Maximum Danger
IP address 92.118.39.87, registered to Unmanaged Ltd in autonomous system AS47890 and geolocated to the United States, represents a maximum-threat infrastructure source with a threat level of 10 out of 10 based on 14,713 total abuse reports. The IP has been flagged for sustained SSH brute-force and general hacking activity, with detection originating from 20 automated honeypot sensors distributed across the threat-intelligence network. First reported in August 2025 and most recently reported in April 2026, this address has accumulated a substantial abuse history despite an activity frequency score of 0 out of 10 at the time of last observation, suggesting the bulk of malicious traffic occurred during the earlier reporting window.
The sheer volume of 14,713 reports is the most significant data point, placing this IP among the most reported addresses for brute-force credential attacks in the observed timeframe. All recent activity splits evenly between Hacking and SSH categories, with the honeypot sensors specifically logging Suricata alerts indicating SSH sessions initiated on expected ports followed by brute-force authentication attempts. The 64 percent confidence score reflects a reasonable level of certainty that this traffic represents deliberate malicious behavior rather than misconfiguration or benign scanning, while acknowledging that attribution to a single actor cannot be definitively established from network telemetry alone.
SSH brute-force attacks remain one of the most common initial-access vectors for threat actors seeking to compromise Linux servers, cloud instances and network infrastructure. By systematically attempting common username-password combinations, attackers can achieve unauthorized access to exposed SSH daemons within hours when default or weak credentials are in use. Once access is obtained, threat actors typically deploy backdoors, cryptocurrency miners or use the compromised host as a pivot point for lateral movement within a network. The detection pattern observed here—repeated Suricata alerts capturing session establishment followed by credential guessing—matches the methodology of automated attack toolkits that continuously cycle through password dictionaries against publicly accessible SSH services.
RO 
SC