Critical Threat
IP address 80.94.92.71 is a high-risk source of malicious activity classified at threat level 10/10, with automated honeypot sensors recording over 1,700 separate incident reports spanning roughly seven months of continuous operation originating from Romanian network infrastructure.
The address, registered to AS47890 under the operator Unmanaged Ltd, generated 1,716 abuse reports from automated honeypot sensors between November 2025 and June 2026, yielding a confidence score of 84 percent and an activity frequency rating of 5/10 — indicating persistent, sustained malicious behavior rather than a brief opportunistic scan. All 20 of the most recent categorized reports classify the activity as hacking, with detection signatures consistently flagging SSH sessions established on unusual non-standard ports and protocol anomalies where only one direction of communication followed expected patterns. This signature profile strongly suggests the address is being used to probe and compromise exposed SSH services through techniques designed to evade basic detection mechanisms that monitor only standard port configurations.
The attack patterns observed — including SSH sessions on non-standard ports and bidirectional protocol mismatches — represent a calculated reconnaissance and intrusion strategy where threat actors route authentication attempts through unusual port numbers to bypass naive firewall rules and signature-based detection that assumes SSH operates exclusively on port 22. These methods enable automated credential stuffing and brute-force campaigns against any exposed SSH service regardless of its configured listening port, making traditional port-blocking alone insufficient as a defensive measure for any publicly accessible Linux infrastructure.
Organizations with exposed SSH services should immediately audit authentication logs for unusual source addresses, implement fail2ban or equivalent dynamic blocking mechanisms tuned to detect rapid authentication failures, enforce key-based authentication with password authentication disabled entirely, and ensure all SSH daemons are updated to versions supporting modern encryption standards. Network operators should also consider implementing strict outbound connection logging and rate-limiting policies to disrupt the infrastructure supporting this persistent scanning campaign.
IR 
GB