Extreme Threat
IP 92.118.39.36 is a maximum-risk threat actor associated with 204 independent abuse reports and confirmed attack patterns including SSH brute-force attempts and web application reconnaissance, presenting a severe danger to any exposed services. This address, registered to Unmanaged Ltd operating AS47890 in the United States, has been actively targeting honeypot sensors since August 2025 with its most recent activity logged in May 2026, indicating persistent threat behavior over an extended campaign window.
The threat intelligence corpus documents 204 total reports generated across 20 distinct automated honeypot sensors, lending substantial credibility to the assessment despite the 76% confidence ceiling. Detailed attack signatures captured by network inspection systems confirm this IP repeatedly probing web application surfaces and executing brute-force authentication attacks against SSH services. The reported threat categories break down as follows: Hacking activity accounts for 14 reports, SSH-specific attacks comprise 13 reports, and Web Application Attack activity represents 6 reports. The abstract attack-pattern evidence additionally references detection of web application probing consistent with honeypot enumeration and SSH brute-force attempts flagged by intrusion-detection signatures.
SSH brute-force attacks represent one of the most common and effective initial-access vectors in internet threat landscapes, wherein automated tooling systematically attempts credential combinations against exposed authentication endpoints until unauthorized access is achieved. The concurrent web application reconnaissance activity suggests this actor pursues multiple intrusion vectors simultaneously, probing for vulnerable components such as exposed management interfaces, outdated web servers, or exploitable application-layer code. Together, these patterns indicate a threat actor seeking to compromise servers through either direct SSH access or application-layer exploitation, potentially establishing persistent access or deploying secondary payloads.
Network defenders should immediately block or rate-limit traffic originating from 92.118.39.36 at the perimeter firewall level and monitor inbound connection attempts from this address for signs of credential stuffing or vulnerability scanning. SSH services should be hardened by enforcing key-based authentication exclusively, disabling root login, and relocating the daemon to a non-standard port where feasible. Deploying automated abuse-response tools such as fail2ban can dynamically update firewall rules upon detecting brute-force patterns. Additionally, web application firewalls and regular security auditing of exposed services will mitigate the concurrent application-layer threat vectors this actor employs.
RO 
MX 
CA 
UA 
UZ 
GB 
BD