Critical Threat
IP 80.94.92.186 is a critical-risk address operated by Unmanaged Ltd in Romania (AS47890) that has been linked to 282 abuse reports since December 2025, predominantly targeting Secure Shell services with sustained SSH brute-force credential attacks at an activity frequency rated 8 out of 10. The IP carries a maximum threat score of 10/10 with 94% confidence across automated honeypot sensors and community reporting, making it one of the most actively malicious addresses in recent threat telemetry.
Analysis of the 282 total reports reveals a concentrated threat profile dominated by SSH brute-force attempts, with supporting evidence from intrusion detection sensors flagging active SSH sessions on expected ports alongside repeated authentication attacks. The detection footprint spans 20 independent automated honeypot sources, with 14 reports categorised under general hacking activity, 13 specifically tagged as SSH threats, and a single report indicating potential host exploitation. The six-month reporting window between December 2025 and May 2026 demonstrates persistent, ongoing activity rather than a transient or isolated incident.
SSH brute-force attacks represent a concrete and widespread threat where automated tools systematically guess login credentials against exposed servers, exploiting weak or default passwords to gain unauthorised shell access. Successful authentication grants attackers a foothold for data theft, lateral movement within networks, or deployment of secondary payloads including cryptocurrency miners and backdoors. This IP's consistent activity pattern and high report volume indicate it is almost certainly part of a coordinated credential-stuffing campaign, likely operating from a botnet or compromised infrastructure used as an attack platform.
Operators with publicly accessible SSH services should treat IP 80.94.92.186 as definitively hostile and block it at the firewall or network perimeter immediately. Implementing fail2ban or equivalent log-based intrusion prevention tools to automatically ban repeated authentication failures will substantially reduce exposure. Hardening measures including disabling password-based authentication in favour of asymmetric key pairs, changing the default SSH port, and restricting root login will eliminate the primary attack surface. Continuous monitoring of authentication logs for patterns consistent with the observed brute-force behaviour remains essential even after blocking known malicious sources.
