Critical Threat
IP 92.118.39.63 is a critical-risk address operated by Unmanaged Ltd in the United States (AS47890) that has generated 3,060 abuse reports across automated honeypot sensors since February 2026, with activity persisting through May 2026. The overwhelming majority of reports flag SSH brute-force attacks, and the IP has also been classified as an exploited host — indicating the device itself may be compromised and weaponized without the owner's knowledge.
The reporting data paints a picture of sustained, high-volume malicious activity. With a threat level of 10/10 and a confidence score of 94%, the 3,060 reports across 20 honeypot sensors represent widespread automated detection. The February-to-May 2026 timeframe spans approximately four months of continuous activity, and an activity frequency score of 8/10 confirms consistent, repeated attack attempts rather than opportunistic probes. The 38 combined Hacking and SSH category reports, alongside 2 Exploited Host designations, suggest this address is actively engaged in credential-guessing campaigns against exposed SSH services while simultaneously being flagged as a compromised attack platform.
SSH brute-force attacks target publicly accessible servers by systematically guessing username and password combinations until valid credentials are found. The dual classification as both an active attacker and an exploited host compounds the risk: the IP may represent a hijacked system that its legitimate owner is unaware is being weaponized, making it difficult to remediate through conventional abuse-notification channels. If successful, attackers gain unfettered shell access, enabling data theft, lateral movement into internal networks, or deployment of secondary payloads such as cryptocurrency miners or ransomware.
Site operators with exposed SSH services should block this IP at the network perimeter or firewall level and monitor for any matching authentication attempts in their logs. Switching to key-based authentication, disabling root login, and changing the default SSH port significantly reduce brute-force effectiveness. Deploying automated dynamic blocking tools such as fail2ban can proactively ban repeat offenders. Additionally, organizations receiving reports linking their infrastructure to this address should investigate potential host compromise and consider notifying the upstream provider regarding the exploited host classification.
RO 
MX