Maximum Danger
IP 80.94.92.182 is a high-risk address originating from Romania (AS47890, operated by Unmanaged Ltd) that presents a severe threat to internet-facing infrastructure, with automated honeypot sensors recording 671 abuse reports across 20 distinct detection points since December 2025. The activity frequency of 8/10 and maximum threat level of 10/10 indicate sustained, aggressive hostile operations with a 78% confidence score that this IP is engaged in malicious activity.
The dominant threat profile for this address centers on SSH-based attacks, accounting for 13 of the most recent reports alongside 13 general hacking activity reports and 2 classified as exploited host activity. Suricata intrusion-detection systems flagged multiple SSH sessions in progress on expected ports, correlating with documented brute-force authentication attempts and confirmed exploited host behavior. The report volume and detection diversity across 20 separate honeypot sensors demonstrate that this IP is not merely a transient scanner but a persistent attack platform conducting repeated intrusion operations over approximately six months of observed activity.
SSH brute-force attacks target exposed servers by systematically guessing authentication credentials, exploiting weak or default passwords to gain unauthorized shell access. When paired with evidence of exploited host status, the IP reputation concern escalates significantly, as the address may belong to a compromised system being weaponized by threat actors without the owner's knowledge, potentially routing attacks through unwitting third-party infrastructure to obscure attribution and bypass reputation-based blocking.
Site operators with exposed SSH services should immediately block IP 80.94.92.182 at the network perimeter, implement fail2ban or equivalent brute-force mitigation tools, enforce key-based authentication in place of password authentication, and disable direct root login. Organizations receiving reports of malicious activity originating from this address should consider notifying the hosting provider to alert the likely compromised system owner, and maintain enhanced monitoring for any authentication anomalies matching the observed attack patterns.
UA 
GB 
BG 
KZ 
FR 
PS 
VN