Extreme Threat
IP 92.118.39.56 is a critical-risk address associated with 230 abuse reports and linked to sustained SSH brute-force intrusion attempts originating from what appears to be a compromised host. The IP, registered to Unmanaged Ltd under ASN AS47890, was first flagged by automated honeypot sensors in January 2026 and continued generating reports through April 2026, indicating persistent malicious activity over a four-month window.
Analysis of the 230 reports reveals consistent detection across 20 separate honeypot sensors, with reported threat categories breaking down as follows: Hacking attempts (12 reports), SSH-based attacks (9 reports), and exploited host activity (7 reports). The detection data, including Suricata alerts for SSH sessions observed on expected ports, confirms repeated brute-force authentication attempts targeting SSH services. Despite a perfect 10/10 threat-level rating, the activity frequency metric of 0/10 suggests the offensive operations may have subsided or shifted patterns in recent reporting periods. The 71% confidence score indicates strong but not conclusive attribution to malicious behavior.
SSH brute-force attacks represent one of the most common initial access vectors used by threat actors to compromise servers and deploy further payloads such as backdoors, cryptocurrency miners, or ransomware. When classified alongside exploited-host indicators, this pattern strongly suggests the IP address belongs to a machine that has itself been compromised and is being weaponized by attackers to scan and brute-force other targets across the internet. This transformation of innocent infrastructure into an attack platform means the true operator may be unaware their system is being used maliciously, while simultaneously exposing their environment to additional compromise through the same infection vector.
Site operators should immediately block 92.118.39.56 at the network perimeter firewall level and implement SSH hardening measures regardless, including disabling password-based authentication in favor of public-key authentication, changing the default SSH port, disabling root login, and configuring fail2ban to automatically ban IPs demonstrating brute-force behavior. Organizations should also consider reporting this IP to its hosting provider so the legitimate owner can be notified of the potential compromise and undertake remediation. Continuous monitoring of authentication logs for attempts originating from this address remains advisable given the extended reporting period.
RO 
GB 
JP 
LV 
KR 
TH