Critical Alert
IP 92.115.19.173 is a critical-risk address assessed at threat level 10/10, linked to sustained hacking activity including SSH brute-force attempts and suspected compromise of the originating system. This Moldovan IP, operated by Moldtelecom SA under ASN 8926, generated 182 total abuse reports from automated honeypot sensors over approximately six months, with activity frequency rated 8/10 — indicating persistent, high-volume offensive operations against target infrastructure.
The detection profile spans December 2025 through May 2026, with community and automated sensors flagging the address for general hacking intrusion attempts (20 reports), SSH credential brute-forcing (2 reports), and notably, evidence that the IP itself may be an exploited host being weaponized without its owner's knowledge (1 report). Suricata signatures detected active SSH sessions on expected ports alongside clear brute-force patterns, suggesting the address operates as both an attack platform and potentially a compromised asset within a broader attack chain. The 69% confidence score reflects partial attribution data, yet the volume and consistency of reporting strongly support malicious intent.
The dominant threat category — hacking activity encompassing SSH brute-force and exploitation attempts — poses a direct risk to any exposed SSH services. Credential-guessing attacks systematically target authentication interfaces, and when paired with evidence of an exploited host, this pattern suggests the IP may be part of an automated botnet or proxy infrastructure used to obscure attacker origin. Organizations with publicly accessible SSH daemons face immediate risk of unauthorized access, lateral movement, and data exfiltration if credentials are weak or the service is unpatched.
Network defenders should block 92.115.19.173 at the perimeter firewall and implement rate-limiting on SSH authentication endpoints to reduce brute-force exposure. Deploying key-based authentication, disabling root login, and changing default ports significantly raises the barrier for automated attacks. Tools such as fail2ban can dynamically block repeated login failures, while intrusion detection signatures tuned to SSH brute-force patterns provide early warning. Operators receiving abuse notifications should investigate whether their infrastructure is inadvertently participating in this activity.
FR 
HK 
TW 
KR 
PE 
CH 
GB