Critical Threat
IP 92.118.39.101 is a maximum-threat address with a 10/10 threat level that has generated 325 abuse reports, predominantly documenting sustained SSH brute-force intrusion attempts originating from US-based infrastructure under AS47890 (Unmanaged Ltd).
The 325 reports spanning August 2025 to March 2026 were detected exclusively through automated honeypot sensors, with community reports contributing additional context. Suricata alert signatures confirm active SSH sessions on expected ports alongside credential-guessing patterns consistent with brute-force campaigns. The network is operated by Unmanaged Ltd, and while the activity frequency metric remains low, the sustained volume of reports over an eight-month window indicates persistent, targeted scanning behaviour rather than opportunistic noise. The single Exploited Host classification within the reported categories suggests this address may, at some point, have been characterised as a compromised system being weaponised without its operator's knowledge.
SSH brute-force attacks represent one of the most common initial-access vectors facing publicly reachable servers. Attackers deploy automated tooling to cycle through username/password combinations, exploiting weak or default credentials to gain shell access. Successful authentication provides a foothold for data exfiltration, secondary payload delivery, lateral movement within networks, or cryptojacking operations. The confidence score of 69% reflects that while the hostile intent is well-established, attribution to a specific threat actor or campaign remains partial.
Defensive measures should be deployed immediately: block 92.118.39.101 at the network perimeter, enforce key-based authentication for all SSH access, disable direct root login, and consider moving the SSH daemon to a non-standard port. Implementing automated rate-limiting tools such as fail2ban will mitigate repeated authentication attempts. Operators should ensure SSH daemons are current with security patches, restrict inbound access via IP allowlists where feasible, and review authentication logs routinely for anomalous patterns consistent with credential-stuffing activity.
RO 
FR 
PE 
CH 
GB 
HK