Substantial Risk
IP 93.152.230.175 is a high-risk address linked to SSH brute-force attack activity, originating from Bulgarian network infrastructure AS210006 and operator Shereverov Marat Ahmedovich. Automated honeypot sensors recorded 210 separate incident reports during October 2025, with the dominant threat category being SSH-based authentication attacks.
The detection data reveals consistent malicious activity concentrated within a single reporting period. All 210 reports were attributed to automated honeypot sensors, yielding a threat level of 8 out of 10. The network is registered to a Bulgarian entity operating AS210006, placing the IP within a geographically specific infrastructure context. The confidence score of 65% reflects some uncertainty in attribution, though the volume of independent sensor reports substantiates the assessed risk. Activity frequency scoring of 0 out of 10 appears to indicate intermittent rather than continuous engagement, yet the aggregate report count demonstrates persistent hostile intent.
SSH brute-force attacks represent a well-established intrusion vector targeting exposed remote access services. Attackers systematically attempt credential combinations against SSH daemons, exploiting weak or default passwords to gain unauthorized server access. The real-world risk includes complete system compromise, data exfiltration, and potential use of compromised hosts as jumping-off points for further network attacks. Even failed attempts consume server resources and generate security event noise that can obscure genuine incidents.
Site operators should implement key-based authentication as the primary login mechanism, effectively neutralizing password-guessing campaigns. Repositioning the SSH service to a non-standard port reduces exposure to automated scanning tools. Deploying fail2ban or equivalent intrusion-prevention tools enables automatic temporary blocking of IP addresses demonstrating repeated authentication failures. Additionally, disabling direct root login and enforcing account lockout policies after failed attempts provide layered defense against credential-stuffing operations.
DE 
SC 
LV 
TM 
VN 
UA 
BE 
DZ