Severe Risk
IP 180.95.152.53 is a critical-risk address assessed at 10/10 threat level that has generated 181 abuse reports over a five-month window, with automated honeypot sensors flagging it exclusively for SSH brute-force activity. The IP originates from the CHINA UNICOM China169 Backbone network (AS4837) in China, and its consistent attack pattern between January and May 2026 indicates persistent, automated scanning behaviour targeting exposed SSH services worldwide.
Detection data reveals sustained malicious activity with 20 separate incident reports and multiple fail2ban violation records tied to the sshd service. The honeypot sensor network recorded repeated sshd authentication failures, with 25 violations documented in attack-pattern logs on two occasions, indicating the address actively hammers authentication interfaces across many targets. The 95% confidence score reflects high certainty that this traffic represents intentional credential-guessing rather than incidental connection attempts. The moderate activity frequency of 4/10 suggests the IP participates in periodic scanning campaigns rather than constant assault, consistent with distributed brute-force operations designed to evade per-IP thresholds.
SSH brute-force attacks pose a direct threat to any server with exposed port 22, using automated tools to cycle through common username-password combinations until valid credentials are discovered. Successful compromise grants attackers administrative access, enabling data exfiltration, malware installation, or use of the compromised host as a stepping stone for further intrusions. The sustained volume of reports confirms this IP has probed numerous networks, raising exposure risk for any organisation relying on weak or default SSH credentials.
Site operators should immediately block this address at the firewall level and configure fail2ban to automatically ban IPs generating repeated authentication failures. Hardening SSH access through key-based authentication instead of password-only methods, changing the default port, and disabling direct root login substantially reduces susceptibility to these automated attacks. Regular audit of authentication logs and enforcement of strong password policies add additional protective layers against this threat vector.
IR 
RO 
BE 
BD 
ES