Severe Risk
IP 92.118.39.84 is a high-risk address linked to sustained SSH brute-force attacks and broader hacking activity, with a threat level of 10/10 based on 545 total abuse reports filed against this address across a seven-month window from September 2025 through March 2026.
Security sensors operated by the community detected the hostile activity originating from this IP, which traces to Unmanaged Ltd operating under ASN AS47890 in the United States. Of the recent reports, 20 cite general hacking activity while 18 specifically document SSH intrusion attempts, and an additional 2 entries flag this address as an exploited host being leveraged as an attack platform. The detection confidence stands at 67 percent, and despite the elevated threat level the observed activity frequency rates as minimal at 0/10. Network telemetry from Suricata intrusion-detection systems confirms active SSH sessions on expected ports alongside ongoing brute-force credential-guessing patterns, indicating a determined effort to compromise exposed SSH services.
The dominant threat posed by 92.118.39.84 centres on automated SSH brute-force attacks designed to guess server credentials and gain unauthorized remote access. These credential-stuffing campaigns exploit weak or default passwords to infiltrate Linux servers and network appliances that expose port 22 to the internet. When successful, attackers can establish persistent backdoor access, exfiltrate sensitive data, or pivot deeper into internal networks. The exploited-host classification raises an additional concern that this address may itself be running on compromised infrastructure, allowing malicious actors to conduct attacks while concealing their true origin.
Administrators with publicly accessible SSH services should immediately block IP 92.118.39.84 at the firewall level and review blocklists to ensure comprehensive coverage. Enforcing key-based authentication exclusively, disabling direct root login, and changing the default SSH listening port substantially raise the bar for automated attacks. Deploying dynamic rate-limiting tools such as fail2ban can automatically ban sources after repeated failed login attempts. Finally, reviewing authentication logs for any matching brute-force patterns originating from this address will determine whether any prior compromise attempts succeeded.
RO 
HK 
UA 
GB