Critical Threat
IP 80.94.92.40 is a critical-risk address operated by Unmanaged Ltd in Romania (AS47890) that has generated 3501 independent abuse reports over approximately three months, with the overwhelming majority of activity consisting of SSH brute-force intrusion attempts detected by automated honeypot sensors. Despite a moderate confidence score of 61%, the sheer volume of reports and maximum threat rating of 10/10 establish this IP as a significant, persistent actor in automated attack campaigns targeting exposed Secure Shell services worldwide.
The reporting window spans from November 2025 through January 2026, with detections originating exclusively from automated honeypot sensors rather than community-based sources. The equal distribution between "Hacking" and "SSH" categories (20 reports each in the most recent sample) confirms that the underlying activity is specifically credential-guessing against SSH daemons. Although the activity frequency metric registers at 0/10, the cumulative report count of 3501 indicates sustained, high-volume probing rather than a brief burst. The Romanian network allocation and Unmanaged Ltd designation suggest this infrastructure may be provisioned specifically for threat operations, which is consistent with the observed pattern of automated honeypot detections.
SSH brute-force attacks represent one of the most common initial access vectors in real-world intrusions, with threat actors using automated tooling to cycle through credential combinations against publicly accessible servers. A successful compromise grants adversaries remote command execution, lateral movement capability, and potential data exfiltration depending on the target environment. The scale of 3501 reports demonstrates that this specific IP is actively participating in distributed scanning campaigns, likely as part of a botnet or paid proxy service, systematically enumerating SSH services across the internet for vulnerable installations.
Site operators running publicly accessible SSH services should implement immediate defensive controls: enforce key-based authentication to eliminate the effectiveness of credential guessing, relocate the SSH daemon to a non-standard port to reduce automated scanning exposure, and deploy authentication-failure rate-limiting tools such as fail2ban to dynamically block repeat offenders. Additionally, restricting root login, implementing port knocking, and maintaining strict firewall policies that limit SSH access to known IP ranges will substantially reduce exposure to this category of automated threat activity.
JP 
HK 
GB