Check an IP Address, Domain Name, Subnet, or ASN
92.118.39.87 has a threat confidence score of 100%. This IP address from United States (AS47890, Unmanaged Ltd) has been observed in 78,753 honeypot sessions and reported 55 times targeting SSH protocols. Detected attack patterns include dual source gpu validation with host context, pci and nvidia gpu identification with host metadata. First observed on January 20, 2026, most recently active April 18, 2026.
Combined execution of lspci (VGA and 3D controller extraction and device count) and nvidia-smi -q (product name extraction and non-empty count validation), together with kernel/architecture (uname -s -v -n -r -m) and uptime collection. This pattern reflects cross-validation of GPU presence using both PCI-level and NVIDIA driver-level queries, enriched with host system context.
Execution of uname -s -v -n -r -m to collect kernel and architecture details, uptime -p for system uptime, lspci queries to extract and count VGA-class PCI devices, and nvidia-smi -q filtering for product name to identify NVIDIA GPU models. This pattern reflects layered GPU identification using both PCI enumeration and NVIDIA driver-level queries, combined with basic host system metadata collection.
Identifies SSH sessions where the actor performs structured hardware reconnaissance including CPU core enumeration, GPU detection via nvidia-smi, VGA/3D controller inspection via lspci, system uptime queries, and kernel/architecture fingerprinting to assess computational capabilities of the compromised host.
Execution of uname -s -v -n -r -m to collect kernel and architecture details, uptime -p for human-readable system uptime, and lspci queries to extract VGA-class PCI device descriptions and count the number of VGA devices. This pattern reflects PCI-level GPU identification combined with basic host system metadata collection.
Execution of uname -s -v -n -r -m to retrieve kernel and architecture details, uptime -p for human-readable system uptime, and lspci | grep VGA | cut -f5- -d ' ' to extract VGA-class PCI device information. This pattern reflects lightweight host profiling combined with basic GPU identification.
| Reporter | Date | Category | Protocol | Comment |
|---|---|---|---|---|
| User | Mar 28, 2026, 24:53 | Brute Force | SSH | Fail2Ban Report - Bruteforce attempt |
| User | Mar 28, 2026, 24:15 | Brute Force | SSH | Fail2Ban Report - Bruteforce attempt |
| User | Mar 27, 2026, 23:37 | Brute Force | SSH | Fail2Ban Report - Bruteforce attempt |
| User | Mar 27, 2026, 21:40 | Brute Force | SSH | Fail2Ban Report - Bruteforce attempt |
| User | Mar 27, 2026, 21:02 | Brute Force | SSH | Fail2Ban Report - Bruteforce attempt |