Maximum Danger
IP 92.118.39.100 is a critical-risk address associated with SSH brute-force attacks and confirmed as an exploited host, presenting a concrete threat to any exposed SSH services worldwide. The IP has generated 199 abuse reports through automated honeypot sensors, with a threat level rating of 10 out of 10, indicating severe malicious activity regardless of its low observed attack frequency. The dominant threat profile combines unauthorized access attempts targeting SSH services with evidence that the host itself has been compromised and weaponized without the operator's knowledge.
Detection data collected between August 2025 and March 2026 shows 20 reports categorized as general hacking activity, 17 specifically identifying SSH targeted attacks, and 3 classifying this as an exploited host. All reports originated from automated honeypot sensors monitoring SSH services. The network is registered to Unmanaged Ltd operating under ASN 47890 in the United States. Suricata alerts confirm the IP is actively conducting SSH brute-force attempts and maintaining sessions on expected SSH ports, with patterns indicating both exploitation attempts and confirmed exploitation of the host itself. The 199 total reports distributed across 20 independent detection sources provides a confidence score of 72 percent for these findings.
SSH brute-force attacks represent one of the most common initial access vectors used by threat actors to compromise servers. By systematically attempting username and password combinations, attackers can gain unauthorized shell access to exposed servers, potentially escalating privileges and deploying persistent backdoors or cryptocurrency miners. The additional classification of this IP as an exploited host indicates that the underlying system has already been compromised, likely through such techniques, and is now being used as an attack platform. This means the IP may be part of a botnet or controlled by a threat actor who has pivoted from the initial compromise to conduct further attacks against other targets across the internet.
Organizations with SSH services accessible from the internet should immediately block this IP address at the network perimeter. Enforcing key-based authentication instead of password authentication eliminates the effectiveness of brute-force attempts entirely. Configuring fail2ban or similar intrusion prevention tools to automatically block repeated authentication failures provides an additional layer of defense. Disabling direct root login and changing the default SSH port reduces exposure to automated scanning and exploitation attempts. Network defenders should also consider reaching out to the hosting provider to report the exploited host so that the legitimate owner can be notified about the compromise affecting their infrastructure.
RO 
UA 
GB