Critical Threat
IP 92.118.39.71 is a critical-risk address associated with 296 abuse reports from automated honeypot sensors, primarily linked to SSH brute-force intrusion attempts against exposed servers. With a threat level of 10 out of 10, this IP represents an active and persistent threat to network infrastructure, though the moderate 59% confidence score indicates some uncertainty in attribution. The activity is concentrated in August 2025, with the majority of recent reports categorizing the behavior as hacking activity and SSH-specific attacks.
Network intelligence places IP 92.118.39.71 in the United States, operating under AS47890 owned by Unmanaged Ltd. The volume of reports is notable—296 total submissions from 20 separate honeypot sensors—which suggests coordinated scanning behavior rather than isolated probes. The reported threat categories split between general hacking attempts (13 reports) and SSH-specific activity (7 reports), with sanitized detection notes confirming SSH brute-force patterns captured by honeypot event logging. Despite the high report count, the activity frequency metric registers at 0 out of 10, indicating that while the IP has been widely reported, recent or continuous scanning activity may have decreased or been distributed over time.
SSH brute-force attacks remain one of the most common initial access vectors for unauthorized server entry. Attackers systematically attempt credential combinations against exposed SSH services, exploiting weak or default passwords to gain shell access. Once inside, threat actors can deploy backdoors, exfiltrate data, or use the compromised host as a pivot point for lateral movement within a network. The volume and distribution of reports for IP 92.118.39.71 suggest automated, opportunistic scanning likely conducted by botnets or credential-stuffing toolkits targeting any accessible SSH daemon on the internet.
Organizations running publicly accessible SSH services should treat this IP as high-priority for blocking or rate-limiting. Immediate defensive measures include implementing key-based authentication to eliminate password-based login vectors, moving SSH to a non-standard port to reduce automated scanning exposure, and deploying tools such as fail2ban or similar intrusion-prevention solutions to automatically ban repeated authentication failures. Regular auditing of user accounts, enforcement of strong password policies, and monitoring honeypot or firewall logs for connections originating from this address will further reduce risk exposure.
RO 
BG 
GB 
SG