Critical Threat
IP 85.217.149.9, registered in Bulgaria and operated by NetIX Communications JSC, presents a critical threat with a maximum 10/10 threat level and 89% confidence based on 166 abuse reports. This address is definitively linked to active hacking activity, specifically sustained SSH intrusion probes targeting exposed services. With an activity frequency rated 8/10, the IP demonstrates persistent and aggressive scanning behaviour that warrants immediate blocking at network perimeters.
All 166 reports originate from automated honeypot sensors detecting the address between January 2026 and June 2026, indicating sustained automated scanning rather than isolated opportunistic attempts. The honeypot detections specifically captured "attack connection" patterns and Suricata alerts matching the ET INFO rule set, flagging SSH sessions established on unusual non-standard ports. This technique is characteristic of threat actors attempting to bypass naive firewall rules that only monitor default SSH port 22. The concentration of detection across a six-month period confirms this is not transient or misconfigured traffic but a deliberate, repeated campaign.
The dominant threat category, hacking, encompasses unauthorized access attempts, vulnerability exploitation and credential attacks. When applied to SSH services, this translates to credential brute-forcing, dictionary attacks against weak passwords and exploitation of unpatched OpenSSH installations. An address exhibiting SSH sessions on unusual ports is deliberately probing for misconfigured or legacy systems that operators may have assumed were hidden from internet-wide scanning. Any exposed SSH service reachable from this IP faces immediate risk of compromise, especially those listening on non-standard ports where administrators may have reduced monitoring.
Network operators should block 85.217.149.9 at the firewall level and implement fail2ban or equivalent dynamic blocking to respond automatically to repeated connection attempts. SSH services should be restricted to known IP ranges via AllowUsers or AllowGroups directives, and key-based authentication should be enforced with password authentication disabled entirely. Continuous monitoring with intrusion detection systems capable of inspecting traffic on all ports, not just port 22, will ensure anomalous SSH activity is detected regardless of the listening port chosen by an attacker.
CA 
CH