Extreme Threat
IP 92.118.39.72 is a critical-risk address that automated honeypot sensors flagged across 20 distinct detection points, accumulating 303 abuse reports between January and April 2026 with a near-uniform distribution of SSH brute-force, general hacking and exploited-host signatures.
The dataset reveals sustained malicious intent over a four-month window, with 14 recent reports categorizing activity as SSH-related intrusion attempts and an additional 14 as broader hacking behavior, while 5 reports classified this address as an exploited host being weaponized without its operator's knowledge. Suricata alerts confirm repeated SSH sessions on expected ports, indicating systematic credential-guessing campaigns rather than opportunistic scanning. Despite the unmanaged network operator designation and a zero activity frequency rating, the sheer volume of reports from multiple independent honeypot sensors yields a 70% confidence assessment that this IP poses a genuine threat to exposed SSH services.
SSH brute-force attacks remain one of the most prevalent initial-access vectors in real-world intrusions, with threat actors leveraging dictionary-based credential stuffing to compromise servers running default configurations. When paired with exploited-host classification, the scenario suggests either successful compromise of this address allowing it to be repurposed as a staging point, or deliberate use of compromised infrastructure to obscure attribution. The unmanaged ISP context implies limited or no abuse-handling responsiveness, making timely blocking the most effective defensive response.
Site operators with exposed SSH services should immediately block this address at the network perimeter and consider implementing fail2ban or equivalent log-analysis tools to auto-ban repeat offenders. Key-based authentication eliminates the attack surface for credential guessing entirely, while moving SSH from port 22 and disabling root login add friction against automated campaigns. Regular patching, intrusion-detection monitoring and alerting on anomalous SSH session establishment from this source address will further reduce exposure.
RO 
FR 
KR 
GB 
HK