. The recidive offender status observed in the detection logs signals that basic perimetre blocking alone has previously proven insufficient, and that the operator behind this IP repeatedly renewed scanning efforts after short intervals.
Organisations exposing SSH services to the internet should immediately audit authentication configurations: enforce public key-based authentication exclusively, disable direct root login, and consider relocating SSH to a non-standard port to reduce automated target selection. Deploy and properly tune fail2ban or equivalent rate-limiting tools to automatically quarantine repeated offenders, and implement multi-factor authentication for any accounts retaining password-based access. Maintain current patch levels on SSH daemons, monitor authentication logs for anomalous patterns, and consider network-level blocking of Bulgarian address space if business relationships do not require legitimate connectivity from that region.
RO 
UA 
CA 
KZ