Extreme Threat
IP 80.94.92.184 is a critical-risk address operated by Unmanaged Ltd in Romania that has generated 576 abuse reports from automated honeypot sensors, predominantly documenting SSH brute-force attacks and broader unauthorized access attempts, with indicators that the host may itself be a compromised system weaponized against external targets.
Detection data from 20 distinct honeypot sensors recorded activity between January 2026 and May 2026, with an exceptionally high activity frequency score of 8/10, indicating sustained, repeated offensive operations over approximately five months. Of the categorized reports, 15 specifically document SSH attacks while 16 reference general hacking activity, and two reports flag the address as an exploited host. Sensor alerts include Suricata signatures detecting active SSH sessions on expected ports combined with concurrent brute-force attempts, confirming an ongoing automated campaign targeting publicly accessible SSH services. The 87% confidence score reflects the volume and consistency of these independent detections across multiple monitoring points.
SSH brute-force attacks pose a direct pathway to server compromise by systematically cycling through authentication credentials until access is granted. When successful, attackers gain command-level control over target systems, potentially escalating privileges, exfiltrating data, or deploying further malicious tooling. The presence of exploited-host indicators suggests this address may be operating under remote unauthorized control, meaning the Romanian-based system itself has likely been compromised and is being used as an attack platform, amplifying the threat it poses to the broader internet infrastructure.
Site operators exposing SSH services should immediately restrict authentication to cryptographic keys while disabling password-based login entirely, and ensure root login is prohibited at the SSH daemon configuration level. Deploying automated banning tools such as fail2ban will mitigate repeated authentication attempts by temporarily blocking sources after threshold failures. Network-level controls like altering the default SSH port and implementing allowlist-based firewall rules limiting source IPs further reduce exposure. Given the confirmed malicious activity and exploited-host classification, blocking this address at perimeter firewalls and routers is strongly advisable while monitoring authentication logs for any matching connection attempts.
IR 
GB