Critical Threat
IP 87.106.80.228 is a critical-risk address operated by IONOS SE in Germany that has generated 530 abuse reports over approximately four months, with automated honeypot sensors flagging it predominantly for SSH brute-force attacks and concurrent web application reconnaissance probes.
The IP was first reported in December 2025, with continued activity logged through March 2026, yielding a substantial reporting window that underscores persistent behavior rather than transient scanning. Of the 530 total reports, SSH-related activity and general hacking probes dominate the threat breakdown across 20 independent automated honeypot detection points, indicating coordinated, multi-vector probing from this single source. The network operator, IONOS SE, manages AS8560, a large European hosting infrastructure commonly leveraged by both legitimate customers and threat actors due to its extensive IP allocation footprint. Despite a low activity frequency metric, the sheer report volume and diverse detection sources confirm this address as a reliably malicious actor within public IP reputation systems.
SSH brute-force attacks represent the primary threat category, employing automated tools to systematically attempt credential combinations against exposed SSH services until access is achieved. These attacks exploit weak or default passwords and can compromise entire servers within minutes when successful. Simultaneously, web application probing attempts to identify vulnerable endpoints through reconnaissance requests targeting known application-layer weaknesses. For organizations running publicly accessible SSH servers or unpatched web applications, this IP poses an immediate threat of unauthorized access, data exfiltration, or further network penetration.
Site operators should block IP 87.106.80.228 at the network perimeter or firewall level as a first line of defense. SSH services should enforce key-based authentication exclusively, disable root login, and change the default port to reduce automated targeting. Implementing fail2ban or equivalent intrusion-prevention tools will automatically ban repeated authentication failures. Regular security audits, prompt patching of web applications, and deployment of a web application firewall will further harden exposure against this category of multi-vector attack.
ES 
FR 
VN 
BD 
JP 
BY 
CH 
LK