High Risk
IP 95.110.231.151 is a high-risk Italian address associated with 397 reported incidents, predominantly SSH brute-force activity detected by automated honeypot sensors, presenting a credible threat to exposed remote-access services. The address, operated by Aruba S.p.A. under ASN AS31034, carries an 8/10 threat level with an 82% confidence rating, indicating substantial corroboration across multiple detection sources during its active window in December 2025.
Community reports and automated honeypot sensors logged the bulk of this activity, with fail2ban triggering repeatedly on sshd connections, confirming systematic password-guessing behaviour rather than opportunistic scanning. Despite a high total report volume of 397 incidents, the activity frequency score of 0/10 suggests the attacks were concentrated in a specific period rather than sustained over time, consistent with coordinated scanning campaigns that target broad IP ranges in short bursts. The Italian network ownership through Aruba S.p.A., a major European hosting provider, places this source within infrastructure commonly abused for anonymised attack traffic due to its commercial hosting model.
SSH brute-force attacks represent one of the most persistent threats to internet-exposed servers, exploiting weak or default credentials to gain unauthorised shell access. Once inside, attackers typically deploy backdoors, cryptocurrency miners or pivot further into internal networks, making initial access a critical breach point. The repeated detection by fail2ban confirms that the address is actively scanning for accessible SSH daemons, with each failed authentication attempt consuming server resources and generating log noise that can obscure genuine login attempts.
Operators running accessible SSH services should enforce key-based authentication exclusively, disable password-based login entirely, and move the service to a non-standard port to reduce exposure surface. Implementing fail2ban with aggressive ban thresholds tailored to sshd will automatically block repeated source addresses like 95.110.231.151. Additionally, restricting SSH access to known IP ranges via firewall rules or VPN jump hosts and monitoring authentication logs for patterns matching this address will further harden defences against similar scanning activity.
GB 
FR