Critical Threat
IP 80.94.92.168 is a critical-risk address originating from Romanian network space (AS47890, Unmanaged Ltd) with a threat level of 10/10 and 2,249 abuse reports logged by automated honeypot sensors, indicating sustained and aggressive SSH brute-force activity against exposed services worldwide.
Analysis of the submitted data reveals an IP address with a 72% confidence score and an activity frequency rating of 8/10, meaning this host is consistently engaged in malicious operations. The target address was first reported in November 2025 with the most recent activity logged in May 2026, spanning approximately seven months of documented threat behaviour. Security sensors recorded 21 distinct threat-category incidents across recent reporting periods, with SSH brute-force attempts and general hacking probes dominating the observed activity. Twenty separate automated honeypot sensors contributed reports, indicating broad detection coverage across the threat-intelligence network. The sheer volume of reports combined with the sustained timeframe strongly suggests this is not a transient scanner but an established automated attack infrastructure.
SSH brute-force attacks represent one of the most common and effective initial-access vectors in server-targeted campaigns. Attackers systematically attempt credential combinations against exposed SSH services, exploiting weak or default passwords to gain unauthorised server access. Suricata intrusion-detection alerts confirming active SSH sessions on expected ports corroborate the honeypot findings and indicate the IP is actively engaged in credential-guessing operations. Successful compromise of an SSH server provides attackers with a foothold inside a network, potentially enabling data theft, lateral movement, or deployment of secondary payloads such as cryptocurrency miners or ransomware.
Site operators should immediately block this IP at the firewall level or via network-level access-control lists. Implementing fail2ban or equivalent automated banning tools will mitigate repeated authentication attempts in real time. SSH hardening measures including key-based authentication, disabling root login, changing the default port, and enforcing strong password policies substantially reduce brute-force effectiveness. Continuous monitoring for anomalous SSH session patterns and enforcing multi-factor authentication add additional protective layers against this category of threat.
GB 
JP 
LV 
KR 
TH 
PL