Extreme Threat
IP 92.118.39.152 is a critical-risk address that automated honeypot sensors flagged across 251 community reports between August 2025 and March 2026, with the overwhelming majority of confirmed hostile activity classified as SSH brute-force intrusion attempts targeting exposed Linux and network infrastructure. With a threat level rated at the maximum 10 out of 10, this Romanian-hosted IP presents a severe and immediate danger to any publicly accessible SSH service, regardless of whether the activity frequency metric registered as low during the most recent reporting window.
The detection profile reveals a sustained campaign of unauthorized access attempts, with 20 independent automated honeypot reports documenting SSH brute-force activity and an additional 20 reports cataloguing general hacking behaviour from this single source. All confirmed detections originated from automated honeypot sensors rather than voluntary community submissions, indicating a methodical scanning or credential-stuffing operation that operates continuously rather than opportunistically. The IP resides within AS47890 (Unmanaged Ltd), a network operator whose infrastructure has historically been associated with transient or anonymised hosting environments, which explains both the longevity of the abuse pattern spanning multiple months and the high volume of incident reports without corresponding remediation action.
SSH brute-force attacks represent one of the most common initial access vectors used by threat actors to compromise servers, with automated tooling capable of cycling through thousands of common credential combinations against exposed port 22 or non-standard SSH listeners in rapid succession. Once access is obtained through weak or default credentials, attackers routinely deploy backdoors, cryptocurrency miners or pivoting malware, turning compromised hosts into stepping stones for further network intrusion. The Suricata signatures triggered by activity from 92.118.39.152 specifically indicate active session establishment attempts on expected SSH ports, confirming that this is not passive scanning but an active authentication assault against target systems.
KR 
GB 
HK