Maximum Danger
IP 92.118.39.37 is a critical-risk address evaluated at a 10/10 threat level, definitively associated with sustained SSH brute-force intrusion attempts against exposed servers worldwide. This IP has accumulated 260 separate abuse reports across automated honeypot detection networks between August 2025 and March 2026, making it one of the most persistently reported addresses observed within that timeframe.
The threat intelligence surrounding 92.118.39.37 draws from 20 distinct automated honeypot sensors that collectively documented Hacking (19 reports), SSH (18 reports), and a single Exploited Host classification. Network routing places this address within AS47890 operated by Unmanaged Ltd, a US-based autonomous system whose "unmanaged" designation aligns with its use as an active attack platform rather than a typical residential or business endpoint. Suricata intrusion-detection signatures specifically captured SSH session establishment attempts on expected ports and documented active SSH command activity consistent with compromised-host behaviour, suggesting this address may be functioning both as an attack launcher and potentially as a partially compromised system itself.
SSH brute-force attacks represent one of the most common and effective initial-access vectors in credential-based intrusions. Automated tools systematically cycle through username and password combinations against exposed SSH daemons, exploiting weak or default credentials to gain shell access. Once inside, threat actors deploy backdoors, cryptocurrency miners, or pivot further into victim networks. The 260 reports linked to this address indicate sustained, high-volume assault campaigns rather than opportunistic probe-and-move activity.
Network defenders encountering this IP in logs should immediately block it at the firewall or network edge and implement fail2ban or similar rate-limiting rules to throttle repeated authentication failures. Transitioning SSH services to key-based authentication, disabling root login, and moving default port 22 to a non-standard port substantially reduces exposure to this attack category. Logs should be audited for any successful authentication events originating from this address, and hosting providers should be contacted regarding the abusive activity observed from their infrastructure.
RO 
KR 
GB 
HK